Hatched : The Data Theft Story

(by Saurabh Singh Rajput, Second Year CSE, VNIT)

"There are two types of companies: those that have been hacked, and those that don't know they have been hacked."

What if I tell you that presently at this exact moment your credit card name,number,password each and every bank detail, would be on sale on dark-web where any random stranger can buy this details in exchange of some bitcoins or money and can use the card for his/her personal use Or Would you believe if I tell you that till the time you end up reading this whole sentence at least 400 new data thefts would have occurred. That’s right because every second 64 records are being stolen and the world has no clue about it. Before going into the technical knowledge of the topic let’s understand what “Data Theft!!” actually means.

Do you remember the English series “F-R-I-E-N-D-S” episode in which “Rachel’s” credit card gets stolen, or the scene in the movie “THE SOCIAL NETWORK”in which Mark Zuckerberg gets pissed off by his girlfriend and hacks into the Harvard system and creates face smash which gets 22000 hits in a single night leading to servers( on which the site was hosted )crashing in Harvard. Both of these have a single thing in common which is using someone else data. This is known as “Data Theft”. A data breach is an incident during which an encrypted database is broken or hacked, and the valuable information stored within is compromised.

The information is user information such as passwords, social security numbers, credit card information, other personal information or confidential corporate information.

Because this information is illegally obtained, when the individual who stole this information is apprehended, he or she will be prosecuted to the fullest extent of the law.

Recently the word Wannacry ransom-ware crippled the whole cyber world in just 2 hours of its explosion by using the flaw in Microsoft systems which was earlier found by the NSA(National Security Agency) and revealed to the world by the hacker’s group “ THE SHADOW BROKER’S ”. This incident gave a huge boost to the ongoing debate of data safety.

The most important question now is that “Who are the people working on this and how they do”. The people behind this whole scenario are known as “The BLACK HAT” or “The CRACKERS”.A black hat hacker is an individual with extensive computer knowledge whose purpose is to breach or bypass internet security.Today there exists a globally organized criminal network of “black hat” devoted solely to the stealing of confidential data.

The terms “data breach” and “identity theft or data theft” are unfortunately becoming a familiar part of our vocabulary these days, but do you know how the two are both different and often interconnected?Some may think a data breach and identity theft is one and the same, but there are

distinct differences between the two.breach is a broader category indicating any spill of confidential data, including those that happen by accident. However we can precisely describe breach as the activity in which there is no malicious intent and the data has been released due to mistake, negligence or some other unintentional cause whereas on the other hand  hacks are compromises caused by people with malicious intent who—whether by simple or complex means—are cracking into the organization's systems in ways that cause problems. Even though both of them are a bit different but still both of them are equally dangerous as both of them may be revealing information that the devices' owners do not wish to have exposed. Hence none of them can be neglected.

Ongoing through the methods used by the hackers for data thefts, “SOCIAL ENGINEERING” methods are the most important one. Only about 3% of the malware tries to exploit a technical flaw. The other 97% is trying to trick a user through some type of social engineering scheme.A social engineer runs what used to be called a "con game." Many social engineering exploits simply rely on people's willingness to be helpful. For example, the attacker might pretend to be a co-worker who has some kind of urgent problem that requires access to additional network resources. Popular types of social engineering attacks include baiting, phishing, spear phishing, pretexting, scareware etc.

In today’s world data of 1 million users is more precious than $1 million itself.With each day passing the google search results for the term ”DATA THEFT CASES” is increasing. Every day several reports of data theft are reported and the matter of surprise here is that the victims are the larger fishes of the pond and not the small companies in most cases. recently data of 17 million users of the Indian startup “ZOMATO” was stolen, however as 60% of these customers logged in through OAuth services like facebook and google, they were totally safe. In 2013 data of 1 billion users was stolen from YAHOO followed by theft of data of 500 million users from the same company in 2014. This theft is believed to bring down the value of Yahoo by 1 billion dollars in its deal with the giant Verizon. Hence more than financially, thefts like this damage the reputation of the company which is priceless.

This is the high time when the whole world instead of ignoring things like this which can destroy us, unites together and fights for a better world both inside and outside the screens.