An injection attack skips the camera. It still has to copy a living face.
Moveris reads one second of video and decides whether a living face was in front of the camera. It is trained and tested on injection attacks, along with the face swaps, lip-sync, and AI-generated video they carry.
What is a camera injection attack?
An injection attack skips the camera. Software feeds the check a video stream that passes for a webcam, so the fake never sits in front of a lens. Security teams also call it a video injection attack or a virtual camera attack.
How fake video gets in
Virtual camera
Software that poses as a webcam and streams any video.
Phone emulator
Software that runs a pretend phone on a computer and hands the app any video.
Tampered video feed
Code inside the app or browser swaps the camera feed before the check receives it.
What comes through can be anything: a face swap, lip-sync, or a face that never existed.
Why injection attacks are hard to stop
Nothing goes wrong at the camera, because there is no camera. The stream is clean and digital, with no screen edges or glare to give it away. A check built to spot a fake held up to a lens has little to read.
Read the face, wherever the video came from
Moveris reads the video itself, so the fake has to pass for a living face, whatever route it took. A brain and a body run a living face, so its blood flow, muscle movement, and emotion work together. We call that cognitive coherence.
Attackers move to whichever route gets through. Whatever the next tool is, it still has to copy a living face's cognitive coherence.
Moveris reads one second of video. It reads each of a hundred regions of the face four ways: facial muscle movement, blood flow, estimated depth, and neighbor contrast. Muscle movement goes down to the microexpressions that carry emotion. Moveris checks how all of those signs work together.
What your team gets back
Each check returns a decision, living face or not, and a human-likelihood score from 0 to 100. A breakdown shows what affected each score, so your fraud and review teams see more than the decision.
Built on our own data
Moveris is trained and tested on injection attacks. We generate, collect, and curate 90% of this data in-house, so it matches what happens in the real world.
Questions
Still have a question? Book a demo and ask us.
What is the difference between an injection attack and a presentation attack?
A presentation attack puts a fake in front of a real camera. An injection attack skips the camera and feeds in fake video. Moveris is trained and tested on both.
Is a camera injection attack the same as SQL injection?
No. SQL injection sends bad commands to a database. A camera injection attack sends fake video to a face check.
Can a virtual camera pass a liveness check?
It can pass a check that trusts whatever the webcam sends, because the software poses as a webcam. Moveris reads the video the virtual camera sends and checks for a living face.
Where do injection attacks happen?
Anywhere a check relies on a camera feed. That includes the selfie step at onboarding, account recovery, and video calls such as job interviews.
Is a face swap an injection attack?
Usually, yes. The usual route is software that feeds the swap through a virtual camera. A swap played on a phone held up to a real camera is a screen replay, which is a presentation attack.
How does the video reach Moveris?
One of three ways: the Moveris SDK on the same camera, your IDV vendor, or your server. On calls, a Moveris bot joins and checks each participant.
Further reading
Put a living face behind the next yes.
Tell us where you need a living-face decision. We will show you Moveris on your own flow.
