即将到来的 Deepfake 攻击让这位加密货币安全高管格外担心

Lunglhofer 感叹，便利往往是安全的敌人，无论是在加密货币还是传统金融中，人们都会拥抱任何能让他们更快地转移资金的工具。

Cybersecurity chief Chris Lunglhofer has spent decades preparing for the worst-case scenarios in the world of finance. But even he’s surprised by the latest threat.

网络安全主管 Chris Lunglhofer 花费了数十年的时间为金融界最坏的情况做准备。但就连他也对最新的威胁感到惊讶。

“I never thought deepfakes would be used for crypto scams,” Lunglhofer, who is now head of cybersecurity at crypto exchange Coinbase, told me at the sidelines of Consensus.

“我从来没有想过 Deepfakes 会被用于加密货币诈骗，”现任加密货币交易所 Coinbase 网络安全主管的 Lunglhofer 在 Consensus 会议间隙告诉我。

Those scams have already arrived. There are now videos circulating that feature the voice and image of crypto CEOs like Coinbase’s Brian Armstrong and Ripple’s Brad Garlinghouse promising to give away free tokens. The videos are designed to trick viewers into visiting scam websites and entering their crypto wallet details.

这些骗局已经到来。现在有一些视频在流传，其中包含 Coinbase 的 Brian Armstrong 和 Ripple 的 Brad Garlinghouse 等加密货币首席执行官的声音和形象，承诺免费赠送代币。这些视频旨在诱骗观众访问诈骗网站并输入其加密钱包详细信息。

Lunglhofer said he’s spoken with several crypto CEOs who have been targeted by deepfakes, and none of them were aware of the scams until Lunglhofer alerted them.

Lunglhofer 表示，他与几位成为 Deepfake 攻击目标的加密货币首席执行官进行了交谈，在 Lunglhofer 提醒他们之前，他们都没有意识到这些骗局。

“They’re all like, ‘What the f*ck is going on?'” Lunglhofer said.

“他们都会说，‘到底发生了什么事？’”朗格霍弗说。

The scams are particularly effective because they often slip past the defenses of major online platforms like YouTube. The videos don’t contain any illicit content like terrorism or nudity, which the platforms make the most effort to detect. And they don’t feature the crypto CEOs saying anything that could be easily flagged as a scam, like promising guaranteed returns on crypto investments.

这些骗局特别有效，因为它们经常能绕过 YouTube 等主要在线平台的防御。这些视频不包含任何非法内容，例如恐怖主义或裸体，这些平台最努力地检测这些内容。而且它们并没有加密货币首席执行官说任何容易被标记为骗局的事情，比如承诺保证加密投资的回报。

“Most of the time, the videos feature the crypto CEO saying something like, ‘We’re going to be giving away some tokens today,'” Lunglhofer said. “There’s nothing inherently scammy about that statement, so it doesn’t get flagged.”

“大多数时候，视频中加密货币首席执行官会说，‘我们今天将赠送一些代币，’”Lunglhofer 说。 “该声明本身并没有什么欺骗性，因此不会被标记。”

Lunglhofer said he’s reported several of the deepfake scams to YouTube, but the videos are still live.

Lunglhofer 表示，他已向 YouTube 举报了几起 Deepfake 诈骗，但这些视频仍然存在。

“I don’t think they’re being malicious,” Lunglhofer said. “I just don’t think they’re paying attention to this type of scam.”

“我不认为他们有恶意，”朗格霍夫说。 “我只是认为他们没有关注这种类型的骗局。”

The scams are also concerning because the quality of deepfakes is getting better every month, which will make them both more convincing and harder to detect.

这些骗局也令人担忧，因为深度伪造品的质量每个月都在提高，这将使它们变得更有说服力，也更难被发现。

“This is going to be a huge problem in the coming months,” Lunglhofer said.

“这将在未来几个月成为一个大问题，”朗格霍费尔说。

In response to this coming onslaught, and to the problem of scams in general, Lunglhofer has a recommendation that goes beyond staying vigilant: If you are moving money, slow down.

为了应对即将到来的攻击以及一般的诈骗问题，Lunglhofer 提出了一个不仅仅是保持警惕的建议：如果您正在转移资金，请放慢速度。

“Most people want to move money as quickly as possible, and that’s putting them at risk,” Lunglhofer said. “If you’re moving a lot of money, use a tool like a vault or a multi-sig signing protocol that has a cooling off period before the money can move. And for smaller everyday transactions, use a passkey.”

“大多数人都希望尽快转移资金，这让他们面临风险，”隆格霍费尔说。 “如果你要转移大量资金，请使用金库或多重签名协议等工具，这些工具在资金转移之前有一段冷静期。对于较小的日常交易，请使用密钥。”

Passkeys are a security feature offered by Apple, Google, and others that generates a security token on a person’s device that can’t be replicated or transferred. The token is then used to authenticate a person’s identity when they log into an app or website.

密钥是 Apple、Google 和其他公司提供的一项安全功能，可在个人设备上生成无法复制或转移的安全令牌。然后，当用户登录应用程序或网站时，该令牌将用于验证用户的身份。

“Passkeys are a huge improvement over passwords, and they’re also much more secure than SMS authentication,” Lunglhofer said. “And not surprisingly, I’m also seeing a lot of crypto exchanges adding SMS authentication as an option, which is mind-boggling.”

“密钥是对密码的巨大改进，而且它们也比 SMS 身份验证安全得多，”Lunglhofer 说。 “毫不奇怪，我还看到许多加密货币交易所添加短信身份验证作为选项，这令人难以置信。”

Lunglhofer said he’s spoken with several executives at crypto exchanges who are unaware that SMS authentication is inherently insecure, and that it was never designed to be a security feature in the first place.

Lunglhofer 表示，他与加密货币交易所的几位高管进行了交谈，他们并不知道短信身份验证本质上是不安全的，而且它从一开始就不是被设计成一种安全功能的。

“It’s amazing how little some of these executives know about cybersecurity,” Lunglhofer said.

“令人惊讶的是，其中一些高管对网络安全知之甚少，”朗格霍夫说。

The bottom line is that setting up passkeys or adding other layers of security might take a minute of your time but, as cyber threats get scarier, the protection is more valuable than ever.

最重要的是，设置密钥或添加其他安全层可能会花费您一分钟的时间，但随着网络威胁变得更加可怕，保护比以往任何时候都更有价值。