How Clicking a Single Link Can Cost Millions | Ryan Pullen | TED

翻译人员: Yip Yan Yeung 校对人员: Yanyan Hong

I received a phone call from somebody who needed my help.

我接到了一个电话， 来电人需要我的帮助。

And they explained to me

他/她解释说，

that this organization had suffered a cyberattack,

这个组织遭到了网络攻击，

more specifically a ransomware attack,

更具体地说，是勒索软件攻击，

which is designed

其目的是窃取你的数据 并使其无法被使用。

to both steal your data and make it unusable.

It replicates itself throughout the business

它可以在整个业务过程中自我复制，

and can drive you down to paper-based controls.

逼你采取纸质管理。

And this was an opportunity that I saw

我看到了一个机会，

where I could influence something positively.

借此我可以对一些事产生积极影响。

And it was my job to investigate what had happened,

我的工作是调查发生了什么、

how it happened and why.

它是如何以及为什么发生的。

And I saw something that I hadn't experienced before firsthand.

我亲眼目睹了 以前从未经历过的东西。

In 2017, the NHS suffered something similar,

2017 年，英国国家医疗服务体系 也遭受了类似的攻击，

and it cost nearly 100 million pounds to recover.

耗资近 1 亿英镑才得以恢复。

This incident cost around five million pounds to recover

这起事件耗资约 500 万英镑恢复，

and took 14 months.

历时 14 个月。

Yet what I saw was the human impact.

但我看到的是人为的影响。

How this happened?

这是怎么发生的？

A single individual clicked a link,

一个人点击了一个链接，

and a single individual enabled this, unknowingly,

而这个人在不知不觉中 导致了这起影响到整个机构的事件。

to happen to an organization.

Multiple people were signed off sick due to stress,

很多人由于压力请了病假，

and multiple people were unable to go to work the next day

很多人第二天 无法上班，无法完成工作。

and carry out their job.

Now, for me,

对我来说，

cybersecurity is a very technological-focused term.

“网络安全”是一个非常技术性的术语。

And yet IBM did a study in 2021.

但是 IBM 在 2021 年 进行了一项研究，

and 95 percent of cyberattacks

95% 的网络攻击涉及人为因素。

used a human element.

Now that's all well and good,

听起来没什么问题，

but what does that actually mean?

但这到底意味着什么？

It means people can be exploited, too.

这意味着人们也可能会被利用。

There’s no lines of code, and there’s no fancy software.

没有一行行代码， 也没有花哨的软件。

Cybersecurity is, as far as the media is concerned,

媒体口中的网络安全

maybe teenagers in their bedrooms causing trouble,

可能是青少年在卧室里搞事、

stealing things and learning how to use them.

偷东西、学习如何使用它们。

Yet what people don't see is the impact and how his day-to-day life.

然而，人们看不到的是 它造成的影响和与日常生活的联系。

And this incident for me,

对我来说，这起事件

made me think slightly differently around cybersecurity.

使我对网络安全有了一些新的看法。

And recently I had an opportunity

我最近有了一个 展示这一思考过程的机会。

which presented this thought process.

I was commissioned to evade security controls

我受委托绕过伦敦一座 非常知名的建筑的安保措施。

for a very well-known building in London.

That’s a snazzy way of saying “break in.”

只是“突破”（break in）的时髦说法。

And effectively, it was my job to see if I could get past the security controls

我的工作其实是 看看我能否通过躲过安保，

and get into the building.

进入大楼。

And so for me, thinking kind of outside of the box,

对我来说，得突发奇想一下，

this building has floor to ceiling doors,

这座大楼有落地门，

24/7 security team,

全天候的安保团队，

endless budget for this kind of thing based on where they are.

环境的特殊性 意味着巨额的预算。

And so, thinking slightly outside,

还得再异想天开一点，

I needed to come up with a different plan.

我得再想出一个计划。

And ...

我选择了“社会工程”路线，

What I did was I tried to go down the social engineering route,

which is the art of kind of deception

欺骗的艺术，

and making people believe something without the full information.

