British engineering giant Arup revealed as $25M deepfake scam victim

126 points by gds44 1 year ago | 102 comments
  • bartlettD 1 year ago
    > According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.

    Regardless of the sophistication of the deepfake, surely this rings huge alarm bells, right? I'm not even sure I'd be comfortable making secret transactions on instruction from my boss. Even if your boss is actually asking you to do this, how can you have the financial authority to transfer $25M and not the savvy to think that being asked to transfer huge amounts of money in secret isn't going to result in you getting thrown under the bus?

    • michaelt 1 year ago
      The scammers usually have a slightly unusual, but plausible (and urgent) story.

      For example, that they've just closed a deal to buy a startup - a negotiation which was of course conducted in secrecy. It's a startup in another country, which is why we're all out of the office. Timezones are why you've received the request outside of normal working hours. And we've got to, um, close the deal so we can announce it outside of stock market opening hours, for both countries. To close the deal we've got to pay 10% of the 250M purchase price upfront. If you can't get this done within 2 hours the deal will fall through.

      • csomar 1 year ago
        Secret doesn't mean illegal. Unless something is illegal, this guy doesn't have any input and it's up to the auditor to verify the legitimacy of the transactions.
        • llamaimperative 1 year ago
          Big transactions happen and it’s some people’s jobs to execute them
          • Semaphor 1 year ago
            "in secret" is the issue
            • netsharc 1 year ago
              I guess a scammer can sell it as "we're buying something significant [another company?], this will affect our share price if the info goes out, so you need to sign this NDA and keep this quiet, you're only 1 out of 10 people who knows this...".

              They could also sell it as payment for an e.g. consulting firm for the above secret deal...

              • pjc50 1 year ago
                "Confidentiality" is entirely normal; since many deals such as takeovers rely on your competitors not knowing until it's happened, it's not unusual for this information to be restricted within the company on some sort of need-to-know basis.

                Authenticating transactions is going to be an increasing problem in the presence of deepfakes, though.

                • ajsnigrutin 1 year ago
                  There are many secrets in business, especially in realestate.

                  Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.

                  • amelius 1 year ago
                    Doesn't SAP have a workflow for that?
                • vintermann 1 year ago
                  Maybe high-up workers are asked to do secret/illegal stuff more often than we think.
                  • helsinkiandrew 1 year ago
                    > Regardless of the sophistication of the deepfake, surely this rings huge alarm bells, right?

                    Its a company with revenues of a couple of billion and that probably sub contracts thousands of other companies on projects around the world. The finance department is probably sending similar payments regularly.

                    Most payments will be "secret" in that the amounts won't be made public to employees that don't need to know. The company maybe, for example, be repeating work that has been already been done in house so doesn't want it known inhouse what companies are being paid.

                    • markogrady 1 year ago
                      I've heard this happening for a local company with about £9 million with a similar email scam. Supposedly, the person who transferred the money was competent and clever. With that amount of money, saying you don't need to ask questions, in part, is very convincing.
                      • el_oni 1 year ago
                        Yeah, this would at least cause me to email my boss and say "Can you just confirm, you want me to transfer $25 million to this account? I'll hold off until you give me confirmation in writing"

                        hell i do this if our tester hasn't managed to go over some aspect of our release. That way i get in writing from the product owner that he has OKd it, and if he sends me a teams message i ask him to email me confirmation.

                        • Tao3300 1 year ago
                          Reminds me of that old urban legend about the trader who ordered the coal futures that eventually showed up as actual coal. In that story there's always an element where the subordinates who have to carry out the transactions have been abused to the point of never questioning his decisions.
                        • chasd00 1 year ago
                          Yep sometimes I go so far as printing the email and sticking it in a meatspace folder on my desk. Just depends on how important that sign off really is and the consequences of not being able to produce it.
                        • miohtama 1 year ago
                          If you are a boomer company that does not know how online works, then you can also afford a boomer-style business class flight tickets to do a secret $25M transaction face-to-face.
                        • tompccs 1 year ago
                          I said this over a year ago elsewhere:

                          Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy.

                          AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans.

                          Until such a time as we live in a Bladerunner-like world of Replicants, being in-person will be the only reliable way to convey a message from human to human.

                          I'm long on travel and in-person meetings, short on VR and telecoms.

                          • masto 1 year ago
                            When I'm on a company video call, the people I'm meeting with are logged into their company accounts, through the fancy company authentication system. Large warnings are displayed if there are any external participants, and I wouldn't be surprised if it's possible to disable the ability to even have guests. Third-party video conference software is banned and blocked from installation on work computers.

                            I am not in the finance department, but in software engineering and operations, two-party controls are everywhere. I can't check in code without reviews. I can't access production systems or make changes without approval from another team member. I would think that similar processes could be put into place for transferring tens of millions of dollars.

