Join us for an evening of fun at this month’s hack::soho taking place 26 November, 6pm – 9pm, set up to be a loose networking environment where cyber security professionals can chat, get some complimentary food & drink, and discuss rising global trends.
This month’s hack::soho features a talk from Jose Maldonado, IOActive Managing Security Consultant. The abstract of the talk, ‘Is Liveness a Lie?,’ is below!
hack::soho is a monthly event hosted at our London, UK office for the cybersecurity and hacking community to discuss all things security over food and refreshments. We welcome you to invite others in your circle to extend our collective network.
Spots are limited, so please use real contact details to confirm your registration. We will not sell, distribute, or use your contact information outside of sending you details about upcoming hack::soho meetups.
We hope you can join us!
Not able to make it to this hack::soho in person? No worries, we will livestream the presentation portion kicking off around 7pm on 26 November. Join the livestream and bookmark the page here.
ABSTRACT
Facial recognition has rapidly become a cornerstone of digital identity: from KYC onboarding flows and building access to mobile authentication and second-factor verification. But how robust are these systems when an attacker looks back? This talk maps the current landscape of face-based identity systems, examining how liveness detection, face-document matching, and AI-driven anti-spoofing controls are deployed in practice and where they fail. We explore two primary attack surfaces: Presentation Attacks (PAD bypass using printed photos, 3D masks, or real human imposters) and injection attacks that subvert the pipeline before it reaches the model, using virtual cameras, Frida hooks, replay attacks, and man-in-the-middle techniques at the capture layer. With AI increasingly embedded on both sides of this arms race, powering both defences and attacks, the talk closes with an honest assessment of what “liveness” actually guarantees today, and what it doesn’t.