让人们在没有完整信息的情况下 相信某些东西。

And what I did was I walked in the front door,

我走进大门，

dressed quite similarly to this,

穿成我今天穿的这样，

and I was greeted by eight people

受到了八个人的问候，

and I thought, oh, that's a bit over the top.

我想，哦，有点过头了。

And it's because every single person should have the right information

这是因为每个人 都应该知道正确的信息，

and should know where they're going,

应该知道自己要去哪里。

It’s very rare for them to be visitors.

他们极少会作为访客出现。

And this person asked me,

然后有个人问我：

"Why are you here? Who are you here to see?"

“你来这儿干嘛的？你找谁？”

And I explained, I didn't have an appointment,

我解释说，我没有预约，

but I was here to see a specific person.

但我来这儿是为了见某个人。

And they said, "Yeah, there's no chance you're getting in."

然后他/她说：“好吧，你进不去的。”

And I thought, oh goodness, I traveled all this way.

然后我想，天哪， 我好不容易来到这里。

And yet what I know is people are empathetic,

我知道人们有同理心，

and people want to help each other, right?

人们想互帮互助，对吧？

And so I made up a story and I said I was here for a legal matter,

于是我编了一个故事，我说 我来这里是为了处理法律事务，

and I was only able to achieve what I needed to achieve

我只能在满足此前提下 才能完成我本该完成的事项。

on these premises.

And they said, "Yeah, sorry, we're still ..."

然后他/她说： “不好意思，我们还在……”

And I explained the urgency, and I made them feel sorry for me.

我解释了事态紧急， 让他/她同情我。

And what I was thinking about giving this talk,

我在构思这场演讲的时候，

I was going to pause and I was going to pretend that I was struggling.

本想我该暂停一下，装作窘迫。

And that emotion that you would have felt

你会感觉到想帮我的冲动，

where you wanted to help me

or you wanted me to continue, is exactly how this person felt.

或者你想让我把事做下去， 这个人就是这么感觉的。

They felt they were stopping me from doing my job, which they were,

他/她觉得阻挠了我完成我的工作， 而他/她干成了自己的工作，

but not for how they expected it.

但他/她没想到是以这种方式。

And then I pretended to be on the phone in the foyer, pacing up and down,

然后我假装在大厅打电话，来回踱步，

pretending to be aggravated.

假装情绪激动。

And then the manager came across with a QR code for me and said,

然后经理给我拿了一张二维码，说：

"So sorry for the issues, no problem."

“很抱歉出了问题，没问题。”

And they showed me around a side passage away from the two rounds of security.

然后他/她给我指了一条 两轮安检旁边的小道。

So I had my laptop bag with me with “the evidence,”

我带着我的电脑包，装着“证据”。

and it wasn’t checked and I was able to go in,

没人查它，我就进去了，

and I was able to go to the floor that I needed to.

我也上到了我想去的楼层。

And I was paid as a cybersecurity expert to evade the controls of this building.

我受聘作为网络安全专家 躲避这栋楼的安保。

And all I did was ask for access and make someone feel sorry for me.

我所做的只是请求进楼， 让别人为我感到过意不去。

And so that's two very different perspectives.

这是两个截然不同的视角。

One, the five-million-pound job and took 14 months to recover

第一，花了 500 万英镑、 14 个月的工作，

where I was helping people,

我是在帮人，

but the second, I was the aggressor

但是第二，我是入侵者 或试图闯入的人。

or the person trying to get in.

Now this is all enabled through the way that humans exist

这一切都源于人类的生存方式和行为。

and human behavior.

And cybersecurity as a whole doesn't really represent that

我认为整体来看，网络安全 并没有完全体现出这个含义。

in a way that is sufficient, I don't think.

And so I have one more narrative and different perspective to share.

我还想分享一个故事 和不同的观点。

And it's when I was a victim.

这次我是个受害者。

This happened only a few weeks ago.

就发生在几周前。

And what happened was I received a phone call.

我接到了一个电话。

It was around 8pm.

晚上 8 点左右。

I received a phone call from a phone number.

我接到了一个电话号码打来的电话。

And they said, "Hello, is this Mr. Pullen?"

他/她说： “你好，是普伦（Pullen）先生吗？”

And I said yes.

