Class Topics

          During the movie, in order to gain access to the revised camera layout the resident hacker Nine Ball uses something known colloquially as a “phishing scam.” Phishing refers to a cyber crime using social engineering in which victims are targeted using personal information or their visited websites to gain access to their files or personal information with “permission.” Common examples of this are the infamous “Nigerian Prince” emails, “Accidental Purchase” messages related to accounts owned by the victim, and “Follower Tracker” sites that claim to show otherwise invisible social media metrics with account information. Phishing uses typically two techniques, both seen in the movie: deception and malware [4]. The first technique is the social aspect: in the movie Nine Ball targets a department head related to security, picking through his social media to find something that might be used to draw in the victim. She uncovers his love for a particular dog breed, basing her initial mail and attachment on the dog. By basing it on the victim’s own interests, the victim is much more likely to follow through with the phishing attempt and allow the attacker access. The second technique is the more technical aspect: embedded in the initial email, Nine Ball creates a program that when downloaded allows her remote access to the victim’s computer. This program, known as malware, is the more dangerous aspect of the phishing attack. Once the victim has been lured into accepting the malware onto their computer in one way or another (downloading a program, inputting credentials into a fake website, etc.) the attacker can then make use of their personal information maliciously. In the movie, Nine Ball uses a program to remote into the victim’s computer and steal security details related to the Met; later these details are used to pull off a major theft in the Met. Despite its effectiveness in the movie, phishing is regarded as an older-style scam. Many tools and client-side technologies have been developed to combat phishing attempts. One such method is authentication: a method of ensuring that requests and inquiries originate from valid users rather than malicious scammers. An example of this comes from banks: “Some banks (e.g., Bank Austria) employ user transaction authentication numbers (TANs) for filtering phishing email. The TAN is sent to the user via a short message (SMS) through mobile” [4]. However, this approach is costly in terms of infrastructure, time, and money. Additionally, this approach does not work well against phishing scams where the attacker is actively monitoring the phishing attempt and communications: such as Nine Ball is in the movie. As ways to counter phishing are developed, so too do phishing techniques evolve.