hey everyone welcome back to today in tech I'm Juliet Beauchamp I am here with
industry analyst and author Chase Cunningham we're talking about deep
fakes to stick around chase thank you so much for calling in really appreciate it
calling all the way from DC right yeah just outside of DC out in the on the
country so it's isolated whether I like it or not maybe for the best right now
so as I mentioned before we're obviously talking about deep fakes but who better
to explain what exactly a deep fake is the new so could you tell us what
exactly a deep fake is and how they're made there's there's actually a variety
of deep face if you will the one that most people are commonly referring to
when they talk about deep fakes is the video versions you've probably seen this
stuff online where Tom Cruise's face is put on to Bill Hader and Schwarzenegger
space is put on to Bill Hader or the Obama one is everyone's relation value
with but essentially what they're doing there is they're taking an image like
the image of me and they're using graphics capabilities to put another
person's image over it but because of the way that you're using the sort of AI
and a machine-learning back in you can make it look very realistic that's the
one most people are familiar with the other types that are out there that are
starting to show up more often now is voice thanks and Reid thinks and voice
fakes are basically where I take a recording of your voice I use an imprint
to build a model of it and then I put other people's words on your voice and
send it to folks which obviously can be very bad and then the last one is a read
fake which is using an artificial intelligence really a machine learning
engine to generate fake text and those are actually pretty interesting seeing
some of the stuff that those machines are able to come up with on their own
right so what do you think goes beyond an impression or even something that
seems that like it's deliberately false for example in the case of Reid fakes is
the difference between a Reid fake and just something that someone wrote to be
deliberately false is the fact that the Reid fake is AI generated yes
about this in my book really there was an a researcher that came up with her
read fake and wanted to see if he could input a whole bunch of Shakespeare and
then let the Machine generate a Shakespearean play and it did and
interestingly enough it was good enough that he sent it off to some folks and
they bought they thought that it was actual real Shakespeare that had just
never been discovered and it was totally generated by a machine deep fakes
obviously seem like quite a big threat for I mean industries across the board
so what is the appeal of a potential bad actor using a deep fake so the real
appeal there is you know we whether folks one of reels are now we kind of
derive our perception of reality now based off of what we see online I mean
if you think about it you get your news you get your video from YouTube and
Twitter and LinkedIn and all those things well if you're I'm malicious
actor and you can't get an exploit or a hack to work because network security is
better than it used to be the next best thing is to go after individuals that
are c-level executives and those type of folks and basically come up with a fake
video or video or graphic or something that shows them doing something that is
compromised if you could picture you know like the CEO of Ford Motor
Company's saying something that was essentially hate speech you can really
cause detriment to an organization in it by the time they can respond it's
accepted as reality and then they have to work their way backwards so it's it's
very damaging so do you see the use of deep fakes as sort of a way that hacking
has evolved I know in your book you sort of mentioned this as like hacking
reality do you see it as the outcome of perhaps better security measures on an
enterprise's part well so I think what we're we're seeing is that the the old
sort of exploits and malware have kind of hit their threshold I mean you can
still cause some exploitation and damage with those but this stuff continues to
evolve and where we're going to see this happen
more in the future is if you're familiar with ransomware you know ransomware you
get a person's machine and then you basically tell them to pay up or
whatever well imagine if you came up with fake videos and imagery in text and
essentially put that on someone's hacked Twitter feed and said look if you don't
do what I want I'm gonna post this online to a million followers and that
could get really really bad really really fast
Wow yeah so what are the implications for this beyond an enterprise I mean the
natural thing that I'm thinking of it's obviously an election year here in the
United States I mean that here in the US we are acutely aware of even with the
chronic virus crisis ongoing I would imagine that this could be a serious
serious threat for elected officials yeah that's the one that actually
worries me the most you know corporations can kind of deal
with this phone when you're dealing something as dynamic as an election
cycle where there's a vested interest for nation states to cause Haiti
discontent this is the perfect opportunity and you know the the fact
that these candidates live and breathe by what their perception is online which
comes from video and text I'm is a very very open Avenue for exploitation so if
I'm the citizen and I see my elected official posting something that seems