                            In other words, there are ways to deal with this that don't come down to "mistrust all technology and revert to face-to-face meetings and handing cash to each other".

                            • michaelt 1 year ago
                              If I was the attacker, I'd use credential-stuffing or something to get access to some random employee's account. Doesn't have to be anyone important.

                              Then I'd set up a short-notice multi-way meeting between the target, the CEO and the hacked account. The deepfake 'CEO' then turns up with no alarms raised, except one wrong name - easily dismissed as a glitch, or an assistant having booked the meeting.

                              • echoangle 1 year ago
                                So your method assumes you can easily take over an employee account? Isn't that the hard part?
                                • david_allison 1 year ago
                                  $10k/week in crypto lets you easily 'hack' a random corporate account
                                  • r00fus 1 year ago
                                    But that CEO account would be marked as (guest/unverified) in Teams or Zoom.
                                  • bongodongobob 1 year ago
                                    Almost everywhere I've worked disallows external participants on Teams by default. We add exceptions when needed. I don't know if this is standard, but has been at the larger companies I've worked at.
                                    • onion2k 1 year ago
                                      I imagine the people at Arup who fell for the scam were confident in their systems protecting them too.
                                    • changoplatanero 1 year ago
                                      Isn't it also possible to scam people in in person meetings by pretending to be someone you aren't? The new thing with deepfakes is that you can pretend to be someone that the victim knows.
                                      • tompccs 1 year ago
                                        Yes but the cost is much higher as is the risk of being caught and arrested.
                                        • another-dave 1 year ago
                                          When you say in-person in that sense, do you mean video call rather than DM?

                                          I took the GP comment to mean truly in-person, like face-to-face across a table

                                          • 1 year ago
                                          • tgv 1 year ago
                                            Yes, you can also bludgeon someone to death with a rock, but that doesn't mean it's a good idea for everyone to have nukes.
                                            • cageface 1 year ago
                                              Scaling up in-person fraud is also much, much harder.
                                            • dmos62 1 year ago
                                              What you said only applies to communication that requires authenticating a party. Most cases that doesn't matter. Voice or video communication used to be inherently unfakeable, now that it is fakeable, we'll just treat it like text comms, relying on secure channels, signing etc.
                                              • spacebanana7 1 year ago
                                                Human written text has been indistinguishable from machine written text for a very long time. We've still managed to maintain chains of trust to discern legitimate messages with decent success rates.
                                                • mulmen 1 year ago
                                                  Or we’re really bad at detecting fraud.
                                                • persnickety 1 year ago
                                                  > making computer-generated chatter and images indistinguishable from messages sent by humans.

                                                  That's a false dichotomy. "computer-generated chatter and images" ARE messages sent by humans. There are no cases of computers having agency known to me yet. The root of the problem is humans who lie and mislead. Now they merely have more avenues to do so. In the same vein, you could blame the electronic engineers for allowing people to lie quickly and over vast distances.

                                                  • jessetemp 1 year ago
                                                    Not that it changes your point much, but AI research also took decades. It’s just that the last few years are when all these milestones were achieved
                                                    • mrkramer 1 year ago
                                                      Guess what? Cryptography exists.
                                                      • noAnswer 1 year ago
                                                        Cryptographically sign all the things!!!!! A L L T H E T H I N G S !!!!
                                                        • blitzo 1 year ago
                                                          We need new ident protocol just for AI. I think that's part of Altman doing that orb thingy with iris scanner. It's creepy though and I'll never touch that things.
                                                          • malermeister 1 year ago
                                                            What's wrong with good ol' private keys?
                                                            • Muromec 1 year ago
                                                              Same as with public transport. You can’t have because it’s haram for some political position
                                                              • pjc50 1 year ago
                                                                PKI is a pretty old idea. People were trying to deploy it in the 90s. It turns out that managing the issuing and authentication of keys, as well as keeping them secure and if necessary revoking them, is such a huge headache that few organizations have managed to do it properly. It might be possible to do better now with TPMs in laptops and phones; essentially this is why Apple Pay is now slightly more trusted than plastic cards.
                                                                • ben_w 1 year ago
                                                                  The ability to make an infinite number of them.

                                                                  And that most people have no idea how to verify any ID, so they need a system that turns any given form of ID into a nice and simple "yes" or "no".

                                                                  I'm not at all clear what kind of ID is going to be genuinely useful for video calls, given we should only be trusting existing contacts anyway? But those things are why "private key" isn't sufficient in isolation.

                                                              • sgt101 1 year ago
                                                                Just use a trusted channel?

                                                                I mean - we have authentication for bank accounts, why wouldn't that be demanded for transactions like this? Without proper authentication of the authorities there's no way that a transaction like this should be put through.

