Only God can help us now

Only God can help us now

Speakers: Paula Popovici, Cybersecurity Researcher | OSINT Investigator | Child-Safety Advocate

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=-MdZr4SW8aE

Overview

Paula Popovici's DefCamp talk, "Only God can help us now," delves into the alarming and rapidly evolving landscape of online threats targeting children. The poignant title is not a theological statement, but a direct quote from a parent responding to a survey question: "What resources or support would help you better protect your child online?" This stark reply encapsulates the profound sense of helplessness experienced by many parents, even those with technical backgrounds, in the face of increasingly sophisticated and pervasive digital dangers. Popovici, a cybersecurity researcher, OSINT investigator, and founder of Blue Dwarfs, argues that this sentiment reflects a critical, often unacknowledged, gap between parental awareness and the reality of their children's online lives.

The talk serves as an urgent call to action, dissecting the systemic failures in parental understanding, educational preparedness, and legal enforcement that leave children dangerously exposed. Popovici meticulously details how threat actors have shifted their tactics, exploiting mainstream platforms and leveraging social engineering to transform children from passive victims into "active distribution assets." This comprehensive analysis, grounded in real-world research and alarming statistics, highlights that digital child safety is no longer merely a parenting concern but a critical cybersecurity, policy, and societal imperative. The presentation challenges the cybersecurity community to integrate these child-facing threats into their core threat models, emphasizing that overlooking this vulnerability is not just a missed threat, but an enablement of harm.

Background

▶ Watch: Introduction: 'Only God can help us now' quote (0:00)

The genesis of Popovici's research, titled "Parental Awareness Strategies and Knowledge of Kids' Online Chat Activity and Cybersecurity Risks," revealed a fundamental disconnect. While many parents express confidence in their children's online safety, often stating, "My child isn't smart enough to have anything," or "We've talked about online dangers," this confidence frequently masks significant blind spots. The traditional understanding of online risks, limited to "bad websites" and "stranger danger," has been rendered obsolete by a rapidly evolving threat landscape. Modern dangers include hidden apps that can disappear from home screens, encrypted messaging platforms that evade casual inspection, and sophisticated social engineering designed to mimic friendship, romance, or opportunities.

Popovici's direct engagement with 12-year-olds in a digital safety seminar starkly illustrated this gap. Despite meticulous preparation based on parental input, it quickly became evident that the children operated "several layers deeper" online than their parents realized. They exhibited a nuanced understanding of digital interactions and posed "sharp questions," prompting Popovici to abandon her structured presentation and follow their lead. This experience led to a crucial realization: "Do parents actually know their kids online or just what they want to know about them?" This gap was further underscored when, in a subsequent session with parents, a seemingly simple question—"Do you know how to find hidden apps on your child's phone?"—was met with silence and confusion, revealing an "illusion of safety built on outdated assumptions." Parents often mistakenly believe that if their child isn't actively engaged in wrongdoing, they are safe, a notion that completely disregards the proactive and insidious nature of contemporary online threats.

Key Findings

▶ Watch: Europol: Minors as primary targets for criminal recruitment (12:00)

Popovici's talk uncovers several critical findings that redefine the scope and severity of digital threats to children:

