Human Hacking: The Psychology Behind Cybersecurity | Dr. Erik J. Huffman | TEDxColoradoSprings

I received the email from my mom titled help I was at working time completely off-guard however when I seen my mom's name next to the email subject help my heart sunk my mom is my support my stream and I hate to hear she needs help from anyone including myself I immediately start thinking about all the sacrifices she made to build a better life for my dad brother and I I started thinking about how she would take me to get a strawberry milkshake after every dentist's appointment because to her I did so well even though we both know I didn't and it was pretty much a fistfight between the dentists and not the entire time but she saw the best in me she always saw the best in me now as an adult I know that we struggled as a kid I could not tell because she never let me struggle even if she did my mama's never asked me for help she's never asked anyone for help every day there was food on the table every Christmas Santa ate the cookies drank the milk and gave me the best presents mama Huffman is a strongest woman that I know she could turn ten dollars into Christmas in five dollars into the most amazing Thanksgiving meal that you've ever had he protected me she protected me from when the monsters went from underneath my bed so now inside my head but if my mom ever needs help I'm there I start reading this email I'm focused on every letter I'm laser focused on this message the email told a story about how her and my dad were going through some financial hardships and they needed some money just to get to the end of the month so I replied how much do you need I get a reply back fairly quick five hundred dollars this is a large chunk of money so I figured I wait until I got home and call her on the phone just so I can see what's going on I was teaching at the time so I went to class with the email heavy on my mind the message kept replaying over and over again and I know my mom's voice very well so reading the email just hurt about an hour later I get another email and they are asking when could I send the money and this started to raise some red flags because my mom is anything but forceful especially in a situation like this she would never be forceful when she's asking her own son for money so the tone that sounded so familiar now started to sound wrong I couldn't help but think what's going on with my family I'm sitting here just troubled in class so I started to think some red flags have been raised because one mama huffman is anything but that forceful person that was represented and two mama Huffman doesn't really email much I mean she can email but it's not her first choice of communication let me tell you all something real quick mama Huffman is a southern raised Christian woman that loves three things she loves Jesus she loves her family and she loves to cook for people she loves to for people you've never eaten enough if you go over to her house so I call her at the first chance that I get and I'm greeted with that loving calm cheerful mom voice it's nothing like Mama's voice so I ask her did you send me an email and she replies Eric jamel you know I don't do the email and yes she said the email because she doesn't really understand the technology but also she used my middle name so I know she is dead serious at this moment in time and no games shall be played if your mom's from the South you know exactly what I'm talking about right now I couldn't help but think that I've been a cyber security professional for years at that point I had two degrees multiple certifications and countless hours of training I've even personally held these trainings but this was different I wondered how could a criminal psychologically compromised me to the point where I almost made a huge mistake and I like to think of myself as one of the good cyber security professionals I blocked a lot of cyber attacks in my day a few months later the school I was working at received a email from an Amazon account with the Amazon invoice attached to it a friend of mine Susan is the one who downloaded the attachment Susan is an online shopper holic she loves the convenience of online shopping a quote she liked to tell me is I hate to go out wait in line if I can get everything I need while being in my pajamas I'm about that life and what a time to be alive that's who Susan is so when she received the email she thought it was something her husband her kids or herself had purchased she analyzed the email it read will look legit even had the correct Amazon logo however when she downloaded the attachment her computer began to slow down so she went to another computer and that computer began to slow down and she went to a third computer in that computer began to slow down let me preface this real quick we are an institution of higher education which we means we have slower internet and we are not using the best computer so a slow computer does not raise any red flags to her or anyone else in the building actually if a computer began to speed up and begin to work efficiently that would be more concerning than a slow computer however I digress so she starts going to her office and bout time she gets to her office she realizes that the monitor had a message up demanding payment the PDF invoice was actually ransomware which means all of her photos documents and files on that computer and every other computer that she went to were encrypted it would be needed in order to access I spoke to Susan and she told me that she just got fooled and she felt stupid but everything felt appropriate and it's not odd for her to receive an invoice from Amazon a little bit later after that a friend of mine John was communicating with so on on Instagram John is a religious person and this person said that they needed prayer and spiritual support and being that religious and supportive person that he is he complied and after about two weeks of direct and consistent communication with this person he felt like he knew them enough and he felt compelled by their story enough that he