Profiling Hackers - The Psychology of Cybercrime | Mark T. Hoffmann | TEDxHHL

Summary

Mark T. Hofmann, a crime and intelligence analyst, reveals the psychological strategies behind cybercrime, focusing on social engineering and manipulation. He emphasizes that most cyberattacks stem from human error, making cybercrime more of a psychological than technical issue. Hackers exploit human vulnerabilities like trust, authority, and curiosity to gain access. Hofmann uses examples and illusions to demonstrate how easily we can be misled. He calls for increased awareness and vigilance to become a 'human firewall' against cyber threats, concluding that education and awareness are key to preventing cybercrime.

Takeaways

• 🕵️‍♂️ Hackers leave personality traces in their behavior, from language to decision-making.
• 📊 More than 90% of cyberattacks are caused by human error, highlighting people as the weakest link.
• 🔐 Cybercrime is not just a technical problem; it's also a psychological and management problem.
• 💻 Many cybercriminals operate in company-like structures, using 'crime as a service' models.
• 🧠 Hackers, especially 'black hat hackers,' are typically young, intelligent, well-educated males.
• 💰 The primary motives for hacking are money, espionage, and thrill-seeking, with money being the most common.
• 🎩 Social engineers manipulate psychological weak points, such as trust, urgency, and authority, to exploit victims.
• 🔍 Hackers use misdirection techniques, tricking victims into ignoring critical thinking, just like in magic tricks.
• 🔐 Hackers often exploit authority and sympathy principles by impersonating trusted figures or institutions.
• 🛡️ Awareness and vigilance are key to becoming a 'human firewall' and preventing cybercrime.

Q & A

What does Mark T. Hofmann describe himself as, and what is his role?

Mark T. Hofmann describes himself as a crime and intelligence analyst, or more commonly referred to as a 'criminal profiler.' His role involves analyzing behavior to understand the motives and psychology behind cybercriminals' actions.

How does Hofmann contrast the portrayal of hackers in media with reality?

Hofmann highlights that in media, hackers are often depicted as people in hoodies with green text on their screens, and their faces are rarely shown. In reality, hackers often operate differently and may leave psychological and behavioral traces that can help identify them.

According to Hofmann, what percentage of cyberattacks are caused by human error?

Hofmann states that more than 90% of cyberattacks or cybersecurity breaches are caused by human error, making people the weakest link in cybersecurity.

What are some of the main motives behind cybercrime as listed by Hofmann?

The main motives for cybercrime, according to Hofmann, are financial gain (money), espionage, fun, ideology, or simply trolling. Financial gain is the most common motive.

What is 'crime as a service' in the context of cybercrime?

'Crime as a service' refers to the organized structures in cybercrime that operate similarly to legitimate companies. Cybercriminals often work in a business-like manner, with supply chains, quality management, and even customer support systems.

Who are 'black hat hackers,' and what are their common characteristics?

Black hat hackers are the 'bad guys' in the world of hacking. Hofmann states that over 90% of them are male, about 80% are under 30 years old, and most of them started hacking between the ages of 10 and 15. They are typically intelligent, well-educated, and do not come from low socio-economic backgrounds.

What psychological motive, besides financial gain, do some hackers have according to Hofmann?

Besides financial gain, some hackers are motivated by thrill-seeking or the 'challenge to beat the system.' They enjoy the feeling of being cleverer than law enforcement and take pleasure in outsmarting others.

How do hackers exploit human vulnerabilities through social engineering?

Hackers exploit human vulnerabilities by using psychological manipulation techniques such as misdirection, the sympathy principle, and the authority principle. They use tactics like phishing emails, sympathy-based schemes, and fake authority symbols to gain access to sensitive information.

Can you explain Hofmann's lesson about the 'art of misdirection'?

Hofmann demonstrates the 'art of misdirection' by performing a magic trick, explaining it, and then surprising the audience with an unexpected twist. He likens this to how hackers manipulate people by making them think they are aware of a situation, only to mislead them further.

