Live Deepfake Image Injection to Evade Mobile KYC Verification

Summary

Facial biometric authentication services are commonly used by mobile applications for user onboarding, authentication, and identity verification for KYC requirements. The iProov Red Team demonstrated a face-swapped imagery injection attack that can successfully evade live facial recognition authentication models along with both passive and active [liveness verification](https://en.wikipedia.org/wiki/Liveness_test) on mobile devices. By executing this kind of attack, adversaries could gain access to privileged systems of a victim or create fake personas to create fake accounts on banking or cryptocurrency apps. Target: Mobile facial authentication service Actor: iProov Red Team Procedure: 1. The researchers collected user identity information and high-definition facial images from online social networks and/or black-market sites. 2. The researchers obtained [Faceswap](https://swapface.org) a desktop application capable of swapping faces in a video in real-time. 3. The researchers obtained [Open Broadcaster Software (OBS)](https://obsproject.com)which can broadcast a video stream over the network. 4. The researchers obtained [Virtual Camera: Live Assist](https://apkpure.com/virtual-camera-live-assist/virtual.camera.app), an Android app that allows a user to substitute the devices camera with a video stream. This app works on genuine, non-rooted Android devices. 5. The researchers use the gathered victim face images and the Faceswap tool to produce live deepfake videos which mimic the victim’s appearance. 6. The researchers used the gathered victim information to register an account for a financial services application. 7. During identity verification, the financial services application uses facial recognition and liveness detection to analyze live video from the user’s camera. 8. The researchers stream the deepfake video feed using OBS and use the Virtual Camera app to replace the default camera with feed. This successfully evades the facial recognition system and allows the researchers to authenticate themselves under the victim’s identity.

Deployers

• Mobile facial authentication service

Tags

• MITRE ATLAS
• AML.CS0033