                                                                • ta93754829 1 year ago
                                                                  we're probably ~10 years away from replicants. in 20years there's going to be millions of tesla humanoid robots all over the place
                                                                  • thedrbrian 1 year ago
                                                                    We’ve had millions of robotaxis since 2017
                                                                    • sambazi 1 year ago
                                                                      do you have actual numbers? thought it was a couple thousand
                                                                    • tsimionescu 1 year ago
                                                                      The whole point of Replicants is that they look exactly like humans in person. Even if we assume AI and robotics advance 100 times or more in the next 10 years to allow the technical part of this, we are not even close to any makeup and prosthetics tech that could make a robot even slightly resemble a human in-person.

                                                                      And I have to mention, Tesla robots are way behind the competition, it's not even clear if their robot does anything really on its own, given how much they fake their videos of it with "creative" editing.

                                                                      • binvader 1 year ago
                                                                        [flagged]
                                                                      • csomar 1 year ago
                                                                        If only, you know, had a simple and efficient way to authenticate messages and emails...
                                                                        • pjc50 1 year ago
                                                                          The tech has existed for decades but is clearly not simple.
                                                                        • imgabe 1 year ago
                                                                          I know it's a meme and all, but doesn't blockchain solve this? Ok, Mr. Guy who looks like my boss on Video Call, I can send those funds, just sign the transaction with your private key and it'll all be done.
                                                                          • mewpmewp2 1 year ago
                                                                            Why do you need blockchain for signing with private key.
                                                                            • pjc50 1 year ago
                                                                              Blockchain does not authenticate the receiver, so there are all sorts of attacks involving substituting the payment address, from dumb (stickers over QR codes) to sophisticated.
                                                                              • imgabe 1 year ago
                                                                                That’s a completely different thing though. The problem here is deepfakes where someone pretending to have the authority to send money tells you to send money.
                                                                              • hacker_88 1 year ago
                                                                                That's just regular Crypto stuff not Cryptocurrency
                                                                            • laurencei 1 year ago
                                                                              What I find strange about this is you dont need it to be "deepfake".

                                                                              Just an inside job.

                                                                              If a large company allows a single employee to transfer millions to a new bank account/vendor that has no history, on "their belief" the instruction came from an approved person (i.e. their boss, CFO etc) - that company has major governance issues that are not related to deepfake.

                                                                              Imagine the more simple scenario - an employee transfers millions, knowingly fraudulantly, to some people they are working with. They then simply supply some "deep fake" pictures and a story how it was an accident - and boom; you walk away with millions.

                                                                              Checks and balances exist for many reasons - deepfake doesnt overcome those by itself. This company is just missing basic steps that would have protected itself here.

                                                                              edit: in fact- its even more obviously some inside job; put the deepfake aside for a moment. How was the meeting even booked? Their PR person said "none of our internal systems were compromised". So this meeting magically appeared in someone's calendar? Using their internal video system (Skype or Teams or whatever). And the criminals knew to target this person, with enough knowledge of random office people to deep fake them? Come on...

                                                                              • skanderbm 1 year ago
                                                                                It reminds me of this case of a hypnotised bank teller http://news.bbc.co.uk/1/hi/world/europe/7309947.stm
                                                                                • bsenftner 1 year ago
                                                                                  You're the only commenter using critical analysis, everyone else is just flapping their jaws.

                                                                                  I hate discussing deepfakes. I'm one of the original patent holders of automated actor replacement technology. I developed it for personalized advertising, after having been an actor replacement specialist in a bunch of VFX film you probably saw.

                                                                                  I spent from 2002 to '08 creating a VFX pipeline, with global patent protections, and an ethical guidance that included public education on this fundamental new technology. Long story short, I needed financing, went to VCs and angels and they were perfectly winning to fund a porn company, but not what I'd planned: an ethical rollout of a sensitive and very powerful technology with many legs, few realize even today.

                                                                                  By '13 I was bankrupt, burned out, and one of my tech partners, a global leader in facial recognition hired me. That's a different story. Actor replacement technology is a fundamental capability with applications far more important than fraud and pornography. But our civilization is far far too immature to realize any of them.

                                                                                  • pjc50 1 year ago
                                                                                    > went to VCs and angels and they were perfectly winning to fund a porn company, but not what I'd planned: an ethical rollout of a sensitive and very powerful technology with many legs

                                                                                    Well, yes, that's kind of what the rest of us have come to expect from the industry. Ethical rollout is always going to take a back seat to raking in as much money as possible. I'm slightly surprised they were willing to touch porn though, not for "ethical" concerns but because it's treated as radioactive by payment services.

