[ Artur Khachuyan Big Data Specialist, СЕО, Tazeros Global System ] Anonymity has died, it's dead.
The ability to do anything on the internet
anonymously has gone - there are only degrees
Like, I can write a comment on your social network page and you won't know who I am
The social network will, the state might
Most ordinary people don't realise that what
they publish on the internet stays there forever
It's an unsolvable problem with digital space
Sooner or later, there will be a leak, you just have to prepare
If someone on social media tries to blackmail you
with intimate photos, 9 in 10 panic
Only one will contact customer support,
which will promptly delete it all - end of story
[ Hacker, 2014-2019 ] Not so long ago, a sex tape
featuring the blogger “Instasamka” was leaked to “Pornhub”
As it turned out, no one had hacked her, she leaked it herself
There's little actual blackmail
While groups like 'sl*t watch' are quite popular,
where guys leak chats along with photos,
that's more self-promotion than blackmail
I think the girls and boys that do this are just messing around
because real cybercriminals wouldn't bother blackmailing people,
when they could just sell their info, and most people realise that
[ Rustem Khairetdinov, Director of development BI.zone ] I think you need to take the position that everything you post online
will surface some day, including chats
If a person takes a screenshot during a secret chat you'll see that,
but they might take a picture of your chat with another phone
A dialogue takes two, but you can't trust the other person
Maintaining this paranoia is a serious business
They'll try to sell you some protected devices but no device is really safe
In this sense, I'm an open person, and, actually, this is also a part of protection
Everyone gets hacked sooner or later,
and you should plan what to do when that happens
[ Ruslan Yusufov, executive partner, Mindsmith ] You could leave everything behind, go and live in the mountains,
disconnect, and become a farmer
The first question is if you can fulfil your potential and be happy there
Second, your personal data is probably already out on the web
Low digital literacy facilitates these kinds of leak
Maybe, you took a picture of your passport or
driver's license when signing up for car-sharing
and sent it to a third party - it's just a matter of time before that leaks
It could be due to an insider who sells the database or a hacking attack
Why? Because a passport, driver's license, a selfie with a passport -
it's all worth something
One criminal sells the data to another,
who goes to a bank and opens an account,
takes out a loan, or uses that bank account to launder money obtained by illegal means
I took car-sharing as an example
because a major car-sharing service has already had a data leak
How do you protect yourself? Don't use car-sharing
The next question is, how seriously would you limit yourself
if you didn't want to share your data with a taxi company?
Is it possible to order a taxi outside of
the centralised marketplace? I don't think so
Take another example: during the pandemic,
when countries were locked down, people relied on home deliveries
To place an order, you need to provide:
your bank card number, home address, name, and phone number
It'd be hard to cut yourself off from that
It would be difficult to live without a bank card
Where would your salary go?
[ Khachuyan ] In theory, you could erase yourself from the net
Get rid of your phone, social media and bank accounts - that's it!
But, by removing all of your info, you will decrease your level of comfort
You can do nothing without a phone
[ Speaker ] Who uses WhatsApp? Raise your hand!
Instagram?
Facebook is the biggest data holder in the world
They have petabytes of data stored on their servers
So, when you tick the box that gives those apps permission to access your phone,
you open a gate to a strange, unknown world
And most of the data that leaks is leaked in this way
Understand? They buy us with convenience
because convenience often outweighs our desire to stay private and anonymous
So, you have no anonymity
We can't stress enough:
don't think that governments are the only ones collecting data on us, they're not
In most cases, we ourselves simply trade away our data for convenience
[ Khachuyan ] Facebook was the first to be caught leaking personal data
Data can always be bought or mined there
Facebook has constantly been caught indiscriminately selling advertising info
There are two basic things at the disposal of the average person
There's Russian Federal Law No. 152 and the Right to Be Forgotten law
RTBF gives you the right to delete any info on you in search engines,
though you can't delete the source itself
For that, you'd have to contact each individual source or website
and take them to court
As for Federal Law No. 152 on Personal Data,
every citizen has a right to expunge their personal data from any source,
and they can't be denied
So, you can contact any company or organisation
and, within 30 working days, they must cease processing your personal data
But, there's another problem
There are no supervisory agencies to verify if your data has actually been deleted
From my personal experience,
it took great effort to even get my phone number deleted from a real estate site
That was a personal victory
For 2 years, I followed them, threatened them, applied to state agencies,
the prosecutor, everywhere!
It would have taken much less time and effort to just buy another SIM card,
but I had to show them who's boss
PREVIOUSLY, EXPERIMENT PARTICIPANTS COMPLETED AND SIGNED A ONE-PAGE AGREEMENT
NOW, MORE ON ITS CONTENT
[ Speaker ] Before we continue, there's a technical matter
for those of you who've signed the document…
Which one of you is Sergey Shevelev?
