Hooked: Investigating the Phishing Attack That Targeted Me at University - Prithika Gopinath

Good morning everyone. I hope everyone is having a good time and you guys are enjoying. So yeah, before I start with my presentation, I would like to know like have you guys ever received a really nice yellow everyone? [laughter] Yeah, I'm like um did you guys last month? Did you just good? So yeah, I did this in one. Before that, before we go into the presentation, I would like to introduce myself. I'm moving into my final year undergraduate doing computer science. I'm based in London. So yeah, I'm not a professional. I'm a beginner and I'm just learning cyber as well. I do other stuffs like I have something else in my background. It's a medicine. So yeah, it's kind of

different. I think you guys are ready and let's move into the presentation. Okay. Yeah, we have got the email. This is the email. Um, you guys could have the logo. University logo. It's bit I guess. I'm not sure. But do you guys realize any fishing red flags over here? Like, could you just figure out? I just figured out one for you because that one is still like your horse and you have so many red flags in it. Go on. So many. >> How you got a student now? >> They don't call you by name. M. >> So if you're a student, they should know your name. >> Yeah. >> Perfect. Anything. >> Why is the pound?

>> Perfect. >> Anything. >> Number space. >> Cool. And anything else? >> Formatting is like weird. >> Cool. Okay. Um, let's figure out the red flags over here. The first one is the student email and the second one is going to be the subject you know when I received the subject was like what's that you don't even give it in that way and from a university a big organization they don't give you a subject line like that and the next one red flag but you figure it out okay and we have the urgency it's like you'll have to do it today you don't have to say it like that you have some time limit they give you the time

limit right so that's okay cool this is an LSU university and they are giving a sha Where is the characters? They're not connected. That is not connected to be honest. And it says that alcohol.co.uk. Cool. But that's not connected with the LSBU. And then we also have See, if you have any quiries, go to Chad law. Where can I go? There's nothing Chad law and they they are selling theirs. And yeah, my university doesn't use Monza bank account. They use corner. They use corner. And I don't know how the creator just made this. And we have the urgency which you mentioned. But you know what? A student has literally paid £850 to this. I don't

know how the student did that. Literally they say that I have did this. I'm like what do you mean you have did it? You are a student from LSPU and we do use constru and yeah we have so many urgency and let's notice why did the system stop? because this is a student's email address which has been already you know captured by the attacker and it has been sent from one thing to the next thing like we have received in the batch wise and the thing is that this is the one email which I got but other students have received from different email ids but it's like so many across you know LSP it has like so many organization

where can I go and find it but with this thing I have got it so they have passed the SPF because it's from LS this year and they have also paused the dam because the signature look legitimate isn't it? It's it's like first time when I saw that email I was like I didn't pay my tip fee just 2 days before and you're sending me this again. I was like, "Oh my god, I can pay it. Maybe it's just random thing." And then I left it out and then I went to watch TV. But after 5 minutes, I was thinking, "Wait, why didn't I receive this email?" And then I went back and then looked it. I was

like, "Oh, that's an interesting scam." And then you have to mark the my [snorts] business page and this one also. I'm like, "Okay, maybe the student who literally got he didn't use the MFA. Maybe he didn't use it or else maybe he would have given his data somewhere, but he didn't use it." And the person is texting me like saying Prika I'm like uh my email has got pushed. Could you please send an other message to everyone? Cool. I can do that for you. Maybe it's his mistake as well. And yeah, let's investigate. Now this is a step one which I did online the chat.co.uk. They have created it on 28th of April which is like 3 days before of the

fishing scam which has happened on 1st of May. 6:54 p.m. I'm missing an email and also the channel UK has been registered in Squarespace. The Squarespace is a really big platform though but I don't know how they did it. And the interesting case is that I went to the UK art company and we don't have anything called Shambla that is literally so stupid of the person but I found something else. They impersonated they impersonated the law firm by the spelling. It's like chat space law but they impressed. I was like okay fine that's interesting. So in this line I think we can get it like the person literally had 3 days of gap just 3 days

of gap and then he did it. I was like really interesting maybe had so much of experience in it. He just literally planned everything. Let's move on to step two the bank account and the soccer. So we received the soccer right? I went through the soccer. I was like, "Okay, I don't know so much of the banks. I don't know which bank it is, but let's have a look at the top code." And it says in one, "Okay, LSD doesn't use one. They don't use it. And how did we get it?" I was like, "Okay." And then, yeah, like £850. Has he mentioned £850? How will a person give £850? It's going to be £8,500 for

for the second semester. It's ridiculous. And then I have mentioned that universities use I don't know how other unities use I'm not sure like other university what they use. Is there any university students over here? Yeah. What do you guys use? >> No. Yeah. [laughter] That's interesting. Any other university students? Do you how do you guys pay your fees to be honest? I'm literally confused because we [laughter] >> finance usually does it. >> Ah because we use the camera. I'm like okay fine. Maybe the other universities use the bank accounts. I don't know how you guys transfer the monies but still I think >> do you with student plans? No. Do you go to the student plans at all or is it so

entire pay? >> So for us it's like they will just give you the link you it's like a third party. It's like we have to pay the fees and that fees goes to the university. So it's like 2 3 days. It's like a third party is an invot. I'm like okay interesting though. So I'm so confused about how other universities student pay their fees. [clears throat] >> You don't use student financing. >> No, we use finance. So you don't have any student loan associated with your education? >> No. >> Okay. Most most universities do it via the government. >> Their fees are part of a loan and the government automatically pays that >> to the university.