我说是的。

And they said, "We've seen your bank cards be used

他/她说：“我们发现你的银行卡 在我国另一个地区被使用了。”

in a different part of the country."

And I thought, oh goodness.

然后我想，天啊。

And what they explained was,

他/她解释说， 有三笔不同的交易，

they explained there's been three different transactions

and would I like them to block them for me?

问我要不要为我拦截？

I said, "Yes please.

我说：“好的。帮大忙了。”

That would be really helpful."

And I Googled the number out of instinct,

我出于直觉在谷歌上搜索了这个号码，

and it was the phone number from the fraud line in the bank.

那是银行欺诈热线上的电话号码。

And something didn't add up.

有点蹊跷。

And I'm a bit of a pessimist.

我有点悲观。

I don't really trust people.

我不太会信任别人。

And so I was instantly on the back foot,

所以我立刻心生戒备，

and they're saying all of these things,

他/她说了这一大堆，

they were confirming my identity.

在确认我的身份。

They told me where I lived, my mother's maiden name,

他/她说了我住在哪里、 我母亲的娘家姓氏，

and they told me a few other bits of information the bank would know.

还说了一些银行才知道的信息。

And all of this is to build a perception of credibility.

这一切都是为了建立可信度。

Why shouldn't I trust you?

我为什么不该相信你？

And why shouldn't you be phoning me to help me?

你为什么不该打电话帮我？

And we go back and forth for around an hour and a half,

我们拉扯了大概一个半小时，

and there was a few things that didn't sit right with me.

有几点让我觉得不对劲。

And so when I was on hold, when they were blocking my transactions,

当他/她在拦截我的交易，让我稍候时，

I phoned the actual fraud line and I said,

我给真正的欺诈热线打了电话，

is there a way that I can verify their identity?

问有什么办法可以 验证他/她的身份吗？

The person on the phone said, "They sound very professional and legitimate"

电话里那个人说： “他/她听上去很专业，像是真的。”

and they were.

确实如此。

I asked for their name, and they had a fake LinkedIn profile.

我问了他/她的名字， 他/她有一个虚假的领英档案。

They had a fake crime reference number for me.

他/她给了我一个假的报案号码。

And ...

我亲身经历了这种情况，

Me experiencing this firsthand,

having investigated things like this on a regular basis for mortgages

我定期调查这样的事情， 检查抵押贷款

and transactions ending up in the wrong place,

和交易有没有流向不该去的地方，

I knew something wasn’t sitting quite right,

我发现不太对劲，

and the true person put a note on my account

确确实实有个人 给我的账户留过言，

and I explained to the person,

我和那个人说：

"Can you tell me what the note says, please?"

“你能告诉我这个留言写了什么吗？”

And that was the first time they got a little bit flustered.

那是他/她第一次有点慌张。

And it took them five minutes and they said,

他/她花了五分钟，说：

“我们会去和客户团队核对。

"We'll go and check with accounts team.

但与此同时，你能告诉我 你手机 app 里的验证码吗？”

But in the meantime, can you tell me the code that it says in your mobile app?"

此时我挂断了电话， 换了卡，然后就没事了。

At which point I hung up, got my cards replaced, and I was OK.

But these three narratives

但是，这三个

of cybercrime or scams or criminal behavior

网络犯罪、诈骗 或犯罪行为的故事

are all technology-focused with the end goal

都是以技术为中心，达成最终目标，

but are human-led.

却是人为主导的。

And you may ask, "How is this possible?"

你可能会问：“这怎么可能？”

"Why can this be so easy?"

“为什么会这么简单？”

I've literally just walked into a building

我就这么走进了一栋楼，

and asked someone to let me in with a fake story.

讲了个假故事就让人把我放进去了。

And someone's phoned me up with a small piece of information

有人拿着一点点信息给我打电话，

and built this incredible picture around, OK, yes, I should trust you.

描绘出了一整幅图景。 好吧，我确实该信你。

And it's because data has a value in different pockets,

这是因为数据在不同人的手中各有价值，

and with small bits of information you can build quite a narrative,

如你所见，只要有了一点信息 就能编个像样的故事。

as you can see.