You've authorised me to use your phone number
to create duplicate SIM cards and other digital identification
[ Speaker ] This is your signature? [ Shevelev Sergey ] Yes
[ Speaker 2 ] It is? Okay
Anastasia Gorkova…
Yes, you've given me permission to disclose your email and social media passwords
Vera Bogdanova… Where are you? You read it through, right?
You've authorised me to use your social media accounts
to ask followers for financial support
And these are just the ones I chose. What have the rest agreed to?
'Permission to track your location and store your movement history'
That's in there too, that's the device use agreement Nikita warned of
'To use your images to create Deepfake material,
including sexual content'
Finally, 'I consent to a kidney transplant'
[ Man ] That's a separate request [ Speaker 2 ] A separate request, which…
[ Woman ] Who? Who?
[ Speaker 2 ] The main sign of a scam,
as it usually transpires, is that things get chaotic.
Like, you need to act fast or something
Remember how you signed this?
You think, 'I've signed it. Who cares about me anyway?'
Believe me, every week, we investigate cases where people thought:
'I just forgot to set a password. So what? Who needs my data anyway?'
Meanwhile, your company suffers huge losses
And you think like that right up until something happens,
not on a TV show, but in reality
[ Anna Kulik, Profiler, president of the science and research center for corporate security 'I've read the user agreement, it's okay'
'I've read through that contract or document'
We are all experts and pros when it comes to reading agreements
It's essential to keep that little paranoid guy in your head,
who should ask, 'Are you sure? You've really read all of it?'
As our experiment shows: people are even willing to give us their kidneys
[ Gleb Mikheev, CTO, Beta Digital production ] There are other methods
that don't involve tricking unfortunate people
They use shortcomings in software
[ Ivan Botanov, Penetration tester ] Basically, there are client and server attacks
Client attacks are like hacking your FB account
Server attacks are like hacking FB's server, so
the degree of damage caused is very different
With server attacks you can…
If you hack into the system, you can take control of all user accounts,
data for millions of users
Then you just upload it
[ Hacker ] Interestingly, it's a two-way thing
Databases can either be inside a server or outside
With utilities, we can see which version of a database has been compromised
As soon as we see the version... if we're lucky, it might be version 8 not 10
Version 8 is full of security holes because admin was too lazy to update it
It's just what we need!
So, you see you failed, but you really want to get into that database
So, you look for anyone selling vulnerabilities to the versions
Of course, it costs a stack of cash! But the opportunity is there
[ Botanov ] There are 'zero-day vulnerabilities' no one knows about
So, antivirus software is helpless
No antivirus software would detect anything
You won't be aware of just another process running in the system
Who looks at processes running in their systems?
[ Hacker ] Once you've got access to one server,
you gain access not only to that server
or that PC, but you can also access the entire network
So, once you've got yourself a network, you become God Almighty
You do whatever you want with it
But you should always strengthen your hack
You make a backdoor to come back to that network at anytime,
to go on with what you were doing in it
Where do backdoors come from?
Ask the system administrators!
Sometimes, they don't track the processes running in their corporate networks
[ Khairetdinov ] The Darknet has much more information than the 'light' version
that we use daily, and it's totally unregulated
So, since there's no regulation, 95% of what's there is illegal:
weapons, contract hits, drugs, human trafficking, and so on
It goes through the same cables we use to get on the normal internet
So, that's a problem
[ Hacker ] On the Net - let's call it the Darknet - we can find all kinds of stuff
We're not talking about illegal drugs,
as you can get those anywhere
Deeper down, you find people who've been in IT for a long time
They buy and sell data
Making money selling illegal things, drugs, and weapons isn't as exciting
as collecting information on people
They could be ordinary folk, like an annoying neighbour, or famous types
You must understand, nothing can be kept secret in this world
Everything's for sale
[ Hadi Hosn, CEO, Axon Technologies ] The byers of those information are either other hackers
that feel they can take it further,
and utilise that vital information to create another hacking attack -
or they could be potentially companies or people
that can use this information for identity theft.
They can use that information and sell it on potentially
with other pieces of information that they have at a higher price.
New types of information that give you a lot more identity sold at a higher price
versus a database of all this information.
So they try to break it down, they take a database leak
And they break it down and they try to take some selected pieces
of that information and create another sale.
And maybe at a smaller volume, but a higher price.
