The advancement in Technology is one that comes with good and bad output. Deep fakes are getting difficult to be detected and identity systems that haven't employed the right Technology are still susceptible to fraudulent KYC submissions.

Despite the fact that identity verification has moved from pre-recorded submissions to live submissions, the use of video injection attack has further made it feasible for bad players to manipulate the live KYC verification system.

What is Video Injection Attack?

Defining video injection attack from the identity point of view; a video injection attack goes on to insert fraudulent data streams between the capture device (sensor), and the biometric feature extractor during identity verification in an attempt to establish a fraudulent identity.

Most identity systems involve comparing a live facial image of an individual with the one on a document.

With the rate at which we flaunt pictures, live videos, etc, on Tiktok, Facebook and other social media platforms, it makes it possible for bad players to leverage on this data to create and verify another individual's identity through video injection attack.

Apps like ManyCam can stream pre-recorded or deep fake videos to appear as if from a real camera. Certain hardwares has the ability to capture video systems from other devices while connected to the device being deployed for identity. These are some of the ways video injection attacks are carried out.

Currently, certain identity systems have further deployed live actions like blinking of eyes, nodding of head, etc into the identity system to help curb deep fakes. Sadly, these measures are not enough to stop deep fakes as there are scripted live cameras that can play the impersonated image to the identity system while the real action is carried out by an attacker.

Our mobile devices are vulnerable especially the substandard ones, same with the devices compromised through malicious links and download. These are what makes it possible for these scammers to access the data needed for the attack.

What could be the way out?

I share the opinion that curbing video injection attacks should be done by carefully screening the journey to identity verification.

What do I mean?

When a system is trying to verify an identity, the first verification is, to confirm that the process is happening with the user and in the user owned device. Most video injection attacks happen because the attacker has access to the victim's device from his own device. Verifying that the device presenting the identity verification actually belongs to the said individual is the first and crucial approach to this.

Achieving this will come with huge financial implications because it has to involve device registration and live verification of the registered device. Of course we are talking about a new advanced set of devices built with strong security measures.

When it is proven that the device being deployed for the verification matches the device of the user being verified, the road to the next stage of verification, facial verification, has been made clean. The system can then accept the biometric submitted after now.

For now, our safest practice towards avoiding being a victim of video injection attack is by being careful of the personal data we release to the public on social media, especially live videos and pictures, avoiding downloading malicious applications or visiting unsafe websites...