﻿- Social engineering attacks cost companies more than a billion US dollars annually. These
attacks are usually initiated through text or email spoofing to obtain access to important
accounts and databases. However, companies and governments are slowly starting to catch up,
making it harder and harder for criminals to be successful or to even just get away.
Recently though, these criminals have started to utilize something else to trick these companies:
artificial intelligence. The rise of AI has paved the way for a new era of social engineering,
which is already being used by criminals to carry out a new wave of massive heists. One such case of
an AI-powered social engineering attack peaked my interest because it stood out from the crowd
netting the perpetrators over 35 million US dollars whilst staying completely anonymous.
To find out how the criminals managed to harness the power of AI to pull off this elaborate heist
with such ease, I had the dig through countless news sites, court documents and hacker forums,
but to make sense of all of that, we first need to understand what social engineering is,
and how it usually works. Chapter one, introduction to concepts. You see, not
just anyone with a MacBook Pro and some free time can hack into companies. Purely technical access
points have started to dry up over the years and the new security systems being implemented
are airtight and can detect intrusions instantly to restrict malicious access, essentially making
most of them impenetrable fortresses that very few hackers can get into. Of course,
there are still technical vulnerabilities but with these new defenses, the barrier to entry
of hacking and actually being successful with it has risen quite a bit, and criminals are always
looking for the path of least resistance. So they found different ways to infiltrate their
targets and their thinking was simple. If we can't gain access to their systems on our own, let the
employees of our targets do it for us. Over time, they develop ways of tricking people into exposing
critical information, essentially treating them as exploitable vulnerabilities. It started out
with simple schemes, such as phishing attacks where employees would receive spoofed messages,
prompting them to insert their passwords. This eventually moved on to more complex methods,
like gaining access to sensitive information by dumpster diving, or even faking a romantic
interest to an employee so the hacker could gain physical access to the servers. For instance, the
security firm RSA lost an estimated $66 million in 2011 because of a relatively straightforward
social engineering attack. The attack was launched when a malicious Excel file was sent via email
to a select group of workers. The email subject line read recruitment plan and the file attached
gave the hackers a backdoor into the system. However, businesses attempted to fight back,
which eventually forced social engineers to evolve in their search for the security chain's weakest
link, and their ability to exploit human trust as a vulnerability. One of the ways that they
did this was through spear phishing which is what took social engineering to the next level.
Spear phishing was one of the most important evolutions in social engineering. You see,
when companies started upping their security, it was hard to infiltrate systems by compromising
low-level employees, so they needed to compromise higher-value targets who are also on average more
informed about social engineering attacks and less likely to fall for them. To have any chance
of success, the attack would need to be very carefully thought out, planned and executed,
and so the attack is personalized on the victim's interest, using a plethora of
open source intelligence data to increase the likelihood that they'll fall for it. Such was
the method of the biggest social engineering attack of all time that was perpetrated
by Lithuania national Evaldas Rimasauskas against two of the world's biggest companies,
Google and Facebook. Rimasauskas and his team set up by fake company pretending to be a computer
manufacturer that worked with Google and Facebook. The scammers then sent phishing emails to specific
Google and Facebook employees, invoicing them for goods and services the manufacturer had genuinely
provided but directing them to deposit money into their fraudulent accounts. Between 2013 and 2015,
Rimasauskas and his associates cheated the two tech giants out of over $100 million. Of course,
he was later apprehended and charged with his crimes. With such a high-profile case taking
place, cybersecurity firms and companies started catching up once again by constantly improving
employee training and their physical location security protocols, making these nefarious acts
harder and harder. So hackers again had to come up with new ways to exploit people's trust so they
could keep pulling off their heists. And in March of 2016, as AI started being introduced to the
mainstream with technologies such as Tay AI and AlphaGo that showed the advancements in critical
thinking and understanding of concepts through AI, some social engineers saw the potential behind AI
and knew exactly where to turn for their next scheme. You see, the ability of AI to quickly
capture and analyze data makes it a perfect tool in unleashing spear phishing attacks.