sent them two thousand dollars to help them in their family through the hardship that they were having after the money was received the person disappeared the Instagram account gone not even to thank you and it's not hard to recognize this is how to reach John his Instagram is flooded with Bible verses Scripture and positive motivation for his followers he doesn't shy away from his beliefs he puts them out there for the world and so I asked John he confided in me yes what should he do I told him he should probably changes get a new bank card contact his bank and inform all his church members about what happened so they do not fall victim as well nearly in tears he told me that this is not fair he told me about how they even exchanged pictures and so he saw the family that he was helping out he told me when people need prayer he phrase when people need spiritual support he helps find them away through he was just doing but he feels like he was called to do I told John about when I communicated with the cyber criminal impersonating my mom and I agree with him if the same thing was to happen tomorrow I will likely feel the same way because it's hard to turn that part of your brain ah now I'm one of the founding researchers for a new and emerging field called cyber psychology cyber psychology is a blend between cybersecurity psychology and a little bit of neuroscience mixed in today we your online your limbic or survival brain doesn't activate as it really does in this physical world right here the Olympic brain is used to moderate feelings it has no cognitive function for language you do not speak using your limbic brain so if you've ever been in a situation where something just doesn't feel right that's your limbic brain letting you know that something's off but it doesn't quite know how to say it however when you're online your limbic system is also used for fight-or-flight that's the most popular reason for your limbic system so when you have the situation's a fight or flight it's actually not a choice the limbic brain is innately going to make this decision for you based on the situation in the scenario that is going on at that moment in time you don't have to think about it you just act when you're online when you're behind your computer screen and you're reading spam you don't think oh my god it's the nigerian prince and you just duck underneath your desk you're dodging from the monitor and you're jumping from your chair that doesn't happen you have two deductive li reason your way through this entire scenario also this limbic brain helps you ever since you were a kid we were all told the same two words stranger danger and when you're online that stranger danger filling those barriers come down and you just see a name in the default voice that you read in is your own you do not read it some creepy man's voice imagining he's sitting in his basement with cheeto dust all over his fingers Mountain Dew is just splayed out everywhere the man even has a cool a mustache you don't read in that voice you're reading your own voice unless see your name of a loved one you see your husband's name to your wives thing you see your kids name you begin to feel loved but then you start to read in their voice this is dangerous because when you trust the messenger more than you trust the message you're in trouble so when I received that email from the criminal impersonating my mom I read the entire thing in her voice I heard her tell me about the hardship they were having I heard her say that she hated to ask her son for money but she nowhere else to turn and she just wanted to make it through the end of the month I heard that and as her son that is difficult to get through cybercriminals have the upper hand and this is not a fair fight it's not reasonable to think that you're gonna see a name of a loved one and feel nothing these criminals have the unique ability to appear however they want whenever they want create this entire scenario and you're going to interpret that scenario based on the settings that they put around it it's estimated that by 2021 cybercrime is going to cost the world seven trillion dollars and this is not slowing down it's only speeding up 90% of all cyber attacks includes some form of social engineering 95 percent of all cyber attacks include phishing phishing is the most common attack by far period because it's the easiest way that they can get the information that they want I'm a sports fan so I'm gonna give you a sport sports analogy if we're playing football and I'm the quarterback I'm not gonna hand the ball off to the running back and have them run directly into von Miller who's arguably one of the best defensive players in the league right now we're actually going to hand the ball off and we're going to go around but we're gonna hand the ball off and we're gonna go the other way von Miller or we might just pass the ball because we can still get yards we can still score touchdowns without attacking the best offender on their defense directly cybercriminals think the same exact thing they don't want to go toe for toe with your firewall they don't want to challenge your antivirus because that's very difficult not when they can exploit the largest vulnerability on every network on the planet right now that's us people cyber criminals are not just hacking computers they are hacking humans because we read reason and react in unlike computers we actually respond to propaganda I'm not talking about trees mountains or desert we're talking about computers phones and tablets this is an environment that we created we are not built for it so I caution you understand your personality and what makes you tick be self-reflective before you react because what you love most whether it be your family your religion or even those online shopping habits all of that can be used against you stay safe thank you you

Channel: TEDx Talks

Views: 25,751

Keywords: TEDxTalks, English, Education, Cyber, Humanity, Security, Sharing, Teaching, Technology

Id: FrNLE1Ixgak

Length: 16min 37sec (997 seconds)

Published: Tue Oct 22 2019