And so today,

如今，

what you would be able to do

如果你想干这种见不得人的勾当，

on the kind of criminal underground, if you like,

would be buy 1,000 email addresses and passwords

你只需花 6 美元左右 买 1000 个邮箱和密码，

for around six US dollars

a cup of coffee in some places, right?

有些店里的一杯咖啡 也这个价，对吧？

That's 1,000 people's account details that you may be able to log into

这 1000 个人的账号信息， 你可以登进去，

or have tangible information to create a case,

拿到货真价实的信息 编造一个事件，

and that might be pretending to be Amazon for a password reset.

可以是假装亚马逊要求重置密码。

It might be what location you went on holiday,

可能是你去度假的地点，

and we're going to do a bit more of a targeted attack that way.

我们就这样进行一些针对性攻击。

And this information is available

这些信息之所以可用， 是因为存在技术上的漏洞。

because of vulnerabilities from a technical standpoint.

Yet this is to exploit human behaviors.

但这是为了利用人类的行为。

Take my parents, for example.

以我的父母为例。

I think I’m in cybersecurity because my parents give me a balance.

我认为我之所以从事网络安全， 是因为我的父母给了我一个平衡点。

My mom is 100 percent, 110 percent optimist.

我妈妈 100%、110% 乐观。

Nothing's going to go wrong, everything's OK,

什么都不会出错， 一切都很好，

no one's going to hurt my little boy and all of this sort of stuff.

没有人会伤害我的小男孩等等。

And my dad's much more on the pessimistic end where,

而我爸爸更悲观，他会说：

“Why do you want to know me?

“你为什么想认识我？

Why do you want this information?”

你为什么想要这些信息？”

And so that balance for me brings kind of both sides of the story.

于是这种平衡为我带来了故事的两面。

And my mom is the sort of person that would have shared

我妈妈就是那种会分享

the traditional WhatsApp messages,

传统的 WhatsApp 消息的人，

250 pounds at Christmas and oh, how lovely that would be,

圣诞节要发上几万条， 多美好啊，

pay for your Christmas lunch and all those sorts of things.

请你一顿圣诞午餐等等。

And that then becomes a whole different attack vector,

然后这就变成了 一个全新的攻击载体，

because it's coming from someone you trust,

因为它是你信任的人发的，

and they're sharing you a link

他们给你分享了一个链接，

and they're sharing something you might want to click,

分享了你可能想点开的东西，

and you begin to trust it even more.

然后你就更信它了。

And so my talk is around really focusing on the ways

我的演讲更侧重于

in which human behavior is exploited

人类行为被利用的方式，

and how we can benefit and protect each other.

我们该如何获益、互相保护。

And it's OK to call these things out.

把这些话说出来是可以的。

And so there's some basic things you can do,

你可以做几件基本的事，

such as resetting passwords

例如重置密码，

and making sure you're not using the same password for all your accounts.

确保所有账户没有用同一个密码。

Because if one of your passwords did get leaked,

因为如果你的一个密码 确实被泄露了，

you would like to know, OK, it's just this one account,

你就知道， 好吧，只是这个账户而已，

and I understand that's the one I need to look after.

我只需要处理这个账户就行了。

When many people will use the same profile for Facebook,

很多人会在 Facebook、

their bank -- their online banking, sorry,

银行，网上银行，不好意思，

and sites that you can purchase things.

和购物网站上使用同一份个人信息。

So you might be able to go on Amazon

所以你可以上亚马逊，

and buy an iPhone with someone's username and password, right?

用别人的用户名和密码 买一台 iPhone，对吧？

Bank account details are stored.

银行账户详细信息都存着呢。

And that creates a whole different perspective of risk and cybercrime.

这为风险和网络犯罪 创造了完全不同的视角。

And so for me,

对我来说，

I don't believe any generation can avoid this anymore.

我认为没有一代人 可以避免这种情况。

Children are being raised with iPads,

孩子们是拿着 iPad 长大的，

and older generations are online shopping

老一辈人之所以在网上购物，

because of convenience and accessibility to services they may not have had before.

是因为他们以前不能 如此便利和容易地获取服务。

And so I believe that understanding how these things may happen

我相信了解这些情况发生的缘由，

and putting some light on them

多关注它们，

can really impact the way in which people conduct themselves

可以影响人们的行为方式，

and challenge when things may not feel quite right.