>> Thanks for being >> He literally sold one of my stuff. Yeah, because I was so confused like how about the university because I don't have any other chance without the university. But thank you so much for the information. Let's get into the email address. So yeah, this might be just a confusion but I I like this. I was like cool that looks interesting. So let me just do it this way. But if it feels so confusing, I'm really sorry for it. So when I looked at the email address, we literally got the IV first it says from it came from LSD uni. But the idea of this show that is from Paris Paris it's very different. I'm like okay

really cool. But you know guys what the um the taco you know was registered it was registered in London Prince. I literally got the person's name and everything but I can't literally say the person name and I got his address as well. It's confidential. I'm sorry about that. Yeah, I was like, okay, we got the address, the sock address in Fishery Road in England and it's in the Paris. How is it possible? Maybe they could have used VPN. So, I'm not sure whether what happened. Maybe the person literally was in Paris and it was like he had a connection with a human for the tour. Maybe I can't really check on that. So, yeah, they could have used a

VPN or maybe, you know, it could be the person over there. So, I'm usually confused what it is. But yeah, the region says that it's a France central and it has literally the name in it. If you guys are so interested later, I'm going to show you my ripple. Maybe you can just come to me in person and then I can show you. I couldn't just fit so many pictures in it. But yeah, if you guys anyhow know more curious about that, just pop to me outside and then I can show you. Okay, cool. Okay, so from my investigation what I thought is like I had like three things in my mind. I'm not sure about

it. It's going to be possible spray. Maybe it's going to be a foster spray. But my other people, my my other colleagues, they told me that whatever it could be a pre fishing as well. But when I asked with my university, they said that there was already a batch of email address which was already in fishing. Maybe this it had happened like around 10 years ago. I guess maybe the student would have got the same email address and it has already the details of it. So he was telling me that I'm not sure about everything but I'm just going to tell you. Okay. I was like okay thank you Jean. Thank you so much for that but

maybe I think it's going to be the password spring because the students would have let us details outside maybe for the discounts and stuff like that or maybe dodgy links. I'm not sure. Yes. But yeah we do give our student email because of the offers right. It really has a good offers. Yeah. Let's go to the full story. The domain was registered on 28th of April and we received I mean I received the email on May 1st at 6:54 p.m. And this guy literally compromised the account on before May. Yeah, before May. And then May evening after 10:15, I had my dinner and I was like, "Oh, let's take the laptop and have a look at it."

And yes, the investigation started. And maybe one night I was like so curious and I finished the report along with my sister. We was in the bed and was like thank you She was giving me the moral support. She was like giving me support like you can do it. And you know what what made me to have an investigation on this. There were other colleagues my friends who were also doing the investigation. We were like okay let me do it first. Let's see who do the competitive spirit. I was like yeah let's do it. Yeah, we can't stop fishing but we can make you massage. So basically the organizations have so much of different systems and everything but what if it's

an individual targeted we don't have so many stuff right like they have filters and everything but we do receive an inbox in our mail like and everything so much of so on it's more we receive it right at the time yeah sometimes there are people who can literally identify I hope everyone here can identify as you did in the first place but what if it's a 16 years to them, 17 years to them. What is a 45 plus years to them? They won't be able to do that because organization companies give a training for the cyber security because they want their companies to be fully secure. But if it's an individual, no, that doesn't happen. So everything has to be started

with an education like a knowledge they need to get it right. For example, first in the time when I retired, I didn't even look at it like I don't know what were and I have my more pre past experience with the fishing scams and stuff. So I got that knowledge of it and like go back and do it. But yeah, humans don't need to have it because in our current generation we have AI in it, right? Artificial intelligence. they're going to take over and they're going to be like creating the scans and everything and they're going to be telling you maybe this human literally made a mistake but next time the AI is not going to make this mistakes but so

for that we need to be more more more secure and safe enough and then we have to have some knowledge on it that we don't go and tra like we don't go and fall in those traps right yeah key takeaways so the technical controls have limits the SCF F DK demar can all be bypassed hass situation and I used free tools. I use the free tools. I didn't use any famous tools because I'm a beginner as I mentioned. So I use some codes, email address and movies. So if anyone over here is not a beginner, I will literally tell you that please you can do the investigation like this. It doesn't matter whether it's right or

