The second wave of covid-19 has gripped India in its cruel arms once again. It has been over a year since the world has been under the control of a little but dangerous virus. The first quarter of 2020 saw countries shutting down, borders closing, and the ever-busy cities went silent. As it became evident that the situation was not going to change, the world adapted to the current needs. Our homes became more than just a place of residence. It became our offices, schools and even hospitals. The internet — often blamed for being a nuisance and waste of time, became the sole source of all education, work and safety. The huge migration of all sorts of human activities and interactions brought in a huge increase in cybercrimes.

Work from home offices and online education led to not only in increase of internet usage, but also the number of internet users. The amount and importance of information flowing through the digital landscape has increased exponentially. This sudden increase in activity online and the mental anguish brought on by the pandemic created a perfect storm of conditions for cybercriminals to carry out all sorts of crimes including data-breaches, malware, ransomware and phishing type attacks. Social engineering is used to aid most of these attacks. The idea of social engineering has changed since the beginning. It is much more advanced and targeted than the ever popular “Nigerian Prince” spam mails.

What exactly is social engineering?

Social Engineering is a type of attack where in the attackers exploit human vulnerabilities by means of social interaction to breach cyber security, with or without the use of technical means and technical vulnerabilities. It can be considered as an art of manipulation to obtain some sort of information from an innocent user.

Different techniques in social engineering:

· Phishing: This is one of the easiest techniques to create and one that a lot of users fall for. It is the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers. Phishing emails are usually send to a large number of users in the hopes that at least a few users end up getting attacked.

· Spear phishing: This is a specific type of phishing where the attacker targets a particular user. There is often a personal touch to the emails. The attacker collects information from various sources, even previous phishing emails, and then forms up an email which is attractive to the user. People often fall for these emails as they see information that is related to them on the email.

· Pretexting: It involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information. The main difference between a phishing attack and a pretext attack while phishing attacks mainly use fear and urgency to their advantage, pretexting attacks rely on building a false sense of trust with the victim.

· Vishing: Vishing (voice phishing) is a type of phishing attack that is conducted by phone and often targets users of Voice over IP (VoIP). The huge increase in online meetings and use of voice over IP services has led to a huge increase in vishing attacks.

· Baiting: Just as baiting a fish with worms, baiting in social engineering is an attack where the user is promised of a reward, usually exciting goods. It could be links with credit card offers or even a bonus joining offer.

· Quid Pro Quo: A quid pro quo attack is a variant of baiting. Instead of baiting a target with the promise of a good, a quid pro quo attack promises a service, or a benefit based on the execution of a specific action. The most usual form of this attack is an IT professional or a similar service provider who promises to fix an issue in your system in returns of your credentials.

· Water-Holing: This is a social engineering attack that takes advantage of the amount of trust that users give to websites they regularly visit. Users are often careless in a familiar site and this is exactly what the attacker is using for. These websites are referred to as watering holes because hackers trap their victims there just as predators wait to catch their prey at watering holes.

How did social engineering change during the pandemic?

The public health emergency brought on by the COVID-19 pandemic and the fear, anxiety, and uncertainty present in the general public, and the desire for information on the pandemic presents the ideal opportunity for exploitation by cybercriminals deploying social engineering attacks. A huge number of covid-19 themed websites and sub domains were generated.

Phishing emails that used the pandemic as their lure mails were targeting the human nature of curiosity, the instinct to gather information and the fear of missing of such emails contained attachments that deployed malware and ransomware or lead to fake sites to harvest user credentials. They encouraged users to visit websites that the attackers used to harvest valuable data, such as usernames and passwords, credit card information, and other personal information from the targets out.

From home remedies to messages from the WHO, emails and other messages became a breeding ground for malwares. The remote work also brought about a spike in the phishing emails targeting employees who were new to the world of online work. Whether it is messages from the IT team or from one claiming to be a co-worker, the scope for social engineering increased by huge margins.

What can we do to protect ourselves?

· Be cautious of all your activities on the internet or phone. Remember prevention is always better than cure.

· Do not click on links, download files, or open email attachments from unknown senders.

· Beware of phone phishing; never provide personal information over the phone if you receive a call. Beware of emails that ask the user to contact a specific phone number to update user’s information as well.

· Always make sure that you are responding to a credible source. Double check before providing any sensitive information.

· Make sure to do transactions only on secure websites. Make sure that the websites are “https” and not just “http”

· Make sure to connect to a company VPN when dealing with sensitive official data.

· Never solely rely on anti-virus or firewalls to protect yourself.

· When opening trusted websites directly from emails, do not directly click on them. Try to go to the websites externally by searching it using a secure browser. Beware of links to web forms that request personal information, even if the email appears to come from a legitimate source. Phishing websites are often exact replicas of legitimate websites.

