Press "Enter" to skip to content

How We Can Make Digital India a Secure Digital India | Rahul Tyagi | TEDxTheNorthCapUniversity


I’m the co-founder and vice president in
the company known as loosen us in
today’s my talk I’m going to show you
some hacks which I feel that you should
see daily we have seen so many news you
know everyone is saying that this much
bank account got hacked someone first
some person’s personal pictures with
done without clothes being released
online so I’m going to show you today
hacks which really mean to you being an
Indian and at the end of the talk we’ll
talk about how together you and me can
make our nation more secure than before
in terms of cyber so my talk is
transforming digital India to secure
digital India let me start with the
story September 2017 in America
everything was going very well
people are going to a job having good
time but suddenly something happened
that something happened which really
transformed cybersecurity forever in
terms of Finance in in most of the
countries a company named Equifax got
hacked
now what is the effects in case you do
not know it’s a credit monitoring
company which basically have records on
every individual in America so for
example if you have to apply for a loan
they will give you a credit score which
is required to apply for the loan now
this information is very confidential
which includes your social security
number just like the other card in India
if someone gives you if you are give
someone your card number than their
certain kind type of attacks someone can
perform but in India we are quite secure
now most people think that u.s. is far I
had done in terms of cyber security of
course they are but one thing you should
be proud of the amount of attacks and
money we are losing is far less than
America which is quite a deal now this
company who keeps the French rate of
almost every citizen of America and the
private financial data of almost 145
million American citizen leaked and was
on sale
in the deep web how many of you know
about deep web okay are you a frequent
visitor sir of course not good so in
case you do not know what is deeper so
deeper is the internet which basically
traditionally doesn’t come on internet
there are certain software’s to access
the data type of Internet and once you
are on the that Internet you can
actually buy kind of bad things like
drugs guns and so on so we should not go
there for the time being
now person when I say personal financial
data that does not mean this type of
data for this type of data like your
personal searches like how to hack my
dad’s phone how to act my girlfriend’s
phone number and so on and Facebook
Instagram I’m talking about the
financial data which metals basically
the breach disclose Americans this type
of data their social security number
their driving license their addresses
previously and like their previous
addresses and recent addresses now this
is a information which in America is
very difficult to get if you are a
federal prisoner or a witness then only
this information you have to disclose
but this information right now is in
public domain for sale anyone can go
there and buy if they have certain money
and they say all transaction are purely
anonymous through a currency known as
bitcoins I hope you know that which is
very difficult to trace that who is
behind this type of attack so right now
I am going to show you practically that
how hackers breached into Equifax
website or their servers and stole the
entire information which were there on
the server so I have a simulation for
that attack this is a server this is
trust – so stress – basically is over is
a server Tomcat Apache server which
basically on which you can host your
website so f of X were using this server
but they didn’t patch 1:1 ability which
was there which should be patched on
time and they just delay one to two
months and this was triggered by the
hackers so just an example if whenever
you get a software update on your smart
phones how many you update immediately
or you wait for free you know Wi-Fi
because it’s quite a deal yes so that’s
a problem you know so this is a server
which is having that vulnerability now
this is the IP address if you can see
and you can hope that this is the
effects dot-com I just didn’t purchase
the domain I just have put my server on
and now what I’m going to do is there is
a script which was available let me show
you so in case you able to see so this
is a script or this is the exploit which
was publicly available right now for
anyone to go for and I will not go with
the details of this exploit but it’s in
Python but this this exploit will
trigger the vulnerability which is there
in the upper chest hurts and then can
take advantage to have entire control on
the server nowadays hackers are not
interested to delete something from your
database of your website change your
page to a very scary page hacker was
here you know what sobs you got hacked
you know previously you have seen you
know some countries are hacking into
another countries and putting a very
scary message that and with some you
know good words there for you so but
nowadays the trend is changing they are
more interested in your money because if
your ecommerce website they will get
into your website they will try to steal
credit card information details of the
customer and then they can actually use
that information to put do some online
purchases so if your card is being used
in Indonesia do you think it’s a good
probability you get money back there
from there
no of course right it’s out of our
jurisdiction so this is expert which I
am going to use now let me show you so
what I’m going to do is I’m going to cat
cat means it’s a command in Linux to
pull up the text in front of you just to
echo just to printf and right now I’m
going to see that what are the so I can
remotely Explorer I can reap only
explore the folders which are there on
the servers if you can see there are so