What is Hofmann's key recommendation for preventing cyberattacks?

Hofmann stresses the importance of awareness as a key element in preventing cybercrime. By being aware of common tactics like phishing emails, social engineering, and psychological manipulation, individuals and companies can better protect themselves from cyberattacks.

Outlines

00:00

🕵️‍♂️ Unmasking Hackers and Their Psychology

Mark T. Hofmann introduces himself as a crime and intelligence analyst, often referred to as a 'criminal profiler.' He explains the stereotypical portrayal of hackers on television versus reality. He aims to 'unmask' hackers by discussing their profiles, motives, and the psychological techniques, like social engineering, that they use to exploit human weaknesses. Hofmann emphasizes that hackers leave traces of their personality through their actions and decisions, which can be analyzed, particularly through language.

05:02

👨‍💻 Profiling the Black Hat Hackers

Hofmann provides a detailed profile of 'black hat hackers,' describing them as predominantly male, under 30, highly intelligent, and well-educated. Despite having no significant socio-economic challenges, these individuals turn to cybercrime mainly for financial gain, espionage, or thrill-seeking. Hofmann questions why, given their intelligence and opportunities, these individuals choose illegal activities over legal career paths. He also highlights that ego and the desire to outsmart systems play crucial roles in their actions.

10:06

🎭 The Art of Misdirection in Cybercrime

Hofmann uses a magic trick to illustrate how hackers use misdirection to fool their victims. He explains how hackers distract targets by making them think they are being protected or helped, only to exploit them when their guard is down. He highlights the tactics used in phishing emails and how urgency is often created to manipulate victims into acting without thinking critically. He also emphasizes that even a small percentage of people falling for these tricks can result in significant success for hackers.

15:10

❤️ Sympathy and Curiosity: Exploiting Human Weaknesses

Hofmann explains how hackers exploit human emotions like sympathy and curiosity. He shares an example of a USB flash drive left by a pickpocket, which could tempt someone into plugging it into their computer, potentially initiating a cyberattack. He also points out how female spies and agents, often seen as unsuspicious due to sexism, are highly effective in intelligence work. He cautions that cybercriminals and spies often look ordinary or sympathetic, making it hard for victims to recognize the threat.

🧑‍⚕️ The Authority Principle: Trusting Experts

In this section, Hofmann describes how cybercriminals exploit people's trust in authority figures by using logos, brands, and institutions in phishing scams. He compares this to marketing strategies where companies use authority symbols to sell products, like in a TV ad for a toothbrush. Hackers do the same by pretending to represent trusted institutions like the FBI or banks. He reinforces that cybercrime is a psychological issue, with more than 90% of cyberattacks stemming from human error, and calls for greater awareness as a defense.

Keywords

💡Cybercrime

Cybercrime refers to illegal activities that involve computers and networks. In the video, Mark Hofmann explains that cybercrime is not just a technical problem but a psychological one, as it often involves human manipulation. Hackers exploit human vulnerabilities to gain access to systems, as seen in examples like phishing emails or social engineering.

💡Social Engineering

Social engineering is a method used by hackers to manipulate people into divulging confidential information. In the video, Hofmann highlights how hackers exploit human psychology, using techniques such as fake emails or creating a sense of urgency to get individuals to unknowingly share sensitive data, like passwords.

💡Human Firewall

A 'human firewall' refers to a person who is trained to recognize and prevent cyberattacks by using awareness and caution. Hofmann encourages individuals to become human firewalls by being aware of social engineering techniques and understanding how hackers manipulate emotions to gain access to systems.

💡Misdirection

Misdirection is a technique where attention is deliberately diverted to hide the real action or truth. In the video, Hofmann uses a magic trick to demonstrate how hackers use misdirection to exploit human vulnerabilities, drawing attention away from critical details to execute cyberattacks without the victim noticing.

