Whispers of the Web: Exposing Data Privacy and Cyber Deception | Amit Dubey | TEDxNIIT University

Key Concepts

• Cybercrime investigation
• Data privacy and security
• Social engineering
• Digital footprint/DNA
• Data manipulation
• Application permissions
• Location tracking
• AI and its impact on cybercrime
• Psychological manipulation
• Miscall fraud

Data Collection and Its Implications

The speaker emphasizes that criminals are innovators and that understanding their methods is crucial for cybersecurity. He argues that individuals are essentially products of the data they've been exposed to, drawing an analogy to large language models.

• Data as a Defining Force: "We all humans are very similar to large language models artificial intelligence because we all are the product of the data that has been fed to us since our birth."
• Facebook Data Collection: The speaker demonstrates the extent of Facebook's data collection by navigating to the "see details" section of the Facebook app in the Google Play Store. He highlights the following data points:
  • Location: Approximate and precise location data (GPS, cell ID, IP address).
  • Browsing Activity: Photos and videos, even those not uploaded to Facebook/Instagram.
  • Calendar Events: All calendar entries.
  • Health and Fitness: Activity levels, time spent sitting.
  • Messages: Facebook Messenger data, emails, SMS, OTPs, and other in-app messages.
  • Contacts: Entire contact list.
  • Voice Data: Voice recordings and voice notes.
  • App Activity: Information about all apps on the phone and their usage.
  • Personal Information: Name, email address, physical address (even if not explicitly provided).
  • Political and Religious Beliefs: Voting history, religious leanings, and sexual orientation (including attitudes towards the LGBTQ+ community).
  • Files and Documents: Data from downloaded files via email, WhatsApp, Telegram, etc.
  • Financial Information: Purchase history, credit score, and other financial details.
• Google Location Tracking: The speaker shows his Google Timeline, revealing precise location data for the past 15 years, including international travel. He emphasizes that this data is court-admissible evidence.
• Vulnerability: This extensive data collection makes individuals vulnerable to manipulation if it falls into the wrong hands.

Case Study: Miscall Fraud of 75 Lakhs Rupees

The speaker presents a case study to illustrate how criminals exploit data to commit fraud.

• The Incident: A person lost 75 lakhs rupees through a "miscall" (missed call) scam, without receiving any OTP or SMS alerts.
• Initial Investigation: The initial investigation focused on identifying malicious apps with SMS access. The speaker explains how to check app permissions in phone settings (Settings > Permission Manager > SMS).
• Finding the Culprit App: Although no malicious app was initially found, the speaker used Google Activity to check the victim's application log and discovered a recently installed and uninstalled video editing app with SMS access.
• Location Data Analysis: Location data revealed that the victim was at home when the app was installed and uninstalled, narrowing down the suspects to his family members.
• Identifying the Perpetrator: By checking the activity on the wife's Gmail account (logged in on a laptop), the investigators ruled her out. The focus then shifted to the 14-year-old son.
• The Motive: The son, influenced by a "girl" (actually a criminal) on Discord, installed the app on his father's phone in exchange for 200 Robux points (a gaming currency).
• Key Takeaway: This case highlights that criminals target individuals (their psychology and vulnerabilities) to gain access to their devices, rather than directly hacking the devices themselves.

Protecting Yourself: Digital DNA and Awareness

The speaker provides insights on how to protect oneself from such attacks.

• Criminals Target You, Not Your Device: "Criminals will never hack your devices to reach to you. Criminals will always hack you to reach to your devices."
• The Importance of Data Awareness: Antivirus software alone is insufficient because criminals target the individual's psychology, which is shaped by data.
• Digital DNA/Fingerprint: The speaker suggests creating a "digital fingerprint" to understand one's unique online behavior and vulnerabilities. He offers links to resources for creating this fingerprint.
• Data Control, Not Just Selling: The speaker argues that companies collect data not just for targeted advertising but to control individuals' decisions, fears, aspirations, and political alignments.
• Limited Aspirations: The speaker illustrates how data points can limit aspirations, using the example of few people considering becoming Prime Minister.
• MyActivity: The speaker suggests using myactivity.google.com to check your google activity.

Conclusion

The speaker concludes by emphasizing the pervasive nature of data collection and its potential for manipulation. He urges the audience to be aware of their digital footprint and how it can be exploited by criminals and corporations alike. The key takeaway is that understanding one's own data and online behavior is crucial for protecting oneself in the digital age.