wrong, but you did your investigation and you have to be so proud of it. E and they always verify before you pay. The person who did, he made a mistake. He literally didn't verify. He didn't even see the chat law and they don't know how he literally pay. It's literally wondrous. But you have to verify before you pay or before you click any links. They can be many dodgy links as well. And the most important multiffactor authentication. kindly to have it. Kindly to have it because that's really important because that person didn't have it. I don't know how it happened but students literally do that as well because for a time I didn't even have my MFA and one of my

friends are you so stupid. You have to have your MFA. How do you even use it? And I was like thank you and I start using it and for this overall presentation what it was like curiosity. My curiosity made this investigation. So I'm like curiosity is your most powerful sense of your teacher. You have to be more curious about what you're going to do and what it is and you have to be like enjoy [snorts] it's interesting. It's interesting. [clears throat] You have to be there. So whenever you visit when pushing email don't just you just do it. It's going to be so interesting. You're going to be finding like oh this person made a mistake over here. Oh the

person has ideas over there. So everything is going to be so so interesting and you're going to be like I did an investigation and I have a report about it. So it's going to be so so interesting. Next time if you guys have any pushing emails, scams and anything like that, please do investigation and then if you guys know I'm so much of eager like I want to know what is what dumb people do about these investigations and stuff like this. I don't know how else the fishing scams come. Maybe offers and everything. What about do the people get offers? Maybe offer scams. Oh, you want this raffle? You're gonna get £1,000. You're gonna get £5,000. Just be realistic,

guys. That's not going to happen. Maybe not. So, you have to be more care about it. But yeah, these are my key takeaways and I hope that everyone really had fun in taking part in my investigation. And I'm I'm taking so much of you guys. I'm here but if you want to have a look at my report I would love I'm so happy to show you it's mobile phone and show you outside but this is my beginner story and I'm so curious about it and then I as if there is any sol I'm so eager to you know change it and then get more knowledge on it and thanks for listen thank you so much and I hope you all had

a good time THANK YOU SO >> [applause]

>> THANK YOU FOR A INTERESTING TALK. UH any questions for >> um did you check your uni's demark records cuz sometimes they misconig

>> you can check the configuration. >> I have to do it anyways. I'll have to I asked them they were like you can't go in without asking a permission. I asked my he can do it but my other >> it's a public record. >> Yeah but still you know he was like >> but yeah cuz sometimes when when you config demo >> you can configure it to not do anything >> um which many places do especially big organizations that probably will do. >> That's right. >> Yeah. Um, you say that people need to be educated and like know about this. But I think if you speak to most people, they'll say, "I know what a fishing scam

looks like. It's obvious." Like they have all the telltale signs. But then, as you were saying, there's also the culture of like, "Oh, it's so obvious. I could just ignore it." But then people have moments of weakness. Maybe they're in a rush. Maybe they had like an argument and are emotional. How do you think we can shift that sort of culture? That's a big question. I know but but yeah I think that um even if the organizations are going to get this maybe you have to include in the other organization for example stuff I'm with they don't because they do handle emails right I do handle my emails and one time one of my colleague

told me that what is this I just did this so you'll have to I think maybe once you start any roles or anything like that you'll have to give a training to the people like this is what it is and this is what it is you'll have to do it But if it's with the I mean the college students you'll have to start some course maybe maybe it's a basic bea course you'll have to start with saying that this is what the pushing event is maybe you will get it in this way you will get it in this way they will target you this way don't pick the links and stuff like that so if you start from

something in a small age maybe this thing there will be like as a followup question do you think a course like that is always the most engaging thing cuz I know not only at uni but also like on my jobs and placements I've done there's pre-training for a lot of things and you can just kind of fly through them like some of them are so obvious and boring like you just kind of skip them. >> Exactly. So do you think there's like some beyond courses cuz as I said like a lot of people think they already know it but then maybe there's like a new advancement saying how do you >> I have I have like a literally a funny

thing to say like maybe you can send an email to the people that's a dodgy link let them click it and then we'll be like you know what this is a dodgy link you don't even know how to do a scam like how this is a scam how did you even fall for it you'll have to take a lesson and then you know you have to force people like do take this >> like a contest. >> Yeah, exactly. So, we'll have to force it on sometime, but it's really bad to post it on people. [laughter] >> And if they still if they still want to like, you know, skip it, >> they have to like how did

>> I like how you turned it into a whole incident investigation. Very cool. The timeline. What was the end result in the end? Did you decide to report the end result? >> Yeah, I reported and when I saw the email, I just reported to my team, but after the full investigation, I reported on May one night around 11:30 p.m. My team was like [laughter] 7:30. I'm sleeping and you're sending an email. I was like, I'm sorry, dude. It's fine. I was like And then they just sent it to the IT department and they asked like what is the next step? And then they reported to the government thing and then they have like post this gu

so much detail. I was like I literally helped you guys as well. Maybe the basic level you guys are not telling me. >> Yeah, that's so cool. I'd love to see your I work at Oxford University so I can share it with you. >> Any other questions? >> No. Can we have another room?