💡Phishing

Phishing is a form of cyberattack where hackers send fraudulent messages that appear to be from legitimate sources to steal sensitive information. Hofmann provides examples like fake Amazon or bank emails that prompt users to click links, giving hackers access to personal data.

💡Black Hat Hackers

Black hat hackers are individuals who use their technical skills to break into systems for malicious purposes, often for financial gain or espionage. Hofmann explains that most black hat hackers are young, intelligent, and motivated by a challenge or thrill, making cybercrime a form of ego-driven activity.

💡Challenge to Beat the System

This concept refers to the thrill or psychological drive that hackers experience when they outsmart security systems or law enforcement. Hofmann discusses how many hackers, especially younger ones, are motivated not just by financial gain but by the ego boost that comes with successfully evading detection and proving their superiority.

💡Authority Principle

The authority principle is a psychological manipulation tactic where hackers present themselves as credible or authoritative figures to gain trust. In the video, Hofmann describes how cybercriminals use logos, brands, or even emails from institutions like the FBI or IRS to trick individuals into believing their messages are legitimate.

💡Crime as a Service

Crime as a service refers to the professionalization of cybercrime, where hackers operate in company-like structures with defined roles, supply chains, and even customer support. Hofmann explains that modern cybercriminal organizations resemble legitimate businesses, making them highly efficient and dangerous.

💡Psychological Weak Points

Psychological weak points are vulnerabilities in human behavior that hackers exploit to execute attacks. Throughout the video, Hofmann emphasizes how hackers analyze human emotions, such as curiosity or trust, to manipulate individuals into making critical errors, like clicking on malicious links or sharing sensitive information.

Highlights

Mark T. Hofmann introduces himself as a crime and intelligence analyst, commonly known as a criminal profiler, focusing on cybercrime behavior.

The typical portrayal of hackers in media (hoodie, green text on screen) is misleading; real cybercriminals often work in structured environments.

Profilers can analyze the language and behavior of hackers to uncover clues about their identity and motives, even from digital traces.

Over 90% of cyberattacks are due to human error, making people the weakest link in cybersecurity.

Cybercrime is not just a technical issue; it’s a psychological, people-centric, and management problem.

Social engineering, the manipulation of human emotions, is a key tactic in cybercrime, making technical defenses like firewalls ineffective if the human element is compromised.

Hofmann highlights Bruce Schneier’s quote: 'Amateurs hack systems, professionals hack people,' emphasizing that people are the primary targets.

Hackers often work in 'crime as a service' structures, with hierarchical organization, supply chains, and even customer support.

The majority of black hat hackers are young, intelligent, and well-educated, with most starting between the ages of 10 and 15.

Key hacker motives are financial gain, espionage, and thrill-seeking, with the challenge of outsmarting authorities playing a significant psychological role.

Social engineers exploit human psychological vulnerabilities through tactics like misdirection and urgency to manipulate victims into making mistakes.

Hackers often use the 'authority principle,' impersonating figures of authority such as government agencies to induce compliance.

Women are increasingly used in industrial espionage, as they are less likely to be suspected, making them highly effective in intelligence roles.

Hofmann emphasizes that all companies are at risk of cyberattacks, no matter their size or perceived importance.

Raising awareness and understanding human vulnerabilities is crucial in preventing cybercrime. Awareness training can act as a 'human firewall' to minimize errors.

Transcripts

Transcriber: Mariolina Sanfilippo Reviewer: Eunice Tan

My name is Mark T. Hofmann, and I’m a crime and intelligence analyst

or what most of you would most likely call “a criminal profiler.”

If you think of cybercrime, you may have something like this in mind.

On television, it always makes these fancy sounds,

(Computer beeps)

and you see the kid with a hoodie in front of a laptop,

with green text on the screen.

Well, reality is different.

And on television, you never really get to see the face.

Hackers are always presented like this or from behind,

but you never really see the face.