                                                                                    • bsenftner 1 year ago
                                                                                      It was absurd. My refusals began when they would insist on a technology proof that was creating nude celebrities in an image with them as the 2nd person. It was really amazing. Always guys, unable to contain their glee being horny, and insisting, insisting the company make porn. This was every single VC, it met with all of them. Angel investor groups too. It darkened my view of humanity.
                                                                                    • 1 year ago
                                                                                      • wasteduniverse 1 year ago
                                                                                        [dead]
                                                                                    • illwrks 1 year ago
                                                                                      The real issue here is a lack of proper risk controls around business processes involving money. Regardless of if it’s £3 for a coffee or £25m for a Secret acquisition there should be an agreed process that everyone involved in business transactions should be aware of so that if they are suddenly privy to a deal they can navigate and validate the authenticity of their involvement.
                                                                                      • legel 1 year ago
                                                                                        This brings up an interesting “risk control” that one of my tech investors personally implemented with his family, in case a audio/video version of him ever asks to do anything crazy: secret passwords, agreed upon in person.
                                                                                        • XorNot 1 year ago
                                                                                          Technically Signal solves this problem with safety codes.

                                                                                          The UI really could stand to be more assertive about what they mean though.

                                                                                          • GiveOver 1 year ago
                                                                                            I notice every time somebody gets a new phone because it says "Your safety number with x has changed" but whenever I've spoken about it with friends, they have no idea what it means. An additional sentence could help here, such as "You might want to double check that you're really talking to x" or the classic "It's possible someone is doing something nasty". Although I understand that this would definitely scare a lot of people, maybe even push them into thinking Signal is insecure.
                                                                                        • graemep 1 year ago
                                                                                          With £25m there ought to be at least two people required to authorise the transfer.
                                                                                        • klyrs 1 year ago
                                                                                          How cool is it that Zoom is capturing our data and using it to train their "AI" efforts? Perhaps nobody in the world is better positioned to completely disrupt nearly every tech-using company, by emulating our C-suites, and ordering us to drain everything. Imagine the Robin Hood shenanigans they could get up to! Or the evil supervillain shenanigans! Who cares, really. The future is so fun!
                                                                                          • dboreham 1 year ago
                                                                                            I think the underlying problem is cultural: people have been conditioned to expect others to authenticate them (give me the last 4 digits of your SSN, tell me the last two transactions on your account), BUT they haven't been told they need to authenticate others. They just aren't thinking "how do I know this is who I think it is? How do I know they haven't been kidnapped?".
                                                                                            • blitzar 1 year ago
                                                                                              My personal protocol with my bank when they ring me is for me to call them back.

                                                                                              The bank workers are normally quite understanding - except when it is someone from fraud detection (and yes these are legitimate calls) and they tend to get odly defensive that I wont hand out my personal information.

                                                                                            • wiradikusuma 1 year ago
                                                                                              I think one way to verify legitimacy is by calling back. For example, "Ok boss, just protocol, but you wouldn't mind if I call you using your usual number?" (or just do it without informing in advance).

                                                                                              Ideally they screen-record (can you do that in Android/iPhone?), so at least if it's really scam, they can say "but I follow protocol, here's the evidence".

                                                                                              Btw we once had a similar scam attempt. "The CEO" emailed Finance in great urgency to transfer money. Good thing the CEO was sitting next to the Finance lady. I was sitting next to them watching the horror turned comedy.

                                                                                              • EZ-E 1 year ago
                                                                                                Learned recently my mid sized company was also targeted. The CFO received first a (fake) call from a lawyer asking to confirm a transaction, then later a deep faked voicemail from the co founder mentioning that same transaction. It apparently all sounded very real. The attacks are becoming very targeted, customized and elaborate. Very far from the Nigerian prince emails written in poor English...
                                                                                                • _tk_ 1 year ago
                                                                                                  The article lacks details to discuss this particular incident. This could reasonably be a company with poor governance, insecure configuration and authentication - and then this is a non-story. OTOH, with the amount of money in question, a sophisticated attack is absolutely believeable, and even 2FA and better process governance will help you out. Maybe a PKI does, but as always, it depends.
                                                                                                  • betaby 1 year ago
                                                                                                    It's not a BitCoin, so transaction has been reversed since then, righ?
                                                                                                    • bgrainger 1 year ago
                                                                                                      Previous discussion (from when it happened but before the victim company was named): https://news.ycombinator.com/item?id=39248649
                                                                                                      • wwilim 1 year ago
                                                                                                        [flagged]
                                                                                                        • olig15 1 year ago
                                                                                                          Explain your reasoning for this. I work in the office, but the vast (98%) of my meetings are on teams or zoom. When you work in a company with multiple locations (and in different countries) working in our assigned office isn’t going to help at all.
                                                                                                          • pjc50 1 year ago
                                                                                                            Half my colleagues are in a different office on the other side of the world. There is no one single "office".
                                                                                                            • verve_rat 1 year ago
                                                                                                              Maybe just the people that can move $25 million should be in the same room, the rest of us can keep the 12 second commute down the hallway.