Lecture10 Cyberpsychology Flashcards
The more sensational the content, the greater the spread. Now there has been numerous studies investigating the technical aspects of such concerns e.g. the use of bots to flood inaccurate info. and from the social sciences there are also numerous studies that observe that people have an inclination to share based on emotional responses such as fear or humour so the propagation is not always artificially inflated. We in the cyber security world need to bridge the gap to understand how cyber threats target technology & people together - the cannot be approached in isolation which demands input form both computers and social sciences in order for the cyber security community to respond to non-traditional threats. By doing this, and understanding how we engage online, we can prepare adequate responses.
Introduction
Phishing
the practice of sending emails that appear to be from reputable sources with the goal of influencing or gaining personal information
Characteritics:
- sense of urgency
- similar look and feel to make it seem authentic
- client address is email instead of name
- similar look and feel to buttons
- images stolen from linkedIn profile to make it seem like the sender is legitimate
- many classical elements of social engineering here
As of April 2020, Google is …
blocking 18m coronavirus scam emails every day
If we are aware of these scams, why are they still working?
- timing e.g. no precedence for pandemic payments so we don’t know what to expect. In Ireland, from April 14th, 533,000 have been given covid payments resulting in a broader pool of people to target. Also people might be under financial pressure or anxious and so more susceptible to risk
Examples of cyber breaches
1) Data security threat scars digital healthcare: security researcher proved that they didn’t have surgery by showing they had no scars. (Security breach led impersonator to steal healthcare info)
2) Businesses warned of increased online fraud: spearphishing attack - victim received an email from an attacker impersonating as a solicitor requesting a 5 figure sum
Impersonation
The practice of pretexting as another person with the goal of obtaining information or access to a person, company or system.
e. g. attacker impersonating a contact tracer, seeking to info about grandmother
- the nature of online communication facilitates impersonation
Attention Economy
Games are designed to completely engage you on multiple levels. Your attention is a valuable resource to online providers. Your time online is revenue for that provider. Developers are battling for your time otherwise known as the Attention Economy
Gaming attacks 1
Applications are immersive and designed to engage e.g. in-app purchases, alerts, friend notifications, communicating with peers while playing all designed to increase engagement. Attackers are aware of this and add digital marketing techniques and prime the target to click something or do something
Lockboxes
an example of monetising play. In order to proceed you may need to purchase a key for example
Gaming attacks 2
Attackers produce professional looking social media sites, blogs, commentary, updates that kindly guide you to install what is often malware.
Principles must be created for game design and websites to inhibit this sort of attack
Information presentation
We tend to see brief headlines and snippets of info.
The more we see it the more we accept it
Health debates online
A study from 2018 studied how Trolls, twitter bots & cyborgs influenced a measles vaccine debate.
Dr. Google described how parents can trust this online info over health officials: techniques such as posting positive/negative comments to increase the perception of authenticity. The problem is they’re inherently biased. This was observed for the measles outbreak in 2015
Sample tactics
1) Hashtag poisoning: wereby the content is altered unexpectedly to the reader
2) Posting arguments from both sides of a debate to make the argument seem more plausible
3) Targeting individuals who are likely to post a view to a target audience
4) Trolling and harassing people that don’t agree with a view
5) Multiple channels: the use of multiple online channels to broaden reach
6) False reports of malicious accounts to have legitimate accounts temporarily blocked
Cybersecurity considerations
Social engineering
Social Engineering techniques
- Open Source Intelligence (OSINT) is the term used to describe gathering information about someone
- Elicitation/Drawing out info
- Pretexting/Becoming someone else (impersonating)
- Psychological Principles/Mind Tricks
- Influence/Persuasion
Many of these techniques apply to both online and offline
