Unspoken Security Ep 32: Can We Social Engineer the Bad Guys to Shut Them Down?

Fear and greed have always been in the toolkits for every human intelligence officer in the world. Can I make you afraid? Can I make you greedy? Common social engineering attackers in the cybersecurity world rely very heavily on those two elements because they are the fastest and the cheapest ways to get, to get the ball rolling.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. I've been building and maturing intelligence programs in the private sector for, I don't know, 9 years now, something like that. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga. Go Zags! And I continue to be deeply committed to servant leadership. This podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not going to be the typical polished podcast. My dog makes occasional appearances. She is wandering around someplace today. People argue and debate. We even swear here. I certainly do my fair share. That's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences that we all attend every year. These are the conversations we usually have when nobody's listening. Now today I'm joined by a friend of mine going back nearly 30 years, man. We're, we're getting pretty old. His name's Chris Birch and Chris is an intelligence practitioner cuz he refuses to let me call him an expert. He's been working in intelligence analysis, human intelligence and counterintelligence since the late '90s when we grew up together in the Air Force. He's brought those skills and concepts to the private sector where he's built and led teams that take it to the bad guys. Now he currently leads a team focused on social engineering and active exploitation of threat actors. Chris, anything you want to add to that?

Yeah, actually, the, you know, the reason that I personally don't like to say expert is I think of myself as a lifelong learner. And the minute I think I'm the expert, I get blindsided and I learn something completely new. So that's just my own personal thing. But I definitely call other people experts. I would consider you an expert as well. So just a personal thing.

Nah, and I appreciate that. I'm the same way, which is kind of funny cuz neither of us were particularly humble when we grew up together. So it's funny that the more you learn, the, the more you realize how much you don't fucking know basically. And so, so we end up learning less as we go, or we learn more and we think we know less. It's a, it's a weird way of looking at it. When we were young, I don't think either of us were particularly humble. Sure as hell weren't, I can tell you that. But that's true. True. Anybody who knows us will probably attest to both of those things. So listen, I, I wanna jump into this though. It's a, it's a really interesting conversation. Like you've, you've had a really interesting career. You've done some very cool things. Like you were downrange doing very scary stuff. And, and then settled— well, I don't wanna settle, makes it sound bad, but you, you worked your way into a, a cool gig in the private sector where you also do stuff that almost nobody else does, right? This whole idea of taking it to the bad guys. And so I really wanna jump in though, you know, one of the things you do is, you know, we talk a lot about this social engineering, right? So there's a lot of people with a lot of different definitions of social engineering and how it really works. I kind of want to hear from your standpoint, you know, what, what you think social engineering is, how you define it, and You know, is it legal?

Yeah, so it's a great question, you know, and a lot of the times when I'm asked the question or I'm doing presentations or having any kind of like, you know, seminars or teaching moments, we talk about what is social engineering, where do they come from, things like that. And one of the things that I like to tell people is humans have been social engineers since the day they were born. You come out of the womb, social engineering starts fairly basic, a little crying, a little, you know, being cute at times, crying at times, you know, playing your parents like fiddles. To get food and protection. So humans are well-versed in social engineering, but it wasn't until 1800s that we actually gave it a name. And it goes beyond just like the baby stuff, you know, it could be trying to get a date, it could be trying to get a promotion at work, it could be something as simple as— this goes back to the 1800s— fixing a factory that doesn't work. So that's where the concept of social engineering came from. And when I think about human intelligence and counterintelligence, the concept of manipulation coming up Social engineering is just human manipulation is all it really is. And hopefully you're doing it for good, but we both know, we both know that's not the reality of the world. Every single day there are a ridiculous number of social engineering attacks. I think I saw a statistic the other day, more than 98% of whatever computer security issues have involving some form of social engineering, which makes perfect sense because humans use computers. That's the most vulnerable part of any network. But legal versus illegal, you know, is interesting because we start going into what does it mean to do social engineering in 2025? You know, and, and the answer is the, the social engineering itself, I don't think is illegal. I think it's the impacts and the downstream effects of the social engineering. We, within my group, we like to call, we, we like to call it weaponization and monetization.

Hmm.

I weaponize the social engineering. To go from simply getting you to click a link to clicking a link and stealing your identity, right? We're weaponizing it as opposed to selling you a new car, which is also social engineering marketing. You know, some of the greatest social engineers you'll ever meet happen to work in marketing. So that's kind of the moral ambiguity around it. What are you trying to accomplish? You know, I mean, Shoot, you used to coach. Coaching is a form of social engineering. Getting the most out of your players. The halftime speeches, you know, those are, those are forms of social engineering. And I'm sure someone's going to listen and go, no, that's not social engineering at all. But it is. You're using words and tones and themes to create an action. You are taking somebody who may be despondent at halftime and reinvigorating them to take some kind of action that you want them to take. Play harder in the second half. Drop the ball. Don't get sick during kickoff. Right?