many folders which are there which same
same like this a criminal basically gets
into it and see these kind of folder but
the
thing which I am interested is it’s a
database can you see that database
folder so now database basically
contains the user information and such
critical information which should not be
visible to the public you know it’s the
backend that’s why we call it back-end
node visible to the front-end people so
right now I am going to get into the
database and there is a there is a SQL
file known as users the users who are
using the website so now this is the
same file which was there in the Equifax
kind of file if we are able to access
that we are going to get username
passwords and other critical information
which is same behind the firewalls and
behind the security so as I’m going to
press enter here you will see all the
user name like Mike their passwords and
there are hash password which were there
he is male or female whatever Roger is
female how it’s possible but it’s okay
so so these are the information this is
how and this information was taken over
and then put it on the Deep Web for
selling now everyone is having this
information and can you use this
information as any kind of you know
cyber crimes which are there now why we
are addressing this issue it happens in
America we are sitting in India well let
me start with this thing again commonly
using smartphones there
fine that’s a good question anybody
having said Nokia 1100 so how many of
think you are smart enough to use that
smart phone raise your hand one okay –
so I can actually count there are 102
people now this is the very problem now
you know how smart is your smartphone
and now you know how smart for a smart
you are so they just like us you know
you are having a very smart device in
the hands of not a smart person and as a
result it which is going to be exploited
by some smart guy sitting somewhere in
the world nice quote right I spent three
minutes on that now now please
understand you are using smart phone
from last how many years three to five
years
if I ask you do you know 80% features of
your smartphone nobody have open compass
there I can guarantee on that now this
is the very problem you are not trained
to use the smartphone and you are not
trained to use the technology in a
perfected way because you think it’s a
technology please understand this is a
part of our life now let me show you
something
India is the biggest user one of the
biggest user of torrent site site you
use Turin I don’t use it it’s illegal 3
year in prison nowadays you know that
you know that still you’re using so
that’s ok now so I only use for the
books you know so how many you think how
many you think that torrents are safe
anybody nobody still you’re using oh
nice now I tell you why you should not
use torrents I’m not saying you should
never use too orange I used to do that
then I saw something and I got scared
well let me show you something then so
do you see this file what it says done
the dvdrip one zero eight zero P and I
know you don’t compromise the quality
you know that’s why I try to in 4k but I
said one zero eight zero pates okay you
know you know your G ot guys you I
understand minimum one zero eight zero P
so some people go out this late you know
but it’s okay so now if this file is in
your computer what you will do open with
the utorrent or BitTorrent yes or no
very cute file right you download it
from torrent site now on the other hand
if you see this this is the attackers
machine so I’m using an operating system
known as Kali Linux it’s a penetration
testing operating system there I have
infected this file in such a way that it
is going to bypass every antivirus which
is there it’s a food fully undetectable
second firewalls whatever the things you
are installing we can bypass that for
sure
so if I put this file online and you’re
going to double click on that then your
entire computer including your camera
including your hard drive including your
all the files which are there is going
to be controlled by someone that smart
guy remotely anywhere in the world I
know you watch crime Patrol you don’t
believe me you need proof so let me show
you them so this is my attacker machine
just observe here this is my attacker
machine which is there so now as I’m
going to double click on this file there
is some there will be something you know
which is going to happen so I double
clicked on that and you can see here it
says meta Prater session one is open so
these two machines are one is here and
one is there and now I got compromised
so as I am going to press enter here and
I type sessions – I won and you can see
here there is a meta better if I tip
screen screen short press enter now I
just took a screenshot of this machine
on my attackers machine which is
anywhere in the world so you have to see
that what it captured I’ll go to my home
folder and you can see here can you see
that so this is the same screen short
which I just took remotely when you
double-click in your home on that
torrent file no aunty was pop-up no
nothing
now this is the very problem a hole
produces today almost this much of GB
every day these are the quotes from
World Economic Forum and if you have
good in maths you can understand then
this much amount of data is there then
definitely we should have to take care
of that now these are things which are
there which you mostly trust own anti
viruses firewalls a DLP solution filter
incoming outgoing connections so this is
a technical person can deploy that but I
can tell you the business in which I am
working and we have seen or each and
everything which is there written on
this screen can be compromised by
hackers it’s just a matter of time
guaranteed
now if this is the case what we should
do well we have seen these kind of news
JP Morgan Xu CIA agent covertly stealing
the information there is a
going on in the world and it’s
traditionally right now it’s the