Today, I would like to unmask the face of hackers, so to say.

I would like to talk about the profiles and motives of hackers.

I would like to talk about psychological manipulation,

about social engineering techniques they are using to attack us,

and what we can do to become a human firewall.

As a profiler, I am interested in behavior.

I analyze behavior,

and I try to identify the motives and the psychology behind that behavior.

Because with everything we do, we show something of who we are;

with every decision we make, we show something of who we are.

And also, hackers make a series of decisions:

They are choosing targets, they are choosing methods,

pretty often they make phone calls,

they write text messages, they write phishing mails.

And with everything they do, or fail to do,

they not only leave digital traces but also traces of their personality.

And very often, the analysis of language is a key element in profiling hackers.

Let me give you an example with the word “behavior” itself.

A person from the United States,

an American, would most likely write the word “behavior” like this,

a person from the UK would more likely spell the word “behavior” like this,

[BEHAVIOUR]

and an idiot might spell the word “behavior” like this.

So based on the word someone is using, based on the analysis of language,

I can try to make a probability statement about an unknown offender.

Yes, cybercriminals are hard to catch,

but in many cases, they are not as invisible as they might think.

[BEHAVIAR]

[>90%]

So what can a profiler tell you about cybercrime?

Well, quite a lot.

More than 90 percent of all cyberattacks or cybersecurity breaches

are caused by human error.

So humans, people, are the weakest link in the cybersecurity chain.

Let me be very clear about this:

Cybercrime is not just a technical problem.

It’s a psychological problem, it’s a people’s problem,

it’s clearly a management problem.

Computers are the weapons,

but the perpetrators and also the victims are humans.

Any door is only as secure

as the person who is holding the key or the passwords.

So you can have the best fancy high-security door in the world.

If I manipulate you to give me the key, it’s useless.

You can have the best fancy high-security firewall system in the world.

If I manipulate you to give me the passwords, it’s useless.

“Amateurs hack systems, professionals hack people.”

This is a quote by security expert Bruce Schneier, and he is damn right.

So what can we say about the profiles of hackers?

Who are the people behind the attacks?

Well, pretty often, cybercrime doesn’t look like this.

It looks more like this.

Law enforcement professionals and intelligence professionals

and security professionals like to use the term “crime as a service.”

So pretty often, cybercriminals work in company-like structures.

They have something like a supply chain,

they have something like quality management,

and sometimes they even have customer support.

So if you or your company gets attacked,

it may not come from a kid in front of a laptop, with a hoodie.

It may come from a call center-like structure

anywhere in the world, like this.

But of course, there are some individual hackers -

we call them “black hat hackers.”

So the ones with the black hats, these are of course the bad guys.

According to the current state of science,

what can we say about the profiles of black hat hackers?

We can say this:

Most of them - some studies say more than 90 percent - are male.

Around about 80 percent are under 30 years old.

[Male Under 30]

The majority of them, around about 60 percent,

started at a very young age - between 10 and 15 years old.

They have above average intelligence, they are pretty often well educated,

and 90 percent do not have a low socioeconomical status.

So they are young, they are intelligent, and they are pretty often well educated.

Why the hell do they do what they do?

The main motives in descending order are money - financial gain -

espionage,

and fun - ideology or simply trolling.

[Motives]

Well, so they do it mostly for money.

If I look at this list of motives, I’m a little bit skeptical.

Because as we just learned,

they are young, they are intelligent, they are well educated,

and they do not necessarily come from difficult or broken home environments.

So if they want to make money,

why don’t they just work for Google or any other Silicon Valley company?

They could make a ton of money in a legal way.

So why are they committing crimes? Why do they make money that way?

Another psychological motive comes into play

which is called thrill-seeking,

or in psychology we sometimes like to call this

“challenge to beat the system.”

So they like the feeling of being cleverer than the FBI.

Never underestimate the role of ego, challenge and thrill-seeking

in cybercrime,

and I’m not just talking theory.