Yes. So old stories for those who don't know, Chris and I go way back. Like I said, in the Air Force and I coached a football team one year on base and Chris was on the team and a good player. Not, not as good as he thought he was, but a good player. Probably, probably our best or one of them at least. But also, well, there you go. I would argue we had a middle linebacker that was pretty impressive, but, but Chris also had a tendency for being a little bit wild. Ended up bringing some risk into the occasional weekend for us. But anyway, we can tell that story later on, I suppose, if people are curious about it.

Getting us off topic.

And people are like, ah, what's this story? Let's go back here. I'm not going to give you that story, everybody, because if you do, you'll probably use it to social engineer us later. But you're right. I mean, you talk about this, like, I think a lot of people think of it, there's a lot of terms to this, right? Like, so social engineering can be something as simple as, you know what, I want to get to the 4th floor of a hotel. I can't because I don't have a key. I don't, I don't belong in that hotel. It's not very hard to manipulate the front desk a lot of times to convince them you're either somebody who belongs there, you just got locked out, you know, show up and, you know, you look sick, you look pregnant. There's a lot of ways to convince somebody cuz people generally want to help other people. You convince them and, and they break down all of their processes for security and suddenly it's like, oh yes, Mr. Johnson, let me help you. And the next thing you know, you're on, you're on the 4th floor. Or something as simple as getting in the elevator and just staying there until somebody pushes the right button and then that's the floor you get off on if you don't have a key card to actually get there. Right. So I mean, there's lots of those little manipulations. There's, you know, social engineering, you know, you can do it with, with customer service, you know, organizations a lot of times to get, you know, discounts or bonuses or whatever. I mean, anybody who's ever, you know, walked up to the line for, for the airline, you know, to get on their flight and, and you, you noticed that the person, you know, at the gate, I don't know, was wearing a, an Atlanta Falcons pin. Since Chris is a Falcons fan, we'll talk about the Falcons. And suddenly you start up this conversation about the Falcons. You don't give a damn. I, I couldn't care less about the Falcons. But you start up a conversation, you get buddy-buddy, and then, oh, lo and behold, you get an upgrade. So I mean, there's a lot of ways to do it, right? Like you said, it's, it's just motivating people. But I think what I want to ask more about when you talk about doing this towards the bad guys is, you know, the deeper components to it, you know, the, the offensive components in terms of cybersecurity, you know, how are you, how are you going down that path? You know, and, and talk a little about the process for social engineering, the people that really are supposed to be immune to this stuff. They're supposed to be the ones doing it to us, not the other way around. You know, how were you able to do some of that?

Well, it's, that's, so that, that's, it's a great challenge and I don't wanna say there's luck involved, but there's a little bit of luck in it because I think the hardest part, you know, I mean, I can go into the weaponization, I can go into the monetization, we could talk about hooks, we could talk about how the social engineering is gonna work. We can, we can get into all that kind of stuff. We could talk about human psychology and how people are predispositioned to be helpful in certain scenarios. But when you wanna think about it from a bad guy perspective, you know, we're going to knowingly go into a threat actor to the bad guy and say, all right, Give me what you got. We want them to come at us. We want them to social engineer us, not the actual customer service rep. There's a little bit of luck there getting ourselves in harm's way. So that's the first problem any organization would have to solve. But once you do that, the scenario then goes into what I call the playing dumb scenario, right? We obviously, we know it's social engineering. We know we're lying. We know it's all fake. We know they're the bad guy. We, we, we have the advantage here, but we need to make them think that they have the advantage. So you come in, you play dumb, you come in, you're overly helpful, you know, you do a lot of rapport stuff. You know, if you think about human intelligence, you know, social engineering, the rapport step, the opening step is really big. You know, you can't just come smashing in there. And I know that's kind of counterintuitive to how some social engineering works, right? Create urgency, create a sense of, create a sense of urgency, immediate requirements. You don't think, you click, and they got you. That's true. That is a very, very prominent and valid social engineering capability or technique rather. But it's all evolved from the classical human intelligence techniques of rapport step. Then I start to introduce, I start to identify motivation. I start to identify what's going to drive you. And then I start just leading you along to where I want to go with this. In the cybersecurity world, these timelines are shrunk. Now, fear and greed have always been in the toolkits for every human intelligence officer in the world. Can I make you afraid? Can I make you greedy? Modern common social engineering attackers in the cybersecurity world rely very heavily on those two elements because they are the fastest and the cheapest ways to get, to get the ball rolling. Mm-hmm. You have kiddie porn on your computer. I'm the IRS. I'm gonna take all your money and secure it. Da da da da. Whatever, whatever, you know, like that's a very common one we've seen where they come in, they, they'll do a Googler shot of your house. They got your PII, they got your personal information from some random breach somewhere. And they're just shotgunning it, right? Well, the first person replies, that's the hook.

