The Basics of
Data Security:
Hackers
CC-BY
Fabian M. Suchanek
Overview
2
•
Types of cybercrime
•
Vectors of attack
•
Protecting yourself
Damage by cybercrime
3
In 2021, the total damage by cybercrime is estimated at
$6bn
.
Users
• have a device infected by a virus or other security threat
• experience debit or credit card fraud
• have an account password compromised
• encountering unauthorized access to or hacking of an email
or social media account
• make a purchase online that turned out to be a scam
• click on a fraudulent email or providing sensitive (personal/financial)
information in response to a fraudulent email
Damage by cybercrime
4
Three common types of cybercrime:
1) account hacking (see
other lecture
)
2) malware
3) identity theft
Def: Malware
5
Malware
is any undesired software, in particular:
-
viruses that delete data (rare...)
-
adware (e.g., “introductory screens”, toolbars, etc.)
-
keyloggers (logs your keystrokes and thus knows your
passwords, email content, etc.)
-
spyware (tracks your activity to target ads or to blackmail you)
-
software that takes control of your computer to send spam,
host child pornography, or participate in denial of service attacks
-
ransomware (encrypts your data and you have to pay to decrypt)
A
ransomware
is malware that makes your data unusable
by encrypting it, and requests a ransom (=money) to decrypt it.
Def: Ransomware
6
The cost is not just the ransom, but also
- operational downtime
- higher insurance fees
Some ransomware also threatens to sell the personal information
online. Here: the ransomware “Ragnar Locker”
Ransomware++
7
In some cases, the pirates threaten to publish information about
fraudulent behavior of the company or about the sex life of its bosses.
Theft of personal information
8
Stealing
• credit card numbers (-> the thief can buy on your card)
• bank login details (-> the hacker can take your money)
• login information (-> the hacker can access your accounts)
• personal details (-> the hacker can impersonate you)
It is sometimes enough to know your name, your
birthdate, your city of birth, and your address to
- order a new credit card
- reset an account password
- receive new bank credentials
Theft of your ID
9
Your personal id can be used to
-
set up a fraudulent Facebook profile
-
money laundering
-
set up a company in your name, and have
it default
-
set up a credit card account in your name
-
open a bank account
-
ask for a loan
So don’t give away scans of your id
easily!
Consider adding watermarks
“for renting apartments only”
Overview
10
•
Types of cybercrime
•
Vectors of attack
•
Protecting yourself
Vectors of Attack
11
The main entrance points for the different types of cybercrimes are
- clicking on fraudulent links (and installing something)
- clicking on fraudulent links (and entering personal information)
- opening fraudulent Office documents (and running the macros)
=>
It all boils down to identifying and trusting
the party who provides the link/document
Fake Emails
Fake emails
are emails that pretend coming from a legitimate sender,
and that entice the receiver to download software, enter personal
information, or otherwise compromise their security.
Writing fake emails to gather personal information is called
phishing
.
It is very easy to send a fake email:
-
the target address can be any of those that are available online
(legitimately or not)
-
the content can be taken from any of the emails that companies
usually send
-
the sending address can be modified ad libitum (unless sender
verification is enabled) [
Gmail help
]
12
=> The only protection is your own vigilance!
Fake Emails
13
=> The only protection is your own vigilance!
Fake emails
are emails that pretend coming from a legitimate sender,
and that entice the receiver to download software, enter personal
information, or otherwise compromise their security.
Writing fake emails to gather personal information is called
phishing
.
It is very easy to send a fake email:
-
the target address can be any of those that are available online
(legitimately or not)
-
the content can be taken from any of the emails that companies
usually send
-
the sending address can be modified ad libitum (unless sender
verification is enabled) [
Gmail help
]