One of the cybercrimes that bothers us at Cambridge is accommodation fraud. Every October about 1% the people who come as grad students or postdocs rent an apartment that just doesn’t exist. Sites like Craigslist are full of ads that are just too good to be true. While the university does what it can to advise new hires and admissions to use our own accommodation services if they cannot check out an apartment personally, perhaps 50 new arrivals still turn up to find that they have nowhere to live, their money is gone, and the police aren’t interested. This is not a nice way to start your PhD.
Some years ago a new postdoc, Sophie van der Zee, almost fell for such a scam, and then got to know someone here who had actually become a victim. She made this into a research project, and replied to about a thousand scam ads. We analysed the persuasion techniques that the crooks used.
Here at last is our analysis: The gift of the gab: Are rental scammers skilled at the arts of persuasion? We found that most of the techniques the scammers used are straight from the standard marketing textbook (Cialdini) rather than from the lists of more exotic scam techniques compiled by fraud researchers such as Stajano and Wilson. The only significant exception was appeals to sympathy. Most of the scammers were operating out of West Africa in what appears to have one or more boilerhouse sales operations. They work from scripts, very much like people selling insurance or home improvements.
Previous cybercrime research looked at both high-value targeted operations and scale attackers who compromise machines in bulk. This is an example of fraud lying between the “first class” and “economy class” versions of cybercrime.
Rental scams are still a problem for new staff and students. Since this work was done, things have changed somewhat, in that most of the scams are now run by an operator using slick websites who, according to the local police, appears to be based in Germany. We have repeatedly tried, and failed, to persuade the police (local and Met), the NCA and the NCSC to have his door broken down. Unfortunately the British authorities appear to lack the motivation to extradite foreigners who commit small frauds at scale. So if you want to steal a few million a year, take it from a few thousand people, a thousand pounds at a time. So long as you stay overseas there seems to be little risk of arrest.
The competition was played out on a “Risk-style” world map, and competing teams had to fight each other for control of several countries, each protected by a fiendish puzzle. A number of universities had also submitted guest challenges, and it was great that so many teams got involved in this creative process too. To give one example; The Cambridge team had designed a challenge based around a historically accurate enigma machine, with this challenge protecting the country of Panama. Competitors had to brute-force the settings of the enigma machine to decode a secret message. Other challenges were based around the core CTF subject areas of web application security, binary reverse engineering and exploitation, forensics, and crypto. Some novice teams may have struggled to compete, but they would have learned a lot, and hopefully developed an appetite for more competition. There were also plenty of teams present with advanced tool sets and a solid plan, with these preparations clearly paying off in the final scores.