paradise of hackers to steal information
globally because they know that there’s
no connection power they aren’t going to
get under so what you should do so these
are a few things we should take care of
before you know jumping into the
cybersecurity first of all twenty four
months ago India was having only 15
million smartphones 2017 now we are
having 250 million smartphones and
majority of people just jumped into
using a digital phone without having
proper knowledge and that is what a
criminal is targeting your awareness
lack of awareness maximum hack happens
because some people click on torrents
they want free MS Office they want free
software’s which are there and they just
download that double click on that
who is why people are giving things for
you for free they are not your siblings
so whence once you download that once
you download that then definitely there
is a thing which is going to be
compromised and that’s your privacy if
you have there’s a thing you know
nothing to hide nothing to fear go but
you know that what you hide what you
hide and what you not then our Indian IT
Act Gama should understand that other
Indian IT Act which will which prevents
the cyber fraud was designed in 2000 and
there were some amendments which was
done in 2008 but still they are not
enough you know we have to remember our
cyber law from A to Z to understand and
to tackle these cyber frauds because
that law is too outdated then you must
report low info to do law enforcement
whenever you see any crime happen how
many of you report when you lost your
smartphone to police department very few
now if that smartphone is going to be
used by cyber criminal terrorists then
definitely you’ll be in a problem so no
matter when you will get the phone or
not or SIM card or note you have to
report to police this is kind of your
safety then cyber security awareness to
government private agencies and
education sector
I’m very feed sad that in India we don’t
have a culture of Education in cyber
security in most of the Institute and
colleges universities
I hope this culture will come at least
one chapter from schools to the core
which would make me mandatory so that
person should understand what what are
the do’s and don’ts in terms of when
they are using internet now in smart
cities the I hope you know that smart
cities are coming up and in smart fees
the bigger challenge will be the
hardware and the digital hardware which
we are going to use to deploy and take
care of the cities if that hardware is
having a backdoor or malware inside it
then no antivirus can detect it now
there are some countries I don’t want to
name they are implanting the malware
into the hardware and suppose that
malware Hardware is basically deployed
in to a nuclear power plant or
electricity grid in a smart city you can
understand the person can remotely
control that and they will be pure
disaster for the city in the future in
smart cities so we have to audit that
Hardware before deploying into the
cities or smart cities and again
awareness of the things which are there
like in rural areas now biggest frauds
are happening is not me in terms of that
technology there is no problem in the
technology but the amount we are losing
as a country is more because of the
awareness of people who are in India so
a person who is going to call the rural
guy and tell I am calling from Bank he
speaks in English and the guys think
okay he’s a quite a deal so he tells
everything to that person so when a bank
is opening an account of a rural person
he should tell them they should tell
them that sir do not click pick any coal
or do not share these details nobody is
doing it for time being in might
understanding of capacity so but if
display two minutes on that to a rural
person then I think we have a diverse 60
to 70 percent of the solution by just
doing this thing not a rocket science
and last thing is the incorporate people
decision-making authorities like board
members they should have a dedicated
budget on the cybersecurity which I feel
is the need of the are if you see the
Equifax from 17 million their their day
evaluation goes all may almost six to
seven billion below now that’s quite a
deal in just one one month their
evaluation goes six billion below
because of one hack so I think they
should depend they should deploy as much
money on the budget of the cybersecurity
in terms of people process and
technology train people deploy good
technology
because if they are they’re spending too
much money on the people power on the
technology part but they are not
spending money on the people part no
matter how much big software is how much
good hardware you are deployed in the
companies if the person who is not
capable of sitting there is not capable
of handling that technology someone will
trigger the person and through the
person he can trigger it into your
organization so we must pay attention to
people in the organization like an
accountant of an organization he is the
real victim to be had if he got had he’s
having no clue about cybersecurity but
he’s taking care of the most critical
information of your company so
corporates has to be proactive because
they must understand offense is the new
defence today in the borderless
environment there is a code that we can
patch any technology but there is no
patch of human stupidity so whenever you
click in your picture whenever you’re
sharing something you’re chatting with
someone make sure presume you’re already
hacked and one day someone is going to
see that but it is a picture video or
whatever the things are once you have
this mindset then definitely you will be
quite secure in terms of using internet
and hoping for the best
in India we are not a country which run
by rule and if you really want to
transform a digital India to a secure
digital India then a basic information
or basic security awareness has to
happen to every citizen of India and
that is quite possible thank you so much
you
Please follow and like us: