been like either before lunch or after
lunch for me and yeah it’s after lunch
this time one fine morning oh yeah I’m
just a normal engineering graduate who
started my career as doing testing and
coding it’s been a while since I was
doing it but security was kind of booing
at that point of time where people were
talking about
I saw I’m a very movie influenced person
Godfrey
you know very interested when impressed
with Tom Cruise hacking another bunch of
American guys doing aegyo they were
hacking stuff so I got very motivated
and I wanted to be one and when I was a
kid I always wanted to be either a
he-man or a Batman
so which was not at all possible but
what happened was I was doing this
normal gig every day of testing
development and typical IT stories one
fine day I realized that Security’s got
a huge potential and this is Indiana
Jones how many of you watched is Indiana
Jones
what is Indiana Jones do explore right
fight the bad guys explore and go for an
artifact so the people aroma Indiana
Jones Indiana Jones is like a character
a fictional character where he hunts for
the hidden artifacts in a lot of stuff
so the I figure out that okay Indiana
Jones is a pretty interesting stuff he
goes behind a lot of things I realized
being a security researcher was my co I
taught at secular research is my
interest but my daily bread is basically
testing and development I cannot do that
so what what do we do be the researcher
like be like Indiana Jones look for
clues gather all material you work at
day and do your day work too because if
you have to reach a goal it takes a
while to do it you cannot be a superstar
in just one day right I figure that out
so I started collecting a lot of info
started reading a lot of stuff and then
I was pretty confident I was doing an
Indiana Jones Act well what happens in
the night how many of you have Batman
friends here oh yes he earns yeah good
okay so Batman has got all these cool
gadgets that’s my second inspiration the
cool gadgets and a lot of stuff fights
the bad guys
and I actually like the fact that he
pretty much operates at night well that
was actually an excuse in a reason
because I didn’t find time to do these
things during the day even I started
doing like this so he started doing the
day job collecting info and then when
the night kicked in I became like doing
collect verifying all the info that I
collected so I was able to understand
what security vulnerabilities are what
hacks where what attacks where so I got
a basic idea of how these things work
the bottom line is I’m neither internet
Jones was a bad man right I’m neither of
these then I figured out how cool is a
researcher to be like yeah it’s like the
suit yeah that he wears is so cool right
being like James Bond get the Bond car
and a lot of gadgets and you come and
say come bond James Bond yeah I’m a
researcher security researcher yeah I
started cool now comes the reality
stepped into this field and I people
started actually at least believing that
I’m a security researcher or an ethical
hacker when the doors opened I see a lot
of these things when I a lot of things
as a researcher you’d have to look there
were a lot of attacks happening in
various forms of the computer beat your
computer your operating system your data
gets stolen your mails get compromised
phishing your Facebook passwords then I
figure out that you need something to
divide these crimes before you analyze
these so I started taking this task of
thinking how crimes can actually be
divided I figured out there are
basically only four or five genres of
crimes okay this is not my own ideology
if it’s all from movies again okay
Joker says in Batman never do something
if you could at something never do it
for free right then I figure out that
crimes are like forged honors won people
want you to get scared play with your
emotions first of all so they try to
commit crime for that too there are lot
of people who really want to do crime
because
they just bored yeah that’s true three
it is find out I found out something was
like bad crime people were paid to
commit crimes like people were paid to
steal your passwords and the fourth one
is sometimes there’s no logic for crimes
okay these were the four genres of
things I figured out then he started
digging one by one the Sherlock Holmes
code came to my mind crime is common
then I found out the Lord of these
attacks that happened toward today in
computers were crime is common but the
logic is rare only very few crimes
you’ll be able to find logic okay then I
found out common parts of it scams were
very very common the left one that you
see is a day to reactivity we live in a
world of technology everybody has got a
smartphone
everybody’s got computers tablets
everything so when this landscape the
threat landscape kind of increases
because your technology broadens you’re
happy with your technology yes you
should
piracy is what piracy and privacy is
what you pay as a price for it so we
have to bear it the left one is a very
common scenario where they send you an
email that looks like an iTunes received
okay it comes to email one fine day so
the coincidence matters you have an
iPhone you can receive that says I
cannot name the game maybe okay you
don’t have a famous game app and it says
four dollars swiped in your card for
this game you’re all smart right we have
four fact three factor authentication
that when you swipe a card you get an
SMS and you’re pretty confident that I
only swiped it well in this case you
didn’t get a swipe and you’re pretty
confident that you didn’t make this
purchase
now you immediately go and click saying
I did not make this purchase yes or no
how many of would you to it raise hands
I don’t see hands I see hands yeah good
okay so when you do that that’s where
you get attacked even if you don’t click
it or you click it you kind of get
attacked here because they are playing
with your emotions the right one is very
calm
how many of you got these type of emails
saying that your Outlook is expired
please click anybody here okay you got
it
okay so this is again the same thing
because we are in a world we live in a
world where we are like very very very
very in a rush lane we certainly see
this in said oh yeah this might be the
email ID values where I clicked when I
was in class six or five somebody’s
misusing it let me update it you’re
trapped
you doomed common scams okay campaigns
seasons and time attacks okay dude you
just drop your wallet can you see you I
see your wallet down you won front row
you you drop your yeah this is called
dealing with emotions okay I just caught
him panicked no I did so basically the
first time Jenny the trick works in the
first time so you didn’t do it so T like
two or three times I stressed it and
think he thought that okay he trusts the
speaker who speaks here and he trusts my
action so he just looked for the wallet
some getting into someone’s computer
does not require the computer itself but
his emotion okay we are all very
emotional people at times right we feel
sad for somebody’s post and try to click
Allah you know donate or click on it
share it that’s what happens hacking and
these crimes basically happened based on
emotions that’s why I put it as
campaigns season and time targets
what are these campaigns basically how
many of you buy online products here or
guys you’re all in a major soup nice ok
ok the main root of this problem is this
ok all these people we think criminals
are just doing things at the back of
their hand or no they are all they know
how the whole market functions it’s like
buying on a sale if it’s 50% sale how
many of us buy everybody buys right ok
leave that buy one get three free how
many of you will buy what I will buy
yeah ok that’s the problem where the
problem arises it’s like when there are
10 legit emails and
then there’s one email that says free
offer it looks really like you’re legit
email but it’s not that’s where you get
your passwords or your credentials
stolen how many of you so this the
picture that says is zooming inside a
domain name what’s a domain name we all
live in a domain name world right
ww-well com every transaction in the
internet that we do today is based on
domain names correct right from your
flight bookings your Train bookings your
even they sell medicines online right
movie tickets every transaction involves
domain names social social networking
everything is done through these domain
names to this domain name becomes how
many if you type the early past your
keyboards by mistake for Gmail
sometimes and still if instead of GMA hi
Ally type GIMA and still opens up your
Gmail sign-in page would you suspect it
and with the green llama I mean if you
notice the green log when you make
transactions a green symbol can anybody
say what something similar about sorry
sake you alright okay proving you all
wrong right now no you’re not secure
okay it’s actually secure you’re correct
so what happens is so when you see that
green lock sign there that gives you a
sense of trust and saying that your
transaction is actually safe well what
happens here is this concept is called
as typosquatting typosquatting is
nothing but we pay a price when we type
a domain name very fast attackers what
they do is they do a lot of combinations
for these domain names if there’s a good
domain name that exists they play around
and replace these domain names and
register
domains under their name and host
similar content pages now if I have a
gmail.com page and if I do a typo
squatting type it by mistake and there’s
a Gmail phishing page I mean see a
similar page like Gmail would you enter
it or not yes who’s that yes awesome why
would you enter it sorry okay just
because you got what you want but you
would not see what’s there in the
content or not right okay this happens
really with based on trust because if
you see the green symbol and you see the
same thing then you are actually doing
so that’s the whole bottom line of it
what happens here is that green symbol
is also being tampered now that’s called
as an SSL certificate which means
whatever transaction I am doing only me
and the server can actually know it’s
all encrypted gibberish Lilla eh tc3
what some words are there because you
cannot decrypt the whole thing so here
what happened was a famous incident
actually happened there was a company
what they did was they started saying
that the world should start
communicating the encrypted way and they
started giving these free certificates
all these attackers started buying these
free certificates and attached these
free certificates through their bad
domains
thus when this mistyping type of
squatting happened
they all got fooled and duped you think
we save what we are not so always have
an extra pair of eyes when you type your
stuff well now I’m going into the get in
the gun mode just give you advice saying
that be careful what you type with take
your time don’t be in a hurry and just
type it so these are the three things
okay now I play a lot of games to be
honest vary a lot of games okay question
time let me ask this question what if
what’s the famous okay say this we watch
a famous movie very famous movie ok or
TV series that we watch you’ve been
following it for yours I mean every year
it comes only 10 episodes for instance
or how many of you watch these free
cricket matches in colleges when you are
not allowed to well I used to watch one
if you used to watch it there are a lot
of sites right that gives a lot of
redirects and ads what
really happens here is they’re trying to
lure you into this trap which is anxiety
anxiety emotion is one thing
anxiety is I got to watch this match I
want to see either collie score a
century or India gonna trash South
Africa I wanna I want to do that now
