Introduction
In the last week of October 2019, all the news media had carried the news pertaining online sale of over 1.3 million Indian credit and debit card holders Credentials/Profile/Account Numbers/CVV Number/Etc on the dark web. One of the news articles among them also reported that the information on the web was available for purchase for even less than Rs.7000/- each ($100). One report also mentioned that the details available on the site, contained about 98 percent of Indian Banks and about one percent was of that belonging to Columbian banks. It was also alarming to learn that, of this 98 percent, 18 percent cards belong to a single Indian bank. On investigation and analysis, it was also reveled the this information has been stolen by means of the ‘Type 2’ Cyber Means, and not by directly hacking the primary source (like the Bank Servers or the Payment Gateway providers). This ‘Type 2’ means entails; stealing of data through Skimming, Magnetic Tape, Camera Streaming, Camera Shots, Stealing or Obtaining data from PoS Machines, Etc.
Now the trouble does not end there, this data is now purchased or obtained by Machiavellian means to then frame a Doxxing Attack on victims. Post October 2019, this form of attacks has increased and the Indian Citizens are under continued attack since then.
Doxxing
Doxxing is a cyber attack targeted on an individual; this involves discovering the real identity of an Internet user from the insignificant information obtained from the first source (i.e. credit/debit card details). In this case the victim is contacted and lured to take precaution due to the fact that his/her information has been obtained from the primary hack, with a bait that the company will provide for safety measures to circumvent the lost data. These will also be done by the caller claiming that they are from a Security Service Provider company. The attacker then uses this additional individual information to execute further attacks or reveal the data so that others can target them with malicious attacks. Doxxing also entails, analyzing information posted online by the victim in order to identify and later harass that person. In a few such attacks in India, the attacker has also used the usage history of the persons credit/debit card to shame and blackmail the victim for details pertaining to usage of the card for non-mainstream activity.
There is precedence to prove that these Doxxing Attacks have devasted the individual victims in mostly the third world countries, where details of individuals are availed on the web due to extensive IT enabled services in those countries. Some doxxing attacks lead to a mass campaign of public shaming, the online equivalent of mobbing. The effects can cause people to lose their jobs, their families, and even their homes. Targets of major doxxing attacks have been forced into hiding and have had to delete all of their online accounts and change their identities to circumvent harassment.
Swatting
Off late in India, we see that there is an increase of Internet Surveillance especially after the abrogation of Article 370 of the Indian Constitution and also post the Supreme Court of India Ayodhya verdict. This then has now facilitated cyber perpetrators to direct Swatting Attack on Individuals and Groups.
Imagine, that you as a Internet User is on the Net, and is playing a game or commenting on a post, or for that matter just posted a post on the allied sensitive issues; and then suddenly you find a group of people (detectives/investigators) or Police at your door step, to interrogate you or to arrest you for Cyber Offence. This is what happens in a Swatting Attack.
In this form of attack, the cybercriminals can use a variety of technical tricks to mask their own digital identities or to make it appear as if the trigger to the police or the Surveillance Agency had originated from the victim, and make it appear as if the cyber activity has taken place from the proposed victim’s digital device. This then results in the SWAT team arriving at the victims place and arresting him/her for no fault of theirs.
Precaution
There are ways and means to protect oneself from Doxxing, but the form of precaution against Swatting is limited and is purely at the mercy of the attacker or the act of due- diligence actions by the SWAT team. In India, clearly the practice of doxxing is escalating and the consequences are now fatal. Limiting exposure and being cautious of the information that one post on the internet is one of the means to circumvent Doxxing. Updates on Facebook and other Social Media sites should be done with due care. The ability to establish Relational-Links to personal data through web browsing should play at the back of the mind, while posting information on the web. Logging into Third Party websites using the Primary Credential like Facebook Accounts/Google Account/Etc, should be avoided.
In the case of Swatting, one needs to know about the increasingly popular prank of calling a SWAT team on an unsuspecting person while the internet watches. This is more Psychological than Conventional. While most swatting attempts revolve around targeting gamers who broadcast their gameplay on live streaming services, yet many of the attacks are with an aim to obscure the criminals’ identity and activity. Also, the act may be to take revenge or to play a prank on others. It is but obvious, that there are no or limited means to ensure being a victim; yet one need to be sensitive that the Swatting Attacks are also based on the pattern/opinion expression of an individual on the web. However, the caution and restraint while using the web, will ensure safety.