即將到來的 Deepfake 攻擊讓這位加密貨幣安全高層格外擔心

Lunglhofer 感嘆，便利性往往是安全的敵人，無論是在加密貨幣還是傳統金融中，人們都會擁抱任何能讓他們更快轉移資金的工具。

Cybersecurity chief Chris Lunglhofer has spent decades preparing for the worst-case scenarios in the world of finance. But even he’s surprised by the latest threat.

網路安全主管 Chris Lunglhofer 花了數十年的時間為金融界最壞的情況做準備。但就連他也對最新的威脅感到驚訝。

“I never thought deepfakes would be used for crypto scams,” Lunglhofer, who is now head of cybersecurity at crypto exchange Coinbase, told me at the sidelines of Consensus.

「我從來沒有想過 Deepfakes 會被用於加密貨幣詐騙，」現任加密貨幣交易所 Coinbase 網路安全主管的 Lunglhofer 在 Consensus 會議間隙告訴我。

Those scams have already arrived. There are now videos circulating that feature the voice and image of crypto CEOs like Coinbase’s Brian Armstrong and Ripple’s Brad Garlinghouse promising to give away free tokens. The videos are designed to trick viewers into visiting scam websites and entering their crypto wallet details.

這些騙局已經到來。現在有一些影片在流傳，其中包含 Coinbase 的 Brian Armstrong 和 Ripple 的 Brad Garlinghouse 等加密貨幣執行長的聲音和形象，承諾免費贈送代幣。這些影片旨在誘騙觀眾訪問詐騙網站並輸入其加密錢包詳細資訊。

Lunglhofer said he’s spoken with several crypto CEOs who have been targeted by deepfakes, and none of them were aware of the scams until Lunglhofer alerted them.

Lunglhofer 表示，他與幾位成為 Deepfake 攻擊目標的加密貨幣執行長進行了交談，在 Lunglhofer 提醒他們之前，他們都沒有意識到這些騙局。

“They’re all like, ‘What the f*ck is going on?'” Lunglhofer said.

「他們都會說，『到底發生了什麼事？』」朗格霍夫說。

The scams are particularly effective because they often slip past the defenses of major online platforms like YouTube. The videos don’t contain any illicit content like terrorism or nudity, which the platforms make the most effort to detect. And they don’t feature the crypto CEOs saying anything that could be easily flagged as a scam, like promising guaranteed returns on crypto investments.

這些騙局特別有效，因為它們經常能繞過 YouTube 等主要線上平台的防禦。這些影片不包含任何非法內容，例如恐怖主義或裸體，而這些平台最努力地檢測這些內容。而且它們並沒有加密貨幣執行長說任何容易被標記為騙局的事情，例如承諾保證加密投資的回報。

“Most of the time, the videos feature the crypto CEO saying something like, ‘We’re going to be giving away some tokens today,'” Lunglhofer said. “There’s nothing inherently scammy about that statement, so it doesn’t get flagged.”

「大多數時候，影片中加密貨幣執行長會說，『我們今天將贈送一些代幣，』」Lunglhofer 說。 “該聲明本身並沒有什麼欺騙性，因此不會被標記。”

Lunglhofer said he’s reported several of the deepfake scams to YouTube, but the videos are still live.

Lunglhofer 表示，他已向 YouTube 舉報了幾起 Deepfake 詐騙，但這些影片仍然存在。

“I don’t think they’re being malicious,” Lunglhofer said. “I just don’t think they’re paying attention to this type of scam.”

「我不認為他們有惡意，」朗格霍夫說。 “我只是認為他們沒有關注這種類型的騙局。”

The scams are also concerning because the quality of deepfakes is getting better every month, which will make them both more convincing and harder to detect.

這些騙局也令人擔憂，因為深度偽造品的品質每個月都在提高，這將使它們變得更有說服力，也更難被發現。

“This is going to be a huge problem in the coming months,” Lunglhofer said.

「這將在未來幾個月成為一個大問題，」朗格霍費爾說。

In response to this coming onslaught, and to the problem of scams in general, Lunglhofer has a recommendation that goes beyond staying vigilant: If you are moving money, slow down.

為了應對即將到來的攻擊以及一般的詐騙問題，Lunglhofer 提出了一個不僅僅是保持警惕的建議：如果您正在轉移資金，請放慢速度。

“Most people want to move money as quickly as possible, and that’s putting them at risk,” Lunglhofer said. “If you’re moving a lot of money, use a tool like a vault or a multi-sig signing protocol that has a cooling off period before the money can move. And for smaller everyday transactions, use a passkey.”

「大多數人都希望盡快轉移資金，這讓他們面臨風險，」隆格霍費爾說。 「如果你要轉移大量資金，請使用金庫或多重簽名協議等工具，這些工具在資金轉移之前有一段冷靜期。對於較小的日常交易，請使用密鑰。

Passkeys are a security feature offered by Apple, Google, and others that generates a security token on a person’s device that can’t be replicated or transferred. The token is then used to authenticate a person’s identity when they log into an app or website.

金鑰是 Apple、Google 和其他公司提供的安全功能，可在個人裝置上產生無法複製或轉移的安全性令牌。然後，當使用者登入應用程式或網站時，該令牌將用於驗證使用者的身份。

“Passkeys are a huge improvement over passwords, and they’re also much more secure than SMS authentication,” Lunglhofer said. “And not surprisingly, I’m also seeing a lot of crypto exchanges adding SMS authentication as an option, which is mind-boggling.”

「金鑰是對密碼的巨大改進，而且它們也比 SMS 身份驗證安全得多，」Lunglhofer 說。 “毫不奇怪，我還看到許多加密貨幣交易所添加短信身份驗證作為選項，這令人難以置信。”

Lunglhofer said he’s spoken with several executives at crypto exchanges who are unaware that SMS authentication is inherently insecure, and that it was never designed to be a security feature in the first place.

Lunglhofer 表示，他與加密貨幣交易所的幾位高管進行了交談，他們並不知道短信身份驗證本質上是不安全的，而且它從一開始就不是被設計成一種安全功能的。

“It’s amazing how little some of these executives know about cybersecurity,” Lunglhofer said.

「令人驚訝的是，其中一些高層對網路安全知之甚少，」朗格霍夫說。

The bottom line is that setting up passkeys or adding other layers of security might take a minute of your time but, as cyber threats get scarier, the protection is more valuable than ever.

最重要的是，設定金鑰或添加其他安全層可能會花費您一分鐘的時間，但隨著網路威脅變得更加可怕，保護比以往任何時候都更有價值。