I met hackers myself, I did my own research,

and one of my subjects told me this:

“I analyze people.

In the end, human hacking works the same way that computer hacking works.

You always look for vulnerabilities and try to exploit them.”

So they are social engineers analyzing us.

They are analyzing our psychological weak points,

and they try to attack,

they try to exploit our psychological weak points.

But what are our psychological weak points?

What are the psychological manipulation techniques?

What are some of the social engineering techniques?

I want to show you a little illusion.

For this illusion, I just need a silk, and I put this silk in my hand.

Then I can show my hand empty, and the silk magically turns into an egg.

As I can see, you’re not that amazed.

And you’re right, it’s not that clever -

it’s just a plastic egg with a hole inside it.

But I want to use this to teach you a lesson about the art of misdirection.

So the fake egg goes in my left pocket, and the hankie goes in my right pocket.

And then I was fiddling around with my right pocket,

and I tried to direct your attention to the silk

while I secretly got out the fake egg with my other hand.

Then I told you I put the silk in my hand,

but in fact I carefully put the silk inside the fake egg.

Then, of course, I can show my hand empty, and then it magically turns into an egg.

Well, not that spectacular, but as I just told you,

I’m going to teach you a lesson about the art of misdirection.

Explain this.

(Egg cracks and drops)

As I just told you, this will be a lesson about the art of misdirection.

Well, what did just happen?

I created an illusion inside an illusion.

So basically, I fooled you while explaining how you have been fooled,

and this way, I totally eliminated your critical thinking.

In the first round, you all watched closely,

and you tried to see the secret behind it.

But in the second round, you relaxed.

I told you, “Relax - now I show you how it’s done,”

and this way, I eliminated your critical thinking.

Again, I fooled you while explaining how you have been fooled,

and this is what hackers do all the time.

They hack you while telling you that you have been hacked,

and this way, they totally eliminate your critical thinking.

Pretty often, phishing mails and short messages start like this:

“We have detected some unusual activity on your account.”

And of course, now you need to click here to verify your credit card information.

Or “Your Amazon account has been locked.

There is some suspicious or criminal activity.

You need to click here to regain access to your account.”

Or “Your account was used to buy a $250 gift card.

If you want to cancel the order and confirm your credit card information,

click here.”

So they tell you that you have been hacked.

In fact, you haven’t been hacked.

But when you click on these links, you will be hacked.

Now, you might say, “Well, I’m smart. I won’t click on these links.”

Well, I’m not sure.

If you’re distracted or if you just made an Amazon order the day before,

I’m not sure if you wouldn’t click on these links.

But even if just two people out of 100, just two percent, click on these links,

well, it’s enough.

If I send 100 mails, two people are going to click on these links.

And this is a very low estimate; it will be way more.

And of course, it’s always urgent - you need to do it right now.

Hackers never say, “Take your time.”

You always need to do something now;

otherwise, there will be a huge damage and it will have a huge negative impact.

You need to do something now without thinking about it.

Let me give you another example of how social engineers and how hackers

try to exploit our psychological weak points.

They are using the so-called “sympathy principle.”

They exploit our tendency to trust and to like people.

Imagine you are in the subway on your way to work and it’s a rainy Monday morning.

It’s going to be a very, very long and boring day.

But suddenly, she gets on the train, and you are getting nervous.

You would love to approach her, you would love to talk to her,

but you don’t really have the guts to do so.

But then suddenly, she stands right next to you.

This would be your chance to talk to her, but still you don’t really do it.

You pretend to read something on your smartphone, but you don’t do it.

She stands so close to you that she is almost touching you,

which is almost a little bit weird.

And then suddenly, she gets off the train.

What did just happen? Is she a pickpocket or something?

Then you reach inside your pocket, and inside your pocket,

you find a little USB flash drive with a heart on it.

What might be on there? A phone number? Pictures?