• Children as Active Distribution Assets: Threat actors are increasingly exploiting children, not as passive victims, but as active participants in malicious activities. This is due to their inherent resilience, high distribution across digital platforms, and the trust they command among peers. In the digital ecosystem, this peer trust equates to significant power, which adversaries are adept at leveraging.
• Shift in Attack Surface: The attack surface has dramatically moved from the dark web and fringe forums to gamified peer-trust spaces and mainstream platforms. Games like Minecraft are being subverted, with hate groups initiating ideological scenarios and in-game chats functioning as lightweight command and control (C2) channels—fast, unmonitored, and disguised as innocent play.
• Precision Social Engineering: Attackers exploit children's attention through pings, notifications, direct messages (DMs), and even Apple AirDrop, bypassing both parental supervision and technical safeguards. This is a departure from traditional email phishing, focusing instead on precision-targeted social engineering tailored to young, hyperconnected users. The first compromise is often a "conversation," not malware, leveraging emotional responsiveness and algorithmic profiling on platforms like TikTok, Discord, and Telegram.
• "Digital Natives" Lack Threat Competency: While young people are often called "digital natives" due to their comfort with devices, this fluency does not equate to competence in threat recognition. They manage multiple digital identities but lack understanding of persistent reconnaissance, data harvesting, or social payload delivery.
• Apps as Pipelines for Criminal Recruitment: Europol's findings reveal that platforms like TikTok, Instagram, and Telegram are no longer just social spaces but "active pipelines for radicalization and criminal recruitment." Minors, some as young as 13, are primary targets, offered up to €20,000 for acts of violence, or pulled into drug trafficking, courier roles, and cyber-enabled scams. Recruiters use emotionally charged language, offer belonging, and create a false sense of protection, preying on vulnerable youth. Europol estimates minors are involved in over 70% of current criminal market activities, highlighting a transformation in modern crime networks that leverage these low-risk, disposable assets.
• Open-Source Intelligence (OSINT) from Parental Posts: What begins as innocent content—dance videos, summer memories, birthday celebrations—posted by well-meaning parents on platforms like YouTube, Instagram, TikTok, and Telegram, becomes a critical entry point for predators. These visuals function as "real-time crowd-sourced intelligence," searchable, taggable, and archivable, forming an APT-adjacent threat model. Children, sometimes mimicking influencers, are unknowingly expanding their long-term digital footprint, while parents, "digitally under-equipped," post content that would fail basic vetting.
• Adolescents as Both Targets and Threats: A case in Romania in 2023 involved a minor apprehended for cyberattacks against public institutions, demonstrating that adolescents can be both victims of online harm and active threat actors. High rates of bullying, neglect, and digital escapism push vulnerable youth into spaces where they are easily manipulated or recruited, often through "grooming [that] looks like redemption, belonging, and praise."
• Systemic Failure in Protection: Alarming statistics from Romania highlight the inadequacy of current protective measures. In 2024, 3,999 cases of sexual oppression against minors were recorded, averaging 11 cases per day. Yet, only 534 victims received social or psychological support. Data from the public prosecutor's office shows that across various categories of sexual offenses against minors, only approximately 28-29% of cases are solved, meaning the vast majority do not reach resolution. This signals a system under severe strain, with enforcement capabilities lagging behind the speed and complexity of digital harm.

Technical Deep Dive

▶ Watch: Demanding transparency and accountability on a school incident (19:00)

The technical core of Popovici's presentation lies not in complex exploits, but in the sophisticated application of social engineering and OSINT tactics, coupled with a critical analysis of the technical and legal infrastructures meant to protect children.

The shift in the attack surface is paramount. Threat actors are no longer confined to the dark web but have infiltrated mainstream digital environments. Minecraft, for instance, is no longer just a game; its in-game chats are being leveraged as covert command and control (C2) channels. This represents a stealthy, low-cost method for communication and coordination, perfectly disguised within a trusted, unmonitored environment. Similarly, platforms like TikTok, Discord, and Telegram are exploited for their inherent design features: rapid communication, notification systems, and perceived privacy. The use of Apple AirDrop to bypass conventional safeguards illustrates an understanding of device-level communication protocols to deliver unsolicited or malicious content directly to a target, circumventing network-level defenses.

The primary attack vector is social engineering, employing principles traditionally seen in phishing or malware campaigns: urgency, trust, and validation. These are meticulously tailored to the psychological vulnerabilities of young, impressionable users. Attackers cultivate relationships through shared memes, trending music links, or flirty messages, making the initial compromise a "conversation" rather than a technical exploit. Children, despite being "digital natives," often lack threat recognition competency, failing to understand concepts like persistent reconnaissance, data harvesting, or the long-term implications of social payload delivery.