在情况可能不太对劲时质疑。

And so for me,

对我来说，

going through this journey and those three different perspectives,

经历这段旅程和这三种不同的视角，

the one where I was the person helping, five million pounds,

一个是我帮助的人， 500 万英镑，

and seeing people really suffer.

看到了人们痛苦不堪。

The second one where I was putting people potentially in that position,

第二个是我让人们处于这种境地，

however fully ethically, and I was meant to be there for my job.

虽然完全是符合道义的， 我只是在完成我的工作。

And the third where I was the victim,

第三个是我成为受害者的故事，

it shows that it can take many different shapes based on information.

表明信息可以产生不同的形态。

And information can come from social media.

信息可能来自社交媒体。

And so if you're going on holiday to Mexico,

如果你要去墨西哥度假，

say, for your honeymoon,

比如度蜜月，

you've saved up all of this money.

你已经存够了钱。

Wonderful, have a lovely time.

太棒了，玩得开心。

Yet someone you know or an acquaintance

但是你认识的人、熟人，

or you have public visibility of your arrangements.

或者你公开了你的行程。

If someone knows that information

如果有人知道这些信息，

and they know the bank you may work with,

并且知道你可能与哪家银行合作，

they could phone you whilst you land and say,

他/她可以在你落地的时候 打电话给你，说：

"We've seen your card be used in this location."

“我们看到你的卡 在这个地点被使用了。”

Now, how are you going to feel

如果有人说你的卡被人用了， 是你用的，你怎么想？

if someone's saying your card is being used and it's you?

You're going to feel OK, cool, yeah, this is me, no problem.

你会感觉还好， 没事，是的，是我自己，没问题。

And they say, "OK, can you just confirm your identity?

然后他/她说：“好吧， 你能确认一下你的身份吗？

Because we want to make sure this is you.

因为我们想确认是你。

Can you just tell me your card number?"

你能告诉我你的卡号吗？”

So you do, and then you're asked why you're there.

你说了，然后他/她问你， 你为什么在那里。

"I'm on my honeymoon."

“我正在度蜜月。”

"Have a lovely time."

“玩得开心。”

All of these social engineering, empathetic side of behaviors.

这些社会工程、善解人意的行为。

And then you get down into the more conversational elements.

然后你说到了更多的对话元素。

"OK, can you just confirm your card isn't going to expire?

“好吧，你能确认一下 你的卡不会过期吗？

When does it expire, please?"

请问它什么时候过期？”

There's many different ways you can pose questions to make people feel acceptance.

你可以通过许多不同的方式提出问题， 让人们感到被人接受。

And then lastly, "Can you just check the security pin

最终，“你能不能检查一下安全码，

so I know which card I'm going to disable?"

这样我就知道要禁用哪张卡了？”

And by that time what you've done is

那时你所做的就是

you've told someone you've got money in your bank

告诉别人你的账户里有钱，

because you've been saving for this wonderful occasion,

是因为你一直在 为这个美好的时刻存钱，

and also you're not going to be in the country to do anything about it.

你跑到这个国家也不会动它。

And so from a cybersecurity perspective,

从网络安全的角度来看，

exploitation can happen in many different ways,

利用可能以许多不同的方式发生，

and I don't think it's publicized around the human elements enough.

我认为围绕人为因素 进行的宣传还不够。

And so if you take one thing from today,

如果说你今天要有什么收获，

I ask that you see this as your opportunity

我想请你借此机会，

to make sure that you protect your own information and your loved ones

确保你保护着你自己的信息、 保护着你的挚爱之人

and your identity online.

和网络上的身份。

There's no problem with using social media.

使用社交媒体没有问题。

All I ask is you consider who you're sharing that information with.

我只是想请你考虑 你在与谁分享信息。

The reason being that information is valuable, even if it's not to you.

因为信息很珍贵， 即使对你来说并非如此，

It could build a picture,

它也可以拼凑出全局，

and it could cause you some trouble.

给你带来麻烦。

Consider who you share your information with.

考虑一下你在与谁分享你的信息。

Thank you.

谢谢。

(Applause)

（掌声）