profile picture? think again!

Why digital privacy matters and how to stay vigilant against social engineering.

Before we start a bit of background on this article, couple of days back an incident occurred with a friend of mine. My friend would be referred to as “Jack” in this article.

So apparently Jack was CyberBullied. Yep, you read that right. The world has come very far, with next-gen cutting edge technologies on hand you can do absolutely anything. We all are aware that with advanced tech comes advanced threats and It has become increasingly common, especially among teenagers.

The Actual Incident - Phase 1

Jack gets a call from the bank stating that there’s something wrong with the account and it needs immediate attention. The human mind is complex. But when it comes to situations like these, it kinda stops working and you feel panicked which forces you to do something ASAP.

So the “agent” claiming to call from the bank starts asking for personal confidential information just to “verify the identity”. Here’s what was asked from the “agent”

• Bank Account Number
• Debit Card Number
• Expiry
• CVV

With scams like these going around, Jack became self conscious and quietly put down the phone thinking it was just another scammer trying to loot. This was just phase 1 of the whole incident, things were about to get real bad.

Let’s pause here for a moment and take a look at the attack that was actually performed in the incident mentioned above. Vishing a phone scam attack designed to get you give up all of your personal confidential information.

Now a days it’s a bit difficult to spot these attacks because you’re not really aware of who’s on the other side talking to you. It might actually be a legit bank agent whereas on the other side it’s a scammer.

To see how easy it is to get things done, watch the video below. It’s a beautifully executed attack and a personal favourite of mine!

Phase 2

Jack was not really worried after the incident, things were about to get real bad and he had absolutely no idea about it. Couple of minutes later, he recieves a ping over WhatsApp.

The ping was from an unknown number, viewing the message content Jack is astonished. Apparently it was the same “bank agent”, and he had sent Jack an image of his own (Jack’s profile picture).

Now Jack is a bit of social person and usually keeps different profile pictures across various platforms. This picture sent by the “bank agent” was a bit alarming because Jack was not really aware where it was uploaded/is used as the current profile picture.

Things did not stop, “the agent” started to send some really disturbing images. By now you should’ve got an idea about the images we are referring to here!

Jack was really worried and directly blocked “the agent” without having second thoughts. Yes that was a wise thing to do, but why did the incident occur at the first place? How did he get access to the pics? What went wrong?

Check out ZENC, a fun portal to play web challenges.

PROMOTED AD

The Root Cause

Like mentioned above Jack has a habit of keeping different profile picture across multiple platforms. So starting to analyze from the ground up all apps have Jack’s face in it. Doesn’t matter if the app isn’t used regularly, but Jack is there.

One simple mistake was the cause to everything! Your probably wondering how having profile picture of your own in all apps be a concern? Think for a moment keeping the incident as an active example, “the agent” took off that pic from an application known as TrueCaller.

When you recieve a ping from a complete stranger with your pic in it, you become paranoid real quick because you can’t think at that moment. You pause, you wait for answers. At the end you become an active victim for them to exploit you even more. Because you’ve just lost your digital defense. Pause and have a good look at the quote below.

The quote above really makes sense in the current generation, because we are no longer in those classic battle fields, instead it’s digital now. With DeepFake tech around, it’s relatively easy to swap faces within a video. Sometimes these deepfakes do go out of the line causing absolute chaos.

It’s not really necessary to upload your profile picture everywhere, even if you have to use a pseudo-picture. The basic rule in the digital era is not to expose yourself everywhere but instead to build up your digital defense.

So if you or anyone you know ever come across an incident like this, the steps mentioned below might help.

1. Do not Panic!
2. Positively, do not reply back!
3. Report & block ASAP!
4. Document the incident.
5. Report it to the Authorities.

See you in the next one! Until then, stay safe online.