what happens here you’re no hurry
correct okay you have a plethora of
whatsapp group where you wanna update
saying wicket fell this guy’s Co century
and they all say awesome what happens
here is now you go to the site and click
the site the site says how many of you
seen this your Flash Player is outdated
please update your Flash how many of you
seen this well now you see a lot of
hands okay everybody’s awake nice okay
cool know what’s the problem what would
you do
you saw so so or say there’s a celebrity
news oh this is this is what sells most
of the times this this celebrity got
married to the celebrity click here to
find out then there’s a video is there
is an original footage breaking news how
many of you see this breaking news
everywhere breaking news breaking views
iPhone design leaked breaking news so in
click on it now it lose due to the trap
it says click here to allow the this
flash content would you allow or
disallow viewer yes right
hello it the problem starts here I’ll
tell you why we have very smart people
at times what we do is three years
before you’re downloaded a browser okay
and we are very smart enough to watch
only these type of videos in the browser
one fine day this happens and you open
the browser again and you do it because
you’ve not updated anything and this in
a very simple term what does this when
you do Anna love it’s outdated it drops
a malicious piece of code which you will
not even know it’ll steal your bank
credentials it’ll steal your passwords
this typically happens with games and
with children because when children play
these all these free games what happens
is there’s there no hurry they want to
play these games they say it says next
next next next how many of you read your
terms and
so after installation how many of you
read the terms in condition next next
next finished right okay the same thing
happens here nobody wants to read okay
so when this happens is they will not
feel a difference but it will make your
computer to send out a lot of spam mails
or it will send out mails to different
countries saying that you are an
attacker without your knowledge so this
is the reality that we are in today and
without your knowledge it will steal
your passwords every week and then what
happens these kids go to school and it
says dude you know what my computer is
really slow then you have another genius
kid in that gang that kid says I know
there’s a virus in your computer
download this feed software it will
remove all the way this the kid goes
back and downloads that software which
itself is a virus okay so the kid
downloads it and he calls up the kid and
said you know what dude the computers
superfast no and it steals an extra lot
of information again if you don’t know
something do not install when you see
these things in the screen saying you
how many if you see in this your
computer has been affected by virus
click here to remove it okay I think all
of you guys are watching some content
which is free content or free at sites I
guess yeah welcome to the world so
careful with these things when we do it
okay so I wanted to do this so how smart
are attackers so when I divided these
faces of attacks I started to understand
the whole pacing of it now do you see
the timeline I become a superhero now I
am a cool researcher I know how security
works now reality hits me I see these
cases at work every day this is one case
where sometimes the case comes and says
there are people who come to me and say
that I clicked on something and it
locked my computer Wow okay now these
are things that we need to do a lot of
digging and investigation what is that
now basically this is because I’ll tell
you the hole so when we are researchers
we do not our only job is not to find
the attack but to see the history of how
the attack would have happened so this
is one such case that we I decided to
just drink dig in deep and find out how
it happens
do you see this something called is in
why
calm okay the basic agenda behind this
attack was see I look I just look really
smart okay I not not now I just
generally look really smart very cooling
clad coolers walk into this reception of
a manufacturing company and said you
know what hi I’m come from such and such
company well I’m just looking for I just
speak Spartan accent English okay you
know what I’m really looking for
something we do we need to do a lot of
orders for a company thousand pieces per
week wanted to do you have contact
number and the receptionist hands over
wasting got to you okay in most of these
small scale companies beats the can
manufacturing companies or small small
firms okay I would take a live example
of these two people which is present
that they have their own companies I go
to the companies and say hey guys hi I’m
Sean I just want to give an order for
like twenty thousand toys and I’m really
advocate of plastic I don’t wanna I hate
these plastic things right so I want to
buy your product so the reception had
this hands over thought to me
technically in these companies when they
do these small-scale manufacturing
industries they have an email ID that is
a common email addy to the receptionist
the receptionist actually handles all
the mails
am I correct or not here perfect okay
yeah now I dropped an email saying as
for discussion on this such-and-such day
please find the court so the discussion
was with you so the receptionist things
that we have actually placed the older
order already please find the invoice
for the thousand five hundred toys I
placed for this week and the code for
the next fifty thousand toys that I’m
going to give would you open it or not
you would not open it but the under
Yeltsin hurry or somebody would open it
or not the receptionist opens by mistake
the receptionist wants to see it and
send an email to you by mistake would
congratulations your computer has been
