Impact of our digital footprint on the Internet and its associated risks

Photo by Tracy Le Blanc on Pexels

People’s lifestyles have undergone a great transformation in recent decades. The development of new technologies has brought countless benefits on which, in certain cases, we have become dependent.

The facilities when it comes to accessing any type of information with little effort, the connectivity with our loved ones and the simplification of certain domestic tasks (such as online orders ) are some examples of how these advances have flooded our lives . However, the main transformation cannot be palpated, as it does not take place in the “physical” world; it is the development of cyberspace.

This new reality provides a new environment for interactions both at an individual and social level and, as in the physical world, our way of perceiving and interpreting it varies from one person to another. This gives rise to a series of different behaviors for each one in different situations, which are a reflection of their own identity and individual characteristics.

For each interaction, little by little we are leaving a trace of ourselves, this is what is known as digital footprint. This concept encompasses the total information that can be obtained from a person through internet research. It includes from what may seem like a simple photo, to private data such as the telephone number or the identity card.

It is important to note that this space is not without its dangers. Despite the fact that the objective of these attacks is very similar to those of the physical world (obtaining money or stealing certain information), the methods used present certain differences. In most cases, the aim is to deceive the user by taking advantage of their emotional and motivational vulnerabilities by means of the well-known social engineering techniques.

Photo from Freepik.es

Understanding this fact is vitally important to avoid falling into the hands of attackers. But how do they come to know which key to press in each person? What methods do they follow to achieve their goal? Up to what level can their sophistication go?

Well, there is no unambiguous answer to all these questions, each attacker can choose a different type of strategy. In some cases, a single message is generated and given a massive broadcast; statistically, someone will end up getting infected. This is what is known as phishing. In this way, despite the fact that various factors related to the user’s expertise intervene , the more contact they have with the Internet, the more likely they are to make a mistake and fall victim to deception.

This methodology is one of the oldest; however, over time it has been refined to give rise to the sophisticated spear phishing. This technique is not based on the mass dissemination of identical messages, but rather focuses on a single target, for which a personalized attack is carried out. In this way, its effectiveness grows exponentially, making it difficult for the user to detect whether or not they are facing a deception.

In this case, it is not so much the number of hours the user spends browsing the Internet that stands out, but rather their level of exposure to it. In other words, the important thing is the amount of data that can be obtained from them through the web. Knowing their main tastes, motivations, movements and even professional aspirations and job position, an apparently truthful message can be elaborated.

This is where the information we publish on social media becomes relevant. Through the photo of someone who is going on vacation, we can obtain various information: who they are going with and, therefore, who are their trusted people, their current location, or that they will be absent from their job for a few days.

To better understand how this data can pose a risk to our cybersecurity, we are going to tell the story of Zed. It is about a young woman who received a message from a distant friend through Facebook.

Photo by Tobias Dziuba on Pexels

After greeting each other, her friend asked for help. She wanted Zed to vote for her in an online modeling competition. To do this, Zed had to register on the contest platform; however, there was a problem. The system crashed, and in order to get the votes back, Zed had to provide her friend with her account password .

Although she hesitated a lot, she ended up giving it to her since, if she didn’t, she could have endangered her friend’s career. At this time, her accounts were hacked. Zed had been the victim of a spear phishing attack: her “friend” was not who she claimed to be, but an unknown malicious attacker.

This person was quickly able to access a large amount of confidential information, including her passport, her bank details and certain intimate photos. In addition, the attacker also changed the passwords and activated two-factor authentication.

In other words, Zed had not only suffered an attack on the confidentiality of her data when an unauthorized person had accessed it, but its availability had also been affected, because no matter how hard she tried, she could not access her own account.

But how could it happen? Zed actually had a friend with that name and Facebook profile. Also, why her? It is clear that this is not one of those common anonymous attacks in which the identity of the victim is not relevant.

Soon after, Zed received a call, it was a young boy who accused her of having led an “immoral life”. From her publications on social networks, it could be seen that she was a very active young woman regarding her affective relationships, in addition to presenting certain vices, such as tobacco.

After stating that he felt good about hacking her because she “deserved it”, he threatened to post all explicit content on her social networks unless Zed seduced him by video call. Since she refused, he did so.

The attacker had not only obtained information about Zed’s lifestyle, but also about her contacts and potential trusted persons. With the information he obtained, he was also able to devise the best strategy to increase the chances that Zed would agree to his initial requests: helping an old friend.

In this case, the biggest mistake was giving her password to who she thought was her friend. However, in another situation, the initially provided link could have directly infected the computer from which access was attempted, stealing or hijacking all the information stored on it. This would not only lead to negative consequences on a personal level, but also at work if it was opened from the work computer, which is quite frequent.

The motives that guide attackers to commit acts of this type are diverse. The search for an economic, moral or personal benefit, as well as obtaining certain secret information are some examples. For this reason, we must pay attention to our digital footprint and be aware of what our greatest vulnerability may be.

Thanks to the identification of the areas to be strengthened, Kymatio helps prevent these types of incidents, providing each employee with an individualized reinforcement that enhances their alertness.