AI can allow cyber criminals to generate highly targeted links, websites and emails based on open
source intelligence data. For example, AI can look at a user's Twitter post to learn about
them or find out what they care about most. This AI could then then use that information to make a
personalized email, essentially automating spear phishing. When spear phishing is automated for
hundreds of employees, criminals get into almost any system no matter what technical security
measures a company has put in place. However, the riskiest application for AI currently would
be deepfakes. Deepfakes, as we know them, are fake videos created using digital software,
machine learning and face swapping, and the results can be quite convincing. However,
audio can be deepfake too to create voice skins or voice clones of public figures. Such voice
synthesis software can copy the rhythms and annotations of a person's voice and can be
used to produce convincing speech, opening the possibility for impersonation on a completely
new level. Something that might even be more concerning is the fact that a significant quantity
of deepfake software can be located on GitHub, which is an online community for the open source
development of a software. And some of these apps are used purely for entertainment purposes,
which is why the creation of deepfakes isn't illegal. However, it is still a way for criminals
to get professional AI deepfaking software without the need for that much preparation or technical
knowledge. An AI-powered social engineering attack first appeared in 2019 when the CEO of a
UK subsidiary of a German energy firm paid nearly 200,000 pounds to a Hungarian bank account after
being phoned by a fraudster who used deep voice technology to mimic the German CEO's voice. Even
more chilling is the fact that the individuals responsible have not been apprehended to this day.
Chapter two, the $35 million heist. Still, this 200,000 pound heist would feel insignificant next
to the 35 million USD heist a group of social engineers pulled off. On January 15th of 2020,
according to Emirati authorities, the branch manager of a company whose name remains redacted
in the official filing received a call that claimed to be from the company headquarters.
The caller sounded like the director of the company so the branch manager believed the
call was legitimate. This branch manager also received several emails that he believed were
from the director of the company that were related to the call. The caller told the branch manager by
phone and email that the victim company was about to acquire another company and that a lawyer named
Martin Zelner had been authorized to coordinate procedures for the acquisition. The branch
manager then received several emails from Zelner regarding the acquisition, including a letter of
authorization from the director to Zelner. Because of these communications, when Zelner asked the
branch manager to transfer 35 million US dollars to several accounts as part of the acquisition,
the branch manager followed his instructions as he should. However, as you might have guessed,
the call was not from the director of the company but a fraudster using deep voice technology to
replicate the voice of the director. According to an Emirati investigation, the fraudster worked
with at least 17 known and unknown culprits to execute the scheme, funnel the funds abroad,
and then launder them, meaning that many of the culprits still remain anonymous and are
most likely now out there enjoying a significant cut of the money or even worse, scheming for their
next target. Even if they aren't, just imagine how many more businesses are following victim to
this kind of fraud now that AI tools are becoming accessible to the general public, especially after
hearing that these kinds of schemes are successful and go unpunished. However, not all hope is lost.
While AI has started being used by criminals, it has also started being used to defend against
them. Businesses, ethical hackers, coders and cybersecurity firms have banded together and
are making concentrated efforts to find ways to combat this type of crime using AI. The
development of such tools, such as AI, phishing, email detectors, deepfake recognition software
and virtual risk officers help security and IT professionals identify the risks posed by social
engineering at the user group and organizational levels. Powered by machine learning, such tools
analyze and learn from an organization's current and historical email data and protect employees
against inbound email security threats, including whaling, CEO fraud, spear phishing and other
targeted social engineering attacks. However, as security a systems advance, so do the methods that
the hackers will use, starting what will likely be an endless arms race between hacker AI and
cybersecurity AI with experts believing that in the future DeepFakes will become far more
sophisticated as technology further develops and might introduce more serious threats to the public
relating to election interference political tension, and additional criminal activity and
it doesn't just end with deepfakes. AI could be built specifically to help scammers in abusing
human emotion and exploiting our way of thinking. Imagine a world where any message you get could
actually be an AI tailored to specifically earn your trust and scam you. While that might sound
like something far in the future, just a few years ago, accurate voice and video synthesis were also
just sci-fi. Now it is something available, open source and free. So if one thing is for certain,
the AI we've seen so far is only the beginning and what the future of technology holds remains
a mystery. Thanks for watching. If you enjoyed the content, consider becoming a member, a patron, or
simply disliking and subscribing to help out with the algorithm. Thanks again and have a good night.