Now, be honest:

Could you stand the curiosity

of not plugging this into your company’s computer

to see what’s on there?

Well, probably not.

And this may be the beginning of a negative butterfly effect unfolding

and a very serious cyberattack.

I’ll tell you a little secret from the intelligence world:

Female spies are bloody good, and it’s partly because of sexism.

Spying, crime and hacking - this is seen as a man’s job.

And this is why women are by far the best, because they are unsuspicious.

If someone looks nice or sympathetic,

it’s really hard to see this person as a potential threat.

So you don’t see the evil if someone has a face like an angel.

But yes, female agents are, without any doubt,

the best in the world.

There’s a good friend of mine, a German ex-intelligence official,

and he also confirms

that more and more women are used in industrial espionage.

So not just hackers try to spy on you,

but also secret agents from intelligence agencies

from foreign countries.

So some of these best-trained agents in the world

may wait for you at the hotel bar, with the face of an angel.

This is Silk Road.

For a very long time,

this has been the largest online drug-dealing marketplace on the darknet.

And this is the man behind Silk Road.

Excuse me, but he looks like a character from High School Musical.

I just want to make a point here:

Many criminals and spies are very successful

because they don't look like criminals or they don't look like spies.

He looks pretty sympathetic -

he’s not a hacker, but anyway -

many criminals and many spies

look pretty unsuspicious and pretty sympathetic.

So they are using their appearance.

They are using our tendency to like and to trust them against us.

[AUTHORITY]

The time is running and ticktocking away, but I want to give you one last example

of how hackers try to exploit our psychological vulnerabilities:

the authority principle.

We are much more influenceable when we consider someone an authority.

And many companies use this principle all the time.

This is the Doctor’s Best TV commercial.

They just combined all the authorities’ stereotypes

in one TV spot.

As you can see, it’s an elderly man with glasses, and he wears a tie,

and he looks like a medical doctor, and he does some kind of experiment,

and it plays in a scientific lab,

and everything in this picture,

and also the brand - it’s called “Doctor’s Best.”

So they just combined all the authority symbols

to convince us to pay much more for toothbrushes.

And people do it.

And cybercriminals do the same principle, the same persuasion technique,

all the time.

So they are using authority symbols, logos, brands

and names of institutions or government agencies

to convince us

that they are the authorities and that this is a real mail.

So they send emails from the FBI or the Bank of America or the IRS,

and they exploit,

they use our tendency to trust experts and to trust authorities.

So what did you learn, hopefully?

[SYMPATHY MISDIRECTION AUTHORITY]

Cybercrime is a psychological problem:

More than 90 percent of cyberattacks are caused by human error.

Cybercriminals, hackers, social engineers play with human emotions.

They play them like a piano.

They know what buttons to push to get a certain reaction.

So what can we do?

What can we do to become a human firewall?

Well, the cyberdefense strategy of many companies

could be described like this:

“Team I Don’t Care,” “I hope it won’t hit us,”

and “I think we are too small” or “We are not interesting enough.”

Well, guess what? You’re wrong.

There are two types of companies:

Companies that have been attacked, and companies that will be attacked.

This is not a cyberdefense strategy;

this is naive.

The key is awareness.

A talk like this, a speech like this, a workshop

can definitely help to prevent crimes from happening.

Awareness alone can be a key element in the prevention of cybercrime.

If someone calls you and asks you for your password on the phone,

I’m not sure if you are going to give it at this point.

If you get an email from Amazon

that your account has been hacked and you need to click on this link,

I’m not sure if you are going to click on this link.

If you find a USB flash drive on the ground,

I’m not sure if you are going to plug it into your computer out of curiosity.

And if you get an email by the FBI or the IRS,

I’m not sure if you will transfer the money or click on these links.

So awareness alone can help to prevent cybercrime.

My name is Mark T. Hofmann, I’m a profiler and speaker,

and I thank you.

Stay safe, and thank you for your undivided attention.

(Applause)