The Emerging Threats of AI with Eli Farhood

Get ready to discover some of the most actionable DevOps techniques and tooling, including performance and reliability for some of the world's smartest engineers. Hey, I'm Joe Colantonio, host of the DevOps Toolchain podcast, and my goal is to help you create DevOps toolchain awesomeness. Hey, it's Joe. And welcome to another episode of the Test Skill DevOps toolchain. Today we'll be talking with Eli all about the emerging threat of AI. He has a really interesting story I think you're going to get a lot out of, if you don't know. Eli is a licensed trader and financial market analyst that has co managed portfolios for over two decades in multiple financial hubs. In his career, Eli gained a deep knowledge of cybercrime and money laundering, which I hope we'll get into. And after becoming an identity theft victim, he created cash to solve a problem affecting hundreds of millions of people. Really excited to talk to him about this. You don't want to miss it, just check it out. Are you ready to level up your DevOps game and crush those quality challenges? Whether you're dealing with flaky tasks, scaling automation, or trying to integrate security into your pipelines, we got something just for you. Introducing the DevOps Quality Testing Playbook from Test Guild. It isn't just another PDF, it's your go to guide packed with actual insights, best practices and strategies to help you create a bulletproof DevOps toolchain. It's built specifically for engineers, testers and DevOps teams who want to optimize their workflow and drive continuous quality throughout their pipelines. The best part, it's free and ready to download, so don't miss it. Head on over to test Guild Me DevOpsbook and grab your copy today. Stay ahead of the game, optimize your pipelines, and let's crush those quality challenges together. Hey, Eli. Welcome to the guild.

Hi Joe. Thank you for having me.

Great to have you. Like I said, you have an interesting backstory. So before we get into it, a little bit of context. How did you become an identity theft victim and how did it lead you to creating your own company?

That's a great question. In 2015. Actually, 2014. Between 2014, 2015, I had someone accessing my checking account by just providing my personal information to my bank. It was as simple as that. And they. He claimed my identity there and they believed him. It was apparently through remote communication, a phone, a combination of phone calls. And he didn't go to the branch. Basically, let's just Put it this way. And he was able to transfer money from my checking account. Some banks allow that, some banks don't. Depends on the bank's risk appetite. And you know, depending on the country as well. Some countries have different pay delivery requirements. But you know, it was such an interesting experience in. It was a struggle too, you know, on a lot of fronts, mentally, most likely and financially. And also, you know, you have to go to court and prove you're innocent. And yeah, it's kind of like you become tarnished, you know, your identity becomes tarnished. You become like a blacklisted person. No one wants to do business with you because you're a risk. It's that simple as that. But, you know, when I was investigating with my bank, like why this happened and how is it so easy today to just grab someone's information and steal their identities? And you realize that, well, there are a lot of data breaches happening every other week right now. And we call them technically in cybersecurity honeypots, right? And those provide records of sometimes hundreds of millions of people. I mean, just recently there's 3 billion Social Security number that was compromised, right? We've heard about it in the news. So what are these data breaches? We uncovered that these data breaches are providing scammers with our credentials and sensitive information. This is basically what's happening. And when they have that information, they can hack our accounts, they can claim our identities, they can hack our devices. And there is where the real risk lines. In America, we're very, I mean, famous to make it easy to make, to do business, right, in financial institutions. You know, just provide some of your information. A few clicks on the web and you create a credit account. But then it's easy. At the same time, there's a trade off. You're at risk of, you know, getting compromised, of someone using your information and not just to steal money. A lot of the cases actually, and this is part of money laundering, a lot of fraudsters, they don't care how much money you have. They don't care if you're a billionaire or if you're a millionaire or even you're broke. All they care about is using your information to create fake accounts under your name. And those accounts can be used to funnel illicit activities. Basically, that's what they do for the most part. And in money laundering, everyone who knows about this industry, this is basically how it happens for them. When they fall, you fall. They don't because they're using your name. And this is where the risk lies. And that's how it happened to me. And it was such a learning curve. You know, part of my work as a portfolio manager and a financial federal license expert, my duty was to protect the financial data of my clients. So I know the drill, I know like how to protect this information. But when it happened to me. And you really have no say in that. Like I didn't have a say of how someone grabbed my information. Maybe they got it from the doc web. I don't know how they got it. It's just that it tells you clearly that there's a problem. And the problem is 80% of fraud stems from stolen ID credentials. Just think about that number. 80% of fraud globally uses stolen ID credentials. So we have a big problem and we tried at catch to solve this problem.