encrypted all your data has stolen so
this is called a cell handsome we’re
attack what happened here is probably
the company thought is running this
computer this reps eNOS is having an old
windows
precautionary turned off updates
computer and a fake Windows 7 when they
open this that piece of code what it did
is it found out where’s the flaw and
just put a password on top of all your
files you cannot guess that password it
encrypts all your data and you have to
pay me money to get back your data I
don’t care if ur so the problem today is
in the modern world as people panic if
they or for toes are lost oh my god all
my 10 years and very big anniversary
pics are gone so they pay back money and
they get it this is where the problem
starts think before you click
did you see the intelligence aspect of
things here I analyzed the situation
I saw the I saw the entry point I sent
an email boom I mean so this is ok if
you’re very careful with clicking no
dialing – okay so this targets happen
for people who are a little bit elderly
people have the kids in the US and
something comes like this saying that
your computer has been this care we’re
basically panicking you if you call to
this number they’ll talk really very
spot on English and they will ask you to
deposit hundred dollars in their account
so that this will go unfortunately if
you restart your computer this one come
back again that’s the trick you got to
print fooled now again banking Trojans
this is the major pattern today so every
time when you see is these two types of
attacks now this the third thing is the
banking Trojan same way it comes in as
an email and steals all your banking
related info this has been on the rise
so we did a research on this and I
cracked a case recently where it came as
a Christmas greeting card malware it
said Merry Christmas greeting card from
some legit account from the US when you
opened it it is Merry Christmas for your
computer yet stole all your data all
your credit cards so we cracked the case
if you see the logic behind all these
crimes is same I send you an email and
you click on that I either steal your
data or I either put a password on it or
I will just dump your data the logic is
same here be it if you play games that’s
the same thing so the logic is same
what’s the bottom line of all these
things human beings right
you might have a billion dollar
enterprise security in your company but
you press the button it’s all is there
in the click of your hands so the logic
is the same as I said and the crime
pattern where is so the next person who
wants to commit the same crime would
change a little bit of the logic instead
of stealing your banking Trojans he’ll
steal your other data and it goes goes
like other data and goes goes on and on
okay this is the bunch of self
infections that I have done to myself to
my computer because I always feel that
this is not a profession it’s social
responsibility there are people fighting
for a lot of things today be it today if
you see what it’s seen through a stock a
lot of people fighting for a lot of
things in the environment or for Human
Rights or for educating people well this
is my home ok I I wanted to be a
superhero well I am now I don’t have a
suit I don’t have a cape well I don’t
want this suit to but if this I want
this Internet a better place for us to
serve because our kids our future is
going to learn from this that a lot of
people who are using it for really good
purpose and the Lord of malicious actors
who are not allowing it to do it well I
stand up here because I want to be the
Batman yes I am the Batman in my circuit
yeah I like how it goes is if I start
educating hundred people when the
hundred becomes 300 the 300 becomes 500
awareness kicks in this is a profession
that we people need this is an
interesting place where you can think
and do a lot of things we need people to
do this so we we self infect ourselves
most of the times and figure out and
find out immediately write a blog post
for people to reach out this was always
a maze for people people felt that oh
security is something big hacking I
don’t understand that’s why I took the
blog by someone started writing called
his Batman with security I put Batman as
a detective and started putting stuff
very easy for people to understand so
this is it we all have a social
responsibility guys I have stood up
already without a cape but the secret
ingredient that I always thought was
being a superhero you
are the secret ingredient here guys it’s
it’s teeny-tiny somewhere here when you
put into a different it in a situation
where well you have to save the world
you stand up you stand up against these
crimes when you meet somebody we are all
technology people when we meet somebody
try to explain these things in a simple
manner to them educate your children do
not give them the curfew of not to play
games play games but tell them how bad
this is for them educate children
because children can pass out on
information like wildfire
okay tell the children that you know
what how this is is this like the Spider
Man who jumps inside it the Trojan comes
inside your computer like that then you
understand put that to the way that I
understand if you see an elderly person
next to your house or for the help
saying that uncle or auntie T you have a
default password in your Wi-Fi I can
help you with that and tell them that do
not click anything uncle and if you see
if you’re not sure of they might call
you from the bank saying that your
password has expired do not give your
debit card details educate we are here
to spread the word change begins with us
yes I have stood up in Gotham to fight
the crimes the cast the bad guys in the
internet I promised that I would do it
for the next how many hours I can but I
want people like you to join me and do
this ladies and gentlemen thank you so much for giving this opportunity