outwardly hateful and seems to cause some sort of large controversy how can I
tell whether or not it's fake isn't the sort of draw of deep fakes that for
hackers at least or bad actors is that they're really really difficult to
distinguish if they're real or not good ones are yeah the good some of the ones
that you see from the you know less perfected agents are kind of comical
most of the time you can tell they're pixelated and you can pick up
something's weird there there was one a while back with Nancy Pelosi and another
one with Hillary Clinton that was very quick to tell that something wasn't
right but really when you're thinking about these type of things I typically
call it the rule of three you know take two your information from three
different sources you know and get it from something that you know and you
commonly look at something that you've never looked at and you
don't really know and then something that is totally orthogonal to the
storyline and then make a decision based on that and if you do those things while
let me take you a little bit longer you have a better chance of actually
responding intelligently to the issue right and but I would imagine that some
people aren't going to necessarily take those steps to perhaps think critically
or sometimes it just seems but just believable enough that they take it as
fact I would imagine that also with the use of social media a deep fake video or
any sort of other deep fake audio or read fake could spread rapidly yeah I
mean this this is gasoline on fire and all it takes is one person I wrote about
this too about influencing the influencers and if you if you're doing
this intelligently as an adversary you target someone that has lots and lots of
followers that typically will respond at an emotional level based on the
information they put in front of them and when you get that emotional response
right you see something this is wrong and then they go off and fire storm it
out to the the internet it just it just takes off like a rocket ship and you
don't have to go after a candidate you go after someone that is tangental to a
candidate maybe they're their kids or someone else that's an influencer that's
tied to them right and then it can become a bit of a dumpster fire much
like what's going on behind you right now
so let's say you know you've been deep faked and at first glance it might seem
like the people who are most at risk for being deep faked as it were are
politicians you know the heads of companies but like you just said it
seems like it could be kind of anyone yeah the biggest thing here is to have a
sort of knowledge of what's out there that's relative to your your persona and
to be able to respond oh and it's one of those things where and if you kind of
look at what happened with the Pelosi and Hillary Clinton and whatnot and some
of the others that are in that line the response has to be very quick and it has
to be something where you are saying like this was not me I don't agree with
this I you know this is totally against my personal beliefs they cannot just
speak something of no that wasn't me like
there has to be a vector in response to it because you're you're combating an
emotional response from the masses right and what can that response even possibly
begin to look like I mean I you know I I trying to put some of this as
theoretical possibilities in the book but I mean you could imagine especially
before we going on now with kovat I have this imaginary scenario of the deep fake
showing up in a particular area where there is a lot of Kovac cases and some
some pharma organizations saying we have a cure however we don't have enough and
we're only going to give it to this group of people and if you do that I
mean you imagine the fallout from that and it would be instant mm-hmm yeah I
can imagine that that would be it would spread also just like wildfire mm-hm
riots that might lose you know human life over something like that so do you
think it's wise for people enterprise's politicians anyone who could be at any
sort of risk for being deep picked you have and plan out their potential
response now yeah they should and you know this is this as well as ones where
I do a lot of work on Capitol Hill and there's been some early you know
conversations around how to combat this at scale honestly those solutions aren't
present in the market yet but the reality of it is just like they have
disaster planning and contingency planning they should have some sort of
plan ready for this when it does happen because it's going to happen I think
there was recently a disinformation campaign around kovin where they were
saying the US Army was the one that built Cova didn't released it to the
masses and there were people already jumping on Facebook saying oh you know
the Army is doing this it's all the us against us and this is a big conspiracy
and by the time logic dialed in on that it was pretty far down the rabbit hole
so I'm thinking now as deep fakes I have to imagine continue to spread and
continue to gain popularity and I would also assume only become more convincing
as AI and m/l technologies advanced what's you are
probably left with a public who's really skeptical not sure of what's true and
what's not so I mean in some sort of perhaps dystopian as it may be future I
could foresee someone intentionally releasing a deep fake something that is
inherently false false information and a fake person portraying it and say nope
