Digital Doppelgängers: The Dual Faces of Deepfake Technology
Where
Track 2
CactusCon 13
Duration
49 min
Explains how deepfakes are built, the fraud cases they power, and the human checks that help catch them.
Summary
The session opens with a hypothetical scenario in which a security analyst receives an urgent request, seemingly from a manager on a video call, to loosen network controls. From there the speaker explains how generative adversarial networks pit a generator against a discriminator, then sorts synthetic media into text, images, audio and video. Each category gets a concrete example: fabricated legal citations that a court rejected, a romance scam built on generated profile photos, and a robocall imitating a national leader.
The middle of the talk moves into live demonstrations, including a voice clone built from a short audio sample and a discussion of real-time face-swap tools running on webcams. Case studies cover a Hong Kong finance employee who wired about $25 million after a video call with what turned out to be fake colleagues, and a company that nearly hired a North Korean operative using a face-swapped identity, whose laptop was shipped to a laptop farm.
On detection, the speaker finds audio classifiers improving faster than video tools, which produced false positives and misses in testing. The practical defenses centre on people: asking unscripted questions, requesting a quick head turn, and confirming sensitive requests through a separate, known channel. Organisational steps include an AI-content proxy, clear policy, and frameworks such as the NIST AI RMF and MITRE ATLAS. The takeaway is to verify before acting and to keep a healthy level of skepticism.
Related talks
Ground Floor·24 min
Josh Kamdjou
Shows how generative AI lets attackers build convincing, fabricated email threads for phishing campaigns at scale.
Packet Hacking Village·29 min
Harish Elavia
Shows how fake LinkedIn profiles can be spotted by combining image forensics, behavioral signals and network graph analysis into one score.
Track 2·54 min
Andrew Sanford
Examines how organizations can verify employee identity when voice, video and other impersonation methods can be convincingly faked.


