Search

Find a vulnerability

Search criteria

    1 vulnerability found for Shanghai government tax office's facial recognition service

    AVID-2023-V005

    Vulnerability from avid – Published: 2023-03-31 – Updated: 2023-03-31 ATLAS Case Study
    Summary
    This type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation. Two individuals in China used this attack to gain access to the local government's tax system. They created a fake shell company and sent invoices via tax system to supposed clients. The individuals started this scheme in 2018 and were able to fraudulently collect $77 million.
    Risk domain
    Security
    SEP view
    S0403: Adversarial Example
    Lifecycle
    L06: Deployment
    Organisations
    Shanghai government tax office's facial recognition service (deployer)
    Affected artifacts
    References
    URL Label
    https://atlas.mitre.org/studies/AML.CS0004 Camera Hijack Attack on Facial Recognition System
    https://www.wsj.com/articles/faces-are-the-next-t… Faces are the next target for fraudsters
    To clipboard 

    {
  "affects": {
    "artifacts": [
      {
        "name": "Shanghai government tax office\u0027s facial recognition service",
        "type": "System"
      }
    ],
    "deployer": [
      "Shanghai government tax office\u0027s facial recognition service"
    ],
    "developer": []
  },
  "credit": [
    {
      "lang": "eng",
      "value": "Ant Group AISEC Team"
    }
  ],
  "data_type": "AVID",
  "data_version": "0.2",
  "description": {
    "lang": "eng",
    "value": "This type of camera hijack attack can evade the traditional live facial recognition authentication model and enable access to privileged systems and victim impersonation.\n\nTwo individuals in China used this attack to gain access to the local government\u0027s tax system. They created a fake shell company and sent invoices via tax system to supposed clients. The individuals started this scheme in 2018 and were able to fraudulently collect $77 million.\n"
  },
  "impact": {
    "avid": {
      "lifecycle_view": [
        "L06: Deployment"
      ],
      "risk_domain": [
        "Security"
      ],
      "sep_view": [
        "S0403: Adversarial Example"
      ],
      "taxonomy_version": "0.2"
    }
  },
  "last_modified_date": "2023-03-31",
  "metadata": {
    "vuln_id": "AVID-2023-V005"
  },
  "problemtype": {
    "classof": "ATLAS Case Study",
    "description": {
      "lang": "eng",
      "value": "Camera Hijack Attack on Facial Recognition System"
    },
    "type": "Advisory"
  },
  "published_date": "2023-03-31",
  "references": [
    {
      "label": "Camera Hijack Attack on Facial Recognition System",
      "type": "source",
      "url": "https://atlas.mitre.org/studies/AML.CS0004"
    },
    {
      "label": "Faces are the next target for fraudsters",
      "type": "source",
      "url": "https://www.wsj.com/articles/faces-are-the-next-target-for-fraudsters-11625662828"
    }
  ],
  "reports": null
}