this is real and then the public just doesn't know who to believe yeah so if
you if you follow some of the nation state level directives around this you
know Russia basically literally says in their campaign guidance that chaos is
the goal it's one of those things but they don't have to necessarily win by
just degradation and eliminating the enemy if they can cause enough strife
and discourse and chaos they still win by just the nature of people having to
respond to it and continue to claw through that process right and in that
way it can seem that whatever goal the person who was being deep faked was
trying to accomplish is just I does whatever plan any someone or gold that
someone is trying to accomplish immediately take a back seat once
they've been deep fakes just does reaction and denying a deep fake
immediately come first it I mean I think it has to if you if you I mean you can
look at what happened with Starbucks a little while ago or they had the police
issues with the you know ethnicity and all that and Starbucks actually
responded extremely quickly to it covered the social media angles and they
were able to minimize the impact to the company based on that response and then
you look at some folks that like Wells Fargo and a few others that have had
similar source of instances that kind of sat back and say we'll just let this
blow away and the gasoline was already on the fire and by the time they got to
it it was a raging inferno got it so I guess before I let you go chase how
we may have a lot of viewers who are c-level executives within their
enterprises or have some sort of relationship to a high
powered person and they might be wondering how do I prevent a deep fake
of me is that even possible I don't think you can prevent a deep fate just
like you can't prevent a hack or you can't I mean you can't prevent yourself
from getting sick really what you can do is take intelligent sort of steps to
make sure that you have an ability to handle it when it does occur and be
ready to respond this is one of those things where it is not a matter of if
but it's a matter of when and how bad and if you if you have a plan in place
and you follow and you respond intelligently you can probably deal with
the fallout the single worst thing that organizations can do is ignore this and
then let it happen right security is always sort of about mitigating risk
right and never about completely solving the problem yeah and it's you know if
you're able to respond to it you're you may be throwing water on a raging
inferno but eventually the water will start helping out right so where do you
see deep fake technology maturing and growing in the next few years I think
that where we're gonna continue to see this is the evolution of this just like
we saw with malware where it used to be you had to be a exploitation engineer
and computer scientists to write malware and whatnot and now you can just buy it
and use it the next iteration of this is going to be just like that where this is
going to become easy to get easy to use deployables there's already some sites
that are offering I think it was like five to seven dollars an hour to
generate deep fakes you know so it's going to become more prolific as those
costs and as those technical requirements drive southward I have to
also wonder what sort of efforts are being made to combat it I've seen sort
of reports of AI tools that you know instead of creating deep fakes are
really trying to search effectively to distinguish real versus fake is there
any sort of promise in that yeah some of the early conversations at the you know
grand level are around leveraging distributed ledger systems to kind of
tag real videos and real and then anything else that comes out
that is not is basically considered a a fake until proven otherwise
which is interesting in its approach but you know the other problem that we run
into is the amount of information that we generate now on a given day is so
astronomical you know so chase before I actually let you go this time is there
anything else about defects that you want our viewers to know I really think
that it's a concept that everyone should figure out you know how they plan to
respond to it and understand the intricacies of it and just like with
anything in the security space you should know how we plan to deal with it
not if great well thank you so much chase I really appreciate it this was
super interesting if not as I mentioned before a little bit concerning but this
is really great information for anyone perhaps CSO CISOs to help develop a plan
now for response before there were the target of a deep big attack yeah thanks
for having me you know you know if you're really looking for the
down-and-dirty on it I happen to know somebody wrote a book about it and we
will certainly be linking chases book in the description below for anyone who is
interested about learning even more really really interesting stuff it's the
kind of thing that you it's you it's worth a read to see just how these deep
fake attacks actually happen more than we can cover in you know a 15 to 20
minute video right thank you very much thanks and thank you all so much for
watching this episode of today in tech if you like this video be sure to give
it a thumbs up and subscribe to our Channel
if you've any questions or comments about deep fix please leave a comment
below I'll try my best to get back to you thanks again for watching and we'll
see you next time