We first came together for a hackathon back in March. Steve Johns has blogged about it in detail . I guess it was some sort of beginner’s luck, but we got third prize in the competition. It was a surprise for us too. But it gave us some confidence and I guess that’s why we thought of applying for Idea Grant in the first place.

We didn’t really have a product in our minds when we initially applied. We only completed our application form just a few minutes before the deadline. We had identified a serious problem which needed attention , but our solution was far from ideal. We realized this the hard way when we failed miserably at a hackathon in MITS Kochi. We got a lot of input from some highly experienced and talented people. They helped us figure out our faults and mistakes.That event was an eye opener. I don’t think I’ve ever failed this badly in something. But that’s when I realized that one could learn so much from failing. All those failure quotes seemed to be true.

Our product was a mess. It had way too many problems and it didn’t even do the work that it was supposed to do. We wondered what we were thinking by applying with such a product for Idea Grant! But surprisingly we got an email the next day saying that we were selected for the first round of pitching. Then began the endless meetings and discussions. We changed our entire product design, identified the problems, and finally after tons of discussions, a completely new version of the product was developed. And the first round of pitching was over and then again, we realized that we had some more problems with our prototype. We were slightly hopeful of getting into the final round. The results of the selection was said to be declared on a Tuesday. We were all so nervous the entire day, refreshing Gmail every few minutes. And finally, when we had just given up all hope, we got the email at around 10pm. I don’t think any of us have been this excited for an email.

The finals of Idea Grant was on 14 July in Trivandrum. After a back breaking and sleepless 8 hour journey, we arrived at the venue. We were all so tired but the realization that all the hard work and all those hours of planning were going to be over in a few hours kept us fresh and excited. The day that we were anxiously waiting for was here. But it was over before we even got the time to think about it. It was all over in 15 minutes. Steve presented it beautifully and we managed to answer most of the judges’ questions. But we don’t know if we were able to convince the judges or not. Hopefully we’ll get a positive result! But at the end of day, I don’t think the results are that important. We are all so happy with our progress and of how far we’ve come since the beginning. It all seems like a dream come true! :D

At first, we approached Mr. Mubarak who was a professor in our college. After discussing with him , he asked us if we could build an app for entering internal marks directly into a software that was already installed in our college. As such an app would require us direct access to the college’s data, we realized that this was something we could not help him with.

After our initial failure, we reached out to Mr Shabeer , who was the owner of Oxygen, a book store near our college. We approached him and told him that we were on a project to help out local businesses.He was really glad to meet us.

During our meetings with him,he shared several problems that he was facing and asked us what we could do for him.These are some of the problems he faced. There is no proper catalogue in Oxygen. So students are not aware of the new books that are available in the store. He also wanted a digital system where students can order the books online as it gets extremely crowded when students have to come in person to order the books. The present system is to write down the books that a student needs in a notebook. This gets extremely tedious especially during their peak times. So he asked us to help him with an app that would solve these problems.

After discussing with Felix Josemon , we decided to go ahead with this project. We met him again and gave him a brief idea about how we were going to be solving the problems. Now we are hoping to complete a prototype of the app within a week and present it to our first customer.

On Jan 31st, about 24 of us attended an android development workshop which was conducted by the DSC club of our college and it was organized by Felix Josemon. I have attended lots of workshops where we learn basics, go home and forget all about it within a week. But this was no ordinary workshop. This was more of a mentorship program.

We received emails from Felix asking for a #meetupovercoffee which turned into a #meetupoverlime. During these meetings , Felix told us about how he became a google scholar and how he grabbed all the opportunities during his 2 week trip to San Francisco.

He also asked to form groups and build apps that will have an impact in the society. He gave us a deadline to form the groups by 6 pm on Saturday. Deadlines are something we engineering students start hearing right from the day we enter college. And usually these deadlines mean nothing. So basically, being the lazy person I am, I procrastinated until the last moment. One of my friend and I had planned to form a group and we thought that it would all go smoothly. But time passed and at 5.45 pm, we realized that we had no group and that when a google scholar gives you a deadline, you have to take it seriously!

People started posting their groups and we entered panic mode. Everyone we knew had already formed a group. I started messaging a bunch of random people from the DSC whatsapp group. It was finally 6 pm and Felix started kicking out people from the group. Then I got a call from vaisakh mohan and within 2 minutes we had formed our teams. Vaishak, Zebin Wilson and me were going to be a team. I had no clue who they were or what they did but soon understood that this was indeed going to be a great team. We are already on the path to build apps that will help the society and I really hope that we can do it by our next deadline…which I’m gonna take seriously this time!