A crucial technical demonstration in the talk focused on identifying hidden apps on an Android device. While the specific technical steps were not detailed in the transcript, the concept itself is vital. Malicious or grooming applications can be designed to mimic legitimate apps or to simply disappear from the home screen, making them invisible to casual parental inspection. This highlights a fundamental flaw in basic parental digital literacy and device security awareness. The ability to find such apps, even through "simple steps," is a foundational skill in home digital forensics.

Popovici also delved into the legal framework designed to protect children, highlighting its technical application and systemic weaknesses. At the EU level, Directive 2011/493/EU establishes minimum rules for combating sexual abuse and exploitation, specifically covering the use of technology, including online solicitation. Romania has updated its criminal code with Law 217/2023 and Law 424/2023, amending Law 286/2009, which came into effect on January 1, 2024. These changes raise the age of consent to 16, explicitly penalize causing or facilitating sexual acts with a minor, and increase penalties to 7-12 years imprisonment under "appropriate conditions." Furthermore, Romanian criminal code includes provisions for offenses committed through IT systems, covering threats or harassment via digital means.

Crucially, the General Data Protection Regulation (GDPR) EU 2016/679 is a cornerstone. Article 8 mandates parental consent for the processing of personal data of children under 16 (Romania chose 16, while member states can lower it to 13) for information society services. The right to be forgotten under GDPR is particularly relevant for content involving children posted online without understanding long-term consequences.

Despite these legal provisions, Popovici meticulously details significant enforcement gaps, which are fundamentally operational and technical failures:

• Under-resourced Institutions: Police, prosecutors, and child protection services often lack the necessary digital skills, specialized staff, and tools to investigate tech-enabled abuse.
• Evidence Vanishing: Cases stall or never begin when critical evidence disappears in encrypted chats or self-deleting platforms, underscoring the technical challenges of digital forensics without platform cooperation.
• Slow Judicial System: The legal system's pace (months or years) cannot keep up with real-time digital crimes, leading to loss of evidence and diminished impact.
• Lack of Digital Literacy: The law assumes a basic level of digital literacy that most parents, educators, and even some officials do not possess, hindering effective reporting and investigation.
• Patchwork Enforcement: Enforcement varies regionally, with some countries having specialized cyber units while others do not even monitor social media reports, creating exploitable gaps.

These "technical" breakdowns in enforcement mean that despite robust legal frameworks, the practical application of justice and protection for children remains severely hampered.

Demo / Proof of Concept

▶ Watch: Alarming statistics and enforcement gaps in child protection (26:00)

During the talk, Paula Popovici included a short demonstration on how hidden apps can be identified on an Android device. She emphasized that these methods are not advanced digital forensics but "simple steps that any parent can learn." The purpose of this demonstration was explicitly stated as educational, designed to "educate parents and support digital literacy in the home," rather than to fuel paranoia or surveillance. The specific technical actions or tools used in the live demonstration were not detailed in the transcript, but the segment served to illustrate a tangible, actionable step parents can take to bridge the "dangerous gap" of the "illusion of safety built on outdated assumptions." It showcased a practical example of how basic digital awareness can reveal hidden dangers that typically slip past casual inspection.

Defensive Implications

▶ Watch: Q&A: Addressing the 'silver bullet' for digital child safety (38:15)

The implications of Popovici's findings are profound, demanding a multi-faceted defensive strategy across several stakeholder groups:

• For Parents:
• Prioritize Communication: The most critical defense is fostering a "meaningful relationship" and open communication with children, starting as early as two years old. This involves teaching them that messages on a tablet aren't inherently safe or real, and that someone making them feel "seen or special" might be a deceptive catfisher.
• Understand Evolving Threats: Parents must move beyond outdated notions of online danger. They need to recognize that apps themselves can be threats, and that parental control tools are not a "silver bullet" but merely one component of a broader security strategy.
• Acquire Basic Digital Literacy: Learn practical steps like identifying hidden apps on devices. This empowers parents to become "digital force multipliers" within their home security parameters.
• Operational Security: Be mindful of content posted about children online. "Intention is not operational security." Understand that seemingly innocent photos or videos can be used for digital reconnaissance by predators, contributing to an APT-adjacent threat model.