[ Gadar ] For instance, the notorious Joom leak
A huge amount of personal data, including bank cards, got hacked
To make money off that database,
no one's going to sell it as the 'Joom DB'
Bank cards and their BINS get sorted
and sold off at 10 times the price
[ Hacker ] They sell two types of service
They sell either data or access to the network, but not to the database itself
So, you have a chance to get what you want
They've sold you an opportunity to connect to that network and download data from it
Databases come relatively cheap
In Russia, you can easily buy a good database
for between 100,000 and 400,000 rubles
You get a robust, feature-rich database,
normally with a few million people in it
It's not always social media users, they may be
pensioners, kids, or teens with new passports
So, they build a database and maintain it for future use
There are also people who can easily make a fake passport using the data
[ Khairetdinov ] They create fake identities
You can fake a person's identity
with just a little personal information that's easy to get
[ Rafael, cybercrime victim ] I opened my Instagram
and saw a message from an unknown account
that had a selfie with my passport as its profile picture
I saw pictures of my documents, two pages from my passport,
my driver's license and passport pic
They also sent a credit contract and one for credit insurance
They said they'd applied for a bunch of credit in my name
They threatened to max out my credit limit using bank insiders
If I didn't pay up, they'd apply for more credit up to $125,000!
I had three days to comply with their demands
[ Khairetdinov ] It used to be that only governments could create a fake ID,
such as a passport in a new name
Now, anyone can do it by making edits in some databases
When they steal someone's identity, they operate in another's name
With a digital signature, they can sell your flat online,
via official channels with forged certificates, or stolen passport details.
They have everything they need to make a transaction!
In the system's eyes, the operation's 100% legit
[ Rafael ] I searched my credit history
I've never applied for credit
and I've already got a 6-month credit debt
They waited for 6 months and only then did they message me
After 2 days, I got another message:
if I didn't send money,
they'd set up an online hate campaign, accusing me of raping a 6-year old girl
A few of those messages had already been posted
They sent me screenshots. Those messages were real!
I was supposed to be a very dangerous man
I shared a short video, and told people about the whole thing
I really don't know what to do
I keep getting messages from different accounts:
'You are a scum! How could you rape her?'
If any of you are lawyers or know the law, or know what to do in such a situation,
I'd be grateful if you would message me, and help me sort all this out
I've changed my documents. I'm keeping a low profile
I try to avoid showing documents at security checks, and attempt to bluff it
Leaks from car-sharing services…
Google it, you'll see this stuff has become pretty standard
You go on with your life and then find out someone applied for credit
in your name 6 months ago, or a year, or 5 years ago
Credit you'd never applied for!
When you go to the police, they say:
'It's routine, there are plenty of scammers in this country. Don't worry!'
[ Yusufov ] We live in a magic world today!
We wake up, open our eyes, press a button, and 15 minutes later, breakfast's delivered
It's magic. I can't imagine how they get from A to B in 15 minutes
and deliver your meal while it's still warm!
It's magic: ordering a cab that comes in a minute, or transferring money in seconds
However, it's so convenient that the majority of consumers don't care
whether their passports are leaked online or not
[ Khachuyan ] We discuss the problem of personal data leaks a lot
It's being discussed at the highest levels
But the average Russian isn't bothered
And until something serious happens…
Only when some severe social issue arises that affects 90% of the population,
will it stir people to do something about it
[ Hosn ] It's really culture change.
And it's an awareness of risky behaviour that exists in this cyber world.
And we're not saying:
we're scaring individuals and families away from the internet.
The internet is full of possibilities - the internet is very valuable.
It's being used in so many different ways as part of research,
as part of development of the human evolution and human improvements,
that we have across different industries:
whether it's healthcare, or automation, or transportation.
But it comes with those risks that need to be aware at a very young age.
There is much better education going into schools now,
but it's home that has to be that same kind of understanding of -
what are the dangers and risks of being connected so well.
[ Svetlana Ostrovskaya ] Hello everyone!
Today we going to talk about Hi-tech cybercrime trends;
and this is actually very important because last maybe 10 years
we have really high number of different cyber crimes
and we have actually growing amount in different areas and in different spheres.
So, it's really important to know about the latest trends
and it's really important to know how to
protect yourself, and protect your organisations -
like your future companies against cyber criminals.
I also want you to discuss with me
all of these topics, that's why this question is for you:
"What do you think is the motivation of cyber criminals?"
It's not sometimes, it's one of their best motivations.
Most of the cybercrimes: they're happening just because
people want to earn a lot of money.
And the second group is actually hacktivism and terrorism.
They have their own ideas -
and they are trying to perform cybercrimes
just to draw a lot of attention to their ideas.
The next group of motivation is usually
state sponsored groups and state sponsored motivation
And in this case, we have hackers and we have groups that are trying to
do something in interest of one country; and usually
they are doing attacks against other countries.
This is all about government and politics.
HACKING WENT BEYOND BREAKING INTO SOCIAL MEDIA ACCOUNTS AND STEALING MONEY FROM BANK CARDS A LONG TIME AGO
TODAY, MOST COUNTRIES HAVE CYBER ARMIES
[ Sergey Petrenko, Head, Information security center, Innopolis University ] In 2011, cyberspace, along with land, water, and space,
was declared by the EU and the US to be another strategic area
If a 'rogue state' conducts a cyberattack, it could be responded to by any means,
including strategic nuclear forces.