Camera hijack attack evades facial recognition in tax system fraud

# Camera hijack attack evades facial recognition in tax system fraud

https://gcdradar.vercel.app/incidents/camera-hijack-attack-evades-facial-recognition-in-tax-system · AIR-2023-0014 · closed 2023-04-14

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss)
- Fix status: No fix needed
- First reported: 2023-03-31 (happened 2018)
- AI role: AI-enabled attack
- Products: Shanghai government tax office facial recognition service

## Summary

Attackers used camera spoofing and hijacking to bypass facial recognition authentication on a government tax system. The scheme enabled unauthorized access and seventy-seven million dollars in fraudulent invoices.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-03-31: Faces are the next target for fraudsters (https://wsj.com/articles/faces-are-the-next-target-for-fraudsters-11625662828)
- 2023-03-31: Camera Hijack Attack on Facial Recognition System (https://atlas.mitre.org/studies/AML.CS0004)
- 2023-03-31: AVID-2023-V005: This type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation. (https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V005.json)

## Sources

- 2023-03-31 AVID: AVID-2023-V005: This type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation. https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V005.json
- 2023-03-31 MITRE ATLAS: Camera Hijack Attack on Facial Recognition System https://atlas.mitre.org/studies/AML.CS0004
- 2023-03-31 The Wall Street Journal: Faces are the next target for fraudsters https://wsj.com/articles/faces-are-the-next-target-for-fraudsters-11625662828

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.