• For Schools:
• Train Educators: Teachers must be equipped to recognize and respond to online threats, including sextortion, grooming, digital manipulation, and harassment. Cybersecurity is a child protection priority, not just an IT concern.
• Integrate Digital Safety: Digital safety education should be integrated across all subjects, not isolated within an outdated IT curriculum focused on basic office software. Digital risk is constant, and prevention should be too.
• Implement a National Curriculum: While Romania's Directoratul Național de Securitate Cibernetică (DNSC) and Ministry of Education have a plan (Planul Național de Redresare și Reziliență, or PNRR) for a dedicated cyber curriculum, urgent execution is needed. Digital safety must become a mandatory national subject.

• For Policy Makers and Law Enforcement:
• Urgent, Measurable Action: Move beyond plans and strategies to implement measurable actions. The existing legal frameworks (e.g., EU Directive 2011/493/EU, Romanian Criminal Code amendments, GDPR Article 8) are insufficient without robust enforcement.
• Address Enforcement Gaps: Invest significantly in specialized staff, digital forensics capabilities, and inter-agency coordination for police, prosecutors, and child protection services. This includes training to understand tech-enabled abuse and how to handle evidence from encrypted or self-deleting platforms.
• Hold Platforms Accountable: Lawmakers must act with conviction to ensure platforms are held accountable for their role in facilitating criminal activities and for failing to protect minors.
• Transparency and Responsibility: Demand clarity, transparency, and responsibility for incidents involving minors online, including detailed investigations, case numbers, and outcomes, as demonstrated by Popovici's public questions regarding the 13-year-olds' incident.

Ultimately, the defensive strategy calls for a shift from reactive clean-up to proactive resilience, acknowledging that "the child is not the weakest link in our security chain, but they are the most exposed one."

Key Takeaways

• The digital threat landscape for children has evolved dramatically, moving beyond traditional "stranger danger" to include hidden apps, encrypted messaging, and sophisticated social engineering on mainstream platforms.
• Parents, even those who are tech-savvy, are largely under-equipped and unaware of the true nature of online risks, operating under an "illusion of safety" built on outdated assumptions.
• Children are increasingly exploited as "active distribution assets" by threat actors, who leverage peer trust and gamified environments (e.g., Minecraft, TikTok) for radicalization and criminal recruitment, as evidenced by Europol's findings.
• Publicly shared content about children by well-meaning parents acts as "real-time crowd-sourced intelligence" for predators, forming an "APT-adjacent threat model" that exposes children to digital reconnaissance at scale.
• Despite robust legal frameworks at both EU and national levels (e.g., GDPR, Romanian Criminal Code amendments), severe enforcement gaps persist due to under-resourced institutions, lack of digital skills, and slow judicial processes, leading to alarmingly low resolution rates for child abuse cases.
• Effective protection requires a shared, multi-stakeholder responsibility: parents must engage and communicate early, schools must adapt curricula and train educators, policymakers must act with urgency and invest in enforcement, and platforms must be held accountable.

About the Speaker(s)

Paula Popovici is a dedicated Cybersecurity Researcher, OSINT Investigator, and Digital Threat Analyst with a profound passion for protecting vulnerable populations online, particularly children. She began her career journey in IT support, where her natural curiosity eventually led her to cybersecurity, a field where she found her purpose. Popovici is recognized for her expertise, ranking in the top 1% on TryHackMe, and specializes in OSINT and digital forensics, skills she uses to translate complex technical issues into clear, actionable insights. She is the founder of Blue Dwarfs, an initiative focused on helping non-technical audiences manage digital risks, and she hosts a podcast aimed at raising awareness for parents and young people. Her work consistently emphasizes the critical need for increased digital literacy and collaborative efforts to safeguard children in the digital age.