You know, it's a great point about money laundering. I had someone that was running credit cards through a low price item I had on my website and just cycling through hundreds and hundreds of numbers until I shut it down and some of them actually went through. So I assume someone is just trying to see if it goes through. And once it goes through, they know they have a real credit card, I guess, and real identity that they then can use for money laundering. Because a lot of people think hey, I don't have millions of dollars so I, I don't have to worry. But obviously like you said, that was a good point.

Yeah, exactly. And that's why, and this is kind of like the decade two decade old problem. Now we're facing an emerging problem. AI. AI is such amazing technology. Fascinating, Fabulous. Call it whatever you want, it's going to change the world. I've started learning about AI encoding in AI and I'm also fascinated and I've seen what was going on today or what happened recently with that theft of $25 million at the Hong Kong based company. I've seen that coming, you know, it, it was obvious that it's going to happen where someone used a deepfake video. He pretended to be the cfo and he was giving instructions basically to his assistant, hey, why are $25 million, we don't want to lose that deal. And so there was this urgency. And the thing is that if you read it on cnn, it tells you that the assistant was doubtful about what's going on. But that urgency, and he saw his CFO on live on camera during a zoom call. He never thought it would be a deep fake, you know, but there you doubt it and you do it because like you're buying with that person, you're speaking with them, they sound like your cfo, they look like your cfo. Right. Old saying, walk like a dog, talk like a dog, you're a dog. Right, Same thing here. So, yeah, the emerging threat of AI is serious. And while it is a fascinating technology, fraudsters now have access to it and everyone have access to it. And I know that software players are using it and also powerful hacking groups are using it as well. And so it's going to provide them a lot of leverage here and we need to be ready.

So I didn't know about the deep fake hack. That is crazy. So at this point then how do you even prevent it? Because when I read about hacking, it's always like, usually it's not necessarily a developer that has a wormhole. It's usually like, like you said, someone calls that they're, they're pretending to be someone. So like I don't even know. How do you get around now with AI now doing deep fakes to prevent it?

Great question. So like I said, when we started attempting to solve the problem, we decided to eliminate credentials. That was our first goal because we wanted to leave hackers with nothing to steal about us. Okay, Any access codes, any passwords, any username, we wanted to eliminate that component because to be honest, I mean, look at history. If you look back just 50 years ago, every now and then there's a large data breach. Trillion dollar companies like Microsoft can't protect themselves, they can't protect their data, they can't protect their clients. Right. We've seen it last year. So what do you do? Like if you cannot protect information that is publicly available, what do you do? What's your solution? Well, the solution for us was to eliminate credentials and replace it with biometrics. But then that wouldn't help me as I helped victim. Right. My problem was that someone stole my information and claimed my identity. And this is how the system runs pretty much all over the place. Like if you go to the uk, usa, Australia, Asia, part of majors, some, most part of Asia, they do use what we call in cybersecurity, pii, Personal identifying information. Right. And that information can be used to just, you know, represent who you are. So we decided additionally, on top of eliminating passwords and multifactor authentications, which are really highly risky, we decided to also allow you to authorize who can use your information whenever you need it. And so think about this. Right now, my information is compromised. Scammers want to use it. They go to the bank, they want to create a credit account, but then they can't create that account before I authorize who can use it. But then how do you authorize it? This was the challenge that we were facing. Okay, how do you allow people to authorize who can use your information? Because today, you know, information can be compromised, used by big tech, by whoever, right? We want to bring back control to you, the individual. You have to take back control over your data, and you have to decide who can use it, who cannot use it, where they can use it, for how long it is going to be used for five minutes, 10 minutes, one day, one week, whatever it is, whenever you need that information, we want it to allow you to authorize who can. Who can use every issue that you can take back control of your data. Your sensitive information tells these are yours, these are your credentials, so to speak, right? To the government, to agencies, to financial institutions. And that's how we started, you know, attempting to find a solution for what happened to me personally. And our solution was basically, your hand. Just use your hand. It's your biometric. You won't lose it. No one can steal it, right? And with that, you can authorize on any smart device who can use your information. So we're protecting you by protecting the use of your information, right? Or giving you back control over who you allow to use your information. And then we're eliminating passwords, which also are a great vehicle through those data breaches that happens uniquely.

