On November 17, the JASON Institute hosted its second webinar of the academic year. This time the topic was the secret world of social engineering from a hacker’s perspective.” We talked about the relationship between COVID-19 and cybercrime; the types of cybercrime; cybercrime as a service; and prevention against cybercrime. For this webinar, JASON was delightful to welcome Erik Remmelzwaal, an expert on cybercrime and the Managing Director of Zolder B.V., to give us an insight into the world of social engineering.
We started the evening by discussing the relationship between the COVID pandemic and cybercrime, Mr. Remmelzwaal observed that cybercrime such as phishing/scam/fraud has increased. These kinds of cybercrimes are non-technical which tries to mislead people by giving their personal details of their accounts. The purpose of such crimes is to steal those accounts and sell them to other criminals. As a result of the pandemic, these kinds of cybercrimes has taken off and there are two reasons for this. First, the pandemic has created an opportunity in the types of scams that can be used by criminals to mislead people. Secondly, since a lot of people are working from home, scammers have a lot of free time to target individuals. Therefore, it is very important to understand the types of cybercrimes that exist out there.
According to Mr. Remmelzwaal, for most entrepreneurs, the realm of cybercrime is a difficult area to understand. Therefore, educating business owners and entrepreneurs in simple terms of the risk their businesses are facing is very important. Mr. Remmelzwaal mentioned seven types of cybercrimes: hacking, social engineering, malware, human error, misuse, physical and environmental. However, for tonight’s purpose, the main focus will be social engineering. In the field of social engineering, Mr. Remmelzwaal focuses on phishing and pretexting. Phishing started out as an email threat, but today phishing can occur through all kinds of messaging platforms, especially Whatsapp. Pretexting would require the attacker to acquire actual information about individuals before contacting them. Such crimes have changed the way cybercriminals are being perceived. Usually, cybercriminals were seen as untouchable, but now evidence has shown that many simple cybercrimes are being carried out by local young people. One of the reasons may be that it is safer to carry out cybercrimes than drug-related crimes.
Turning to the topic of cybercrime as a service, Mr. Remmelzwaal explained that there is a thriving criminal community, where cybercriminals provide services to each other. Such services are the building blocks of an imminent cyber attack on a victim. He gives the example of Paunch, a Russian cybercriminal, who created the blackhole exploit kit. This tool provided other criminals to distribute their malware successfully through the exploitation of vulnerabilities in the software code of the web browser to install malware automatically. Since web browsers have become a lot safer, cybercriminals have turned to the human side of the computer, which is done mostly through phishing and pretexting.
To create a resilient digital society and to prevent cybercriminal activity, first and foremost it is important to understand what is happening. This means that one should think beyond technical prevention by doing research, detecting the issue, and then respond appropriately. Therefore, it is crucial that companies and entrepreneurs learn how data is being stolen from their companies. Secondly, to prevent cybercriminal activities, it requires people to change their behavior. For this educating is not the only way to change people, motivation and ability are two important factors that play a role as well. Therefore, it is a psychological and legal area as well. Lastly, as we assume that such criminals are home-grown, it is vital that proper technological skills are being taught. By doing so people can learn that there are boundaries in what they can do and what will be the consequences of their actions.
Towards the end of the webinar, some of the attendees asked how often people actually transfer the money as a result of phishing and pretexting. Mr. Remmelzwaal explained that not every cybercriminal activity gets reported to law enforcement. So there is not a complete picture of how often bribery or criminal activity is successful. However, for a couple of years, bribery or asking for ransom has grown a lot. In protecting the Dutch government from cybercriminal activities, it depends on the different ministries, but cybersecurity still needs improvement.
You can rewatch the webinar on our Vimeo, click here!