I would think this is kind of like a mind shift, though, from the way people are used to doing things. How do people start incorporating this technology then? If I'm a developer listening to this and I have an application of software, how hard is it to integrate into biometric data like you have or your technology in order to get it to work? Can they retrofit it? Does it have to be built from the beginning with this type of authentication in mind? How does that work?

So if you look at most robust biometric systems, I'm sure a lot of people heard of clear at the airport, right? Or they've probably heard of Face ID on iPhones, or they heard about Amazon One at the whole food store, right? Most of these robust technology, we call them robust, they have a problem, they do rely on a device, and unless that device is available, that convenience disappears. And so we also attempted to solve the problem from that perspective. We wanted to eliminate the hardware so that we can democratize access. You know, when you can access your identity using your hand on any smart device, it's basically like a password. That's the beauty of passwords. Right. Passwords work anywhere. You can change them if someone stoles them. Right. Steals them. Right. And they work on a laptop, on an iPad, on any small device. We wanted to replicate the convenience of passwords, remove the friction of passwords and give you back control over who can use your information. That's basically the genesis of Couch. That's how we started building this. And I was really lucky that my co founder is a veteran in cyber security. He has more than 20 years of experience in that field. He has one successful exit. So we have a proven team. We have veterans from IBM, from Raytheon, from Symantec. And those veterans really are helping us shape up the product and come up with the value that businesses need, that consumers need. Because we want to provide protection not just for consumers, but for businesses. Think of like financial institutions for example. They have on their infrastructure a lot of customer information, employee information. If that information is compromised, you as a business, you're held liable. Right. And someone can sue you. So think of all those risks as a business, you know, we can protect that as well. And but to again to provide that protection, we had to eliminate the hardware elements from any biometric system. It just doesn't work for us. It's a non starter. If you need the special hardware, good luck. I don't have access to my account anywhere. And you still have to use passwords at some point because if I can't use it on any device, then you have to allow me to use passwords. And the moment I allow you to use passwords, then the risk is still there. We haven't really solved much. We needed to eliminate passwords and in order to do that we needed to provide you access on any device. That's why we thought of developing a technology that works without having to have any special device. It works on your iPad, on your laptop, on your phone, on your Android, on any smart device that has a camera.

All right, so how does it work then? Rather than a login screen, just says place your hand here and then.

Yeah, basically think of like if a bank deploys our technology, it's a software only solution. All that, all you have to do as in the client journey would be, you know, starting their banking app, waving their hand and they have access to their phone, I mean to their bank account. They don't need any password, they don't need any multi factor code, they don't need all this tassel.

All right, so I know a lot of laws are being passed like gdpr, you get fined a lot. If someone hacks you and they're stealing your data, especially if you work for healthcare. So do you see this as a way to actually make your GDPR compliance even stronger? Because you're like, hey, I'm not stirring anything. I'm stirring. I don't know, what are you storing? Are you storing a handprint or, like, I don't know how that works, but you're not storing any PII information?

I guess that's a great, great question. So one of our clients is actually based in Europe. And yes, we're dealing with gdpr and we found a way around it. We're going to deploy our tech on their infrastructure. And so the business. Because GDPR does not allow a third party to authenticate someone's business. Right. Clients. And so the way around it was that we deploy our tech on their infrastructure, and this way we, the business client, will authenticate their own clients using our tech on their infrastructure. So we're not dealing with confidentiality. We don't get access to their information. We don't deal with any kind of customer data that the client has.

Love it. So, you know, biometrics, like, why is it more secure then. Then using, say, a password generator that creates, like, a crazy password for you automatically? Why is this, you think a better solution than something like that?

Yeah. That's amazing.

Because.

Well, the thing is that you can steal anything today. You can use AI to recreate anything as well. And in the future, even though now there are some technologies that can verify that's an AI footage, that's not an AI footage. In the future, even as AI becomes more mature as a technology and more advanced, we know for a fact that we won't even be able to tell the difference between an AI footage and a real human footage shot with a camera sensor. And when that happens, it will be extremely hard to protect people unless you deploy certain technologies that can verify personhood or can verify that that biometric is a human biometric. And that's what we attempted to build with catch, because we have, in our technology, we have that engine that can verify whether this image is a human biometric or whether it is a defect biometric. We also use other biological markers, so we can detect pulse and other, you know, markers that are part of R2H secret, that can certify to the highest degrees that this biometric belongs to you, the owner of that identity, and not someone else who has a photo of your hand, who could have a video of your hand, or who could have compromised our servers. But just to tell you more technically, about that. Even if our servers are compromised, that wouldn't matter much because we don't have any raw biometrics. So when you sign up to our servers. Let me walk you through what technically happens. So, right, we take a picture of your hand, but that picture then is converted into a function. So we have a mathematical function that represents Joe, for example, and we house that function on our servers at eight different locations, and we purge that biometric image that we took from your hand. And the reason why we're purging it, because that's not good to house. We want to house only tokenized items that represents your identity, and they're going to be stored on several different locations so that we make it extremely hard for fraudsters to steal that constant which represent who you are. I hope I was able to.

Yeah, absolutely. Because I was going to ask you what's going to stop someone from stealing your biometric of your hand and creating, like, a 3D. I know this is outrageous. A 3D model of it and, like, really trying to mimic as much as possible. It sounds like you have algorithms that I just learned about recently about deep fakes that people can look at the blood flow in your eyes, some sort of algorithm that'll know if it's a fake. So it sounds like something similar with your biometrics of your hand.

You could say that. And you can't stop anyone from seeing biometrics. Let's start there. Your biometric is available on LinkedIn. It's available on your Facebook, on your Instagram. We're taking pictures here and there. You could be editing.

That's true.

Right, right, right, right. And if you're targeted, like, we're going to take things to the highest level of security. If you're a targeted person and you happen to be at an event and someone just snapped a picture of you, they have a hidden camera somewhere in the chest there. Someone can get your biometric one way or another, especially if it's facial recognition. We believe the hand is much more secure than the face because someone has his hand on his profile. Right. And it's a voluntary biometric. Like, if you're walking down the street, cameras are capturing your face anyway. So we call that a passive barometric. But your hand is a voluntary barometric. It's not going to be captured even if you're walking down the street. So that's why we believe the head is much more powerful and more secure by metric than facial recognition. And also, it has a lot of other advantages. For example, it does not Discriminate against people of color or races. Also, besides being a voluntary biometric, it is private. Think of that. You know, facial recognition, iris recognition, all these are invasive technologies.

I think it's a good point. Especially with software developers, algorithms that have biases baked into them. You brought up a good point. This sounds like a way that maybe you can train, not have to worry so much about biases. So how true is that, then? How accurate is that?

It is so true. So the reason why there's a bias, not just because of the algorithm itself, there's a technical reason. When you happen to have a darker skin shade, AI struggles sometimes to figure out where's your eyebrow, raise your nose, where's your. And that struggle sometimes makes the eye on inefficient, if that makes sense. And sometimes it gives you a false negative. Okay. Or false positive. Can be both. The hand, on the other hand, the hand, no matter what skin color you have or race you're like, what kind of race you belong to, they all have a bright palm. And we did our lab test on that. Even people who are black people have bright palms. So the hand has a lot of features, especially this color, you know, always having a bright palm. Actually, to your point, if you happen to be a black person, your hand is much more accurate than a white person, if that makes sense, because there's more contrast. You have the black lines on your hands, but then you have a white backdrop, which is perfect for identification. But just, you know, giving you an example that, yes, the hand has a lot of advantages from a discrimination perspective, from a privacy perspective, and also from a security perspective, a lot of the times I'm not sure if you've seen it, but the demonstration of how they hacked face ID on iPhone. Have you ever watched that?

No. No.

Okay. Yeah. It was hacked three months after launch. The Face ID of iPhone. And the way they hacked it is that they literally, like, used a 3D mask of that person. They 3D printed a mask of his face, they put some lenses on his eyes to mimic real human eyes, and they unlocked the phone. It was that simple. The hand is a very, like, I would say it's not aesthetic. It's very highly. That you can make gestures with the hand. How can you 3D print that? You. You know, it's very hard to 3D print a hand and create a gesture. Right? And those lines, as you close your hand and open it, they change with every frame of that sequence while the face is more static. You remember back in the days when they were allowing you to use facial recognition with a mask and this they said can know who you are. That's because facial recognition for the most part focuses on this side of your face. Aesthetic part. And the more aesthetic it is, the we say we think it's the more risky. That's why the hand is very hard to recreate on 3D printer.

All right, this is a dumb question. Does your hand ever change? Like my mother in law could not get fingerprinted. I don't know why. There's something with her fingertips. Didn't get, couldn't get a fingerprint off it. Is that possible with the hand? Is any use cases where the hand changes over time or isn't is it usable?

Absolutely. It does change over time. Not over the weeks, but definitely over the years. And that is not a problem because every time you're using Catch, we're grabbing a picture of that hand, tokenizing it and retraining the engine to identify you. So as long as there are minor changes over time, that's not a problem. The problem lies if there's a sudden change. Let's say, I don't know, you had a wound on your hand, maybe there's a large scar that just wasn't there when you signed up. Yes, that will be problematic. But then we give you the option to use both hands to identify who you are. So you can use the left hand, the right hand, if this one is busy, you can use this one or otherwise.

All right, Eli, this sounds like a great solution. How can people learn more or sign up that they're interested in it? Do you have like a free trial? Like have you gotten a lot of input already from the market that this is definitely something that people want to do to start using hand type of authentication within their software?

Yeah, absolutely. Thank you for bringing that up. So we have had interest from IBM as a potential partner and also we were chosen by Visa among the top five fintech startups in the United States. We also worked with the FDIC on digital identity proofing for community banks. So we've had some interesting validation on that side. We also grabbed several Lois. And now we're engaging with B2B customers. Like I mentioned earlier, one of them is based in Europe. They are interested to use our concept and explore it and try to offer it to their end users. And now we are actually trying to also gauge interest from the end users. We want to know if retail investors or the consumers are also interested in that concept. So we wanted to validate both sides of the market, the businesses and the consumers. And now we launched our crowdfunding campaign. And so I invite people to Visit our website, catchid.com that's K-A-T-S-H-ID.com, where they can also learn more about Catch, about its features, about the value it provides and the protection it provides for identity. And there's also an Invest button if they want to explore more our investment opportunity and join our journey. Because we think that this movement is just starting. Digital identities are here to stay. And this is the future. The future is a lot of private businesses will need to identify who you are. And we want to be the leader in that space so that we help change the world, protect people from fraud, and protect businesses as well. We know for a fact if you're able to streamline, if you're able to provide convenience and security on any device, that can change a lot of things in cybersecurity, especially when it comes to business dynamics. You know, that makes a lot of business very efficient, more profitable. Any profitability on the business side will bring down the prices of their services. It will be more inclusive when you can democratize access. People can access their identities from any device. That's also very powerful. You know, underserved, under banked, populate or perhaps regions can gain access to banking services again. I mean, why do you think banks are charging so many high fees? Because they have a high cost as well. Right. Those branch that they maintain are costing them close to $800,000 on average per year. Right. If you're able, like as a bank, I mean. Let's look at Covid post. Covid. Things changed a lot. People are more accustomed to doing things online. People don't go to the branch anymore. I've heard it from many packers. They told me they're ghost towns right now. And so most of their branches are unprofitable. If they cut down on that unprofitable element they have now, those branches, they become more efficient, they can provide cheaper financial services, you know, be more inclusive and have more expand their client base. So there's a lot of dynamics that can go into play and we're very excited. By the way, I didn't mention this in my discussion, but we're very excited about Web3 because digital assets are so powerful and they will change the world, but their problem is that they're not secure. And this is also our next challenge at Catch. We want to use this technology we're building and add more to it to protect digital assets. This is such an amazing space that I'M really so excited.

So you mean like leveraging blockchain to make it more traceable, right?

Absolutely. Because actually we do use blockchain to track and record the parties involved, time, location and the purpose of the transaction so that you can, you know, go back in time and review what went wrong, if there's anything wrong.

You're dealing with banking, probably health care, a lot of regulated environments. So how does someone, how could someone trust this type of technology? I assume, have you been to like, audits? Do you have to prove yourself to any type of government bodies to say, hey, this is a legitimate technology before a bank or a financial institution can incorporate it into their software?

Yeah, absolutely. You have to have. It's like sending organic bananas, right? I give that example all the time. You got to get the certificate that's organic. And same thing here. You have to be compliant, get all the certifications needed in order to work with banks. And that's why we know for a fact right now, large banks are not our clients because we're not there yet. But we're conducting penetration testing in house. We're going to conduct penetration testing with a third party, get those certifications, all the compliances needed before we start offering this to big brand for sure.

Akili, before we go, what's the best way to find or contact you?

You can find me on LinkedIn, Elijah Farwood. I respond, I'm very friendly but you know, get to our website, catch id.com that's k a t shid.

And you can learn more about Catch over there. And you know, I have my contacts as well there. You can contact me directly. I'd love to connect and I look forward to, you know, I'm very, very. Identity is so personal to me, let's put it this way, because I fell victim to fraud and, and twice, Joe, not just once, Twice last year, 2023, it was another experience. So it's very personal for me and I'm just. There's no plan B for me. I need to solve this problem and protect people, protect myself, protect businesses. And we can do it. And this is why we're working on this so hard day and night so that we can achieve our mission, ambition.

And for links of everything of value we covered in this DevOps Toolchain Show. Head on over to testguild.com p168. So that's it for this episode of the DevOps Toolchain Show. I'm Joe. My mission is to help you succeed, creating end to end full stack DevOps toolchain awesomeness. As always, test everything and keep the good. Cheers. Hey, thank you for tuning in. It's incredible to connect with close to 400,000 followers across all our platforms and over 40,000 email subscribers who are at the forefront of automation, testing and DevOps. If you haven't yet, join our vibrant community at Test Guild, where you become part of our elite circle driving innovation in software testing and automation. And if you're a tool provider or have a service looking to empower our guild with solutions that elevate skills and tackle real world challenges, we're excited to collaborate. Visit test guild.info to explore how we can create transformative experiences together. Let's push the boundaries of what we can achieve. O the Tescill Automation Testing Podcast with hoots and lyres, the bards began their song A tune of knowledge, a melody of code through the air it spread like wildfire through the land, Guiding testers showing us secrets to behold.