Well, it's funny you mentioned that. I'm going to interrupt real quick because I had this not too long ago. I had a friend of mine ping me with this exact scenario. So anybody listening, if you haven't heard of this scenario, it's worth listening to briefly. A buddy of mine pinged me and said, you know, he was worried. Somebody had reached out to him in email and they said, you know, we've, we've been monitoring your computer. We've seen what you've been doing, you know, very vague stuff. You've been doing some, you know, dirty things and we've seen it. And, you know, we've got snapshots and we're going to send it to your family. If you don't pay us, you know, whatever cryptocurrency that they liked that day. And, and like I said, they send you a picture like of your house and your address and some, you know, personal information, which is all publicly available, you know, garbage really. Uh, and this is a guy in our industry. He's a smart guy, but he got nervous and he pinged me and asked, you know, is this real? Should I worry about it? You know, and, and I, you know, explained to him, you know, you don't have anything to worry about. I said, listen, I don't know what you've been doing, but the fact of the matter is these guys are just betting. Everybody's got something they're ashamed of. It doesn't even matter if it's, criminal or not. And he's not, to my knowledge, a criminal or doing anything like that. But, you know, he probably watches something risqué on his computer, whatever. And I said, that's the thing, they're just banking on that. And it's a shotgun. They're going to send out to everybody and then see who responds. And the first person who responds is their victim now. Okay, here's somebody who's got some shame, some guilt, some fear, and doesn't want to get caught because whatever. And it doesn't have to be illegal or anything. It just, it's about how you feel. You know, I used to tell people doing polygraphs, this is pretty graphic. So if anybody wants to turn, tune out for a second. That's fine. I said, listen, the polygrapher doesn't care if you have sex with goats. They care if you care if you have sex with goats. It's, I mean, they might care if you have sex with goats. I'm not recommending it, but the point is it's, it's about your shame and your fear. It's about what you can be leveraged. All right. This, this friend of mine, I have no doubt he's watching perfectly legal pornography. He's an adult. He's watching perfectly legal stuff, but there's a shame and a fear component to it. Now it doesn't matter. It's just as bad for him as if some people are watching things that are very illegal or doing illegal acts. And, and that's the key, like you said, is it's just about shotgunning it out because the stats tell you most people have something they're ashamed of, something they're afraid of. They've done something in front of their computer and that, and you know, they get this letter that says, ah, your camera was on it. We caught you doing whatever the hell it was that you do in your private life. And, and so then they exploit you and if you take the, you know, take the bait, then you're probably gonna end up giving them money or whatever. And then it just gets worse, by the way, for anybody who makes that mistake. If you get blackmailed, it doesn't go away. You're just gonna keep getting blackmailed. I, I'm sorry to say. If they really have something on you, you're just gonna have to live with that probably, because it just gets worse.

Well, and that, and that's, and that's a great example of the fear component, right? You know, I'm trying to, you know, I, in the sense being the bad guy, I'm trying to generate that fear, fear of your wife or husband finding out, fear of your boss or our neighbors or mother or whoever, you know, Sally, brother, cousin, whatever, whatever, figuring out, you know, and I think there's, you know, and, and when you're talking AJ, there was a thought in my head about the duality of the internet. You know, we'll get on the internet and we will scream to the world whatever we think, you know, from the, from the privacy and anonymity of our own home. But when you breach that anonymity and even the thought of that anonymity being breached, we're all very much, ooh, no, no, I'm not interested at all. You know, so, so Johnny likes porn, watches porn 24 hours a day. He's, he may not have an issue with that in the privacy and anonymity of his own home, but when that's suddenly being talked about at church or school or work or whatever, Now it's a big deal. So that's a, so that's a fear factor. Conversely, you know, the alternative to the fear factor is the greed approach. Mm-hmm. We all know the poor Nigerian prince trying to give away money for years.

Yes. It's amazing.

You know, I mean, that guy is still trying. I mean, he's really generous, you know, but people fall for, because of greed.

Yep.

You know, I think I can make money quick. I can get rich quick. Mm-hmm. And what upsets me in a lot of the investigations that I've run, particularly in the last 18 months, I have to, I would say I'd go back even further, post-COVID, I would think. Post the pandemic are the work from home scams. They're actually getting on like Indeed.com and things like that, you know, job sites, and they're offering work from home jobs to do. And it's mostly single parents, desperation, not necessarily greed, but it's desperation, which ties very closely to greed. I need, I need, I need, I want, I want, I want. And they get sucked in these scams. And these are organized, these are organized crime groups, often Eastern European, that are running these scams. And there's, I mean, they're really well done. They'll have portals you log into. They'll have, you know, HR people that'll con— I mean, it's probably like 3 people posing as 10 people, you know, AI now. Yeah. You'll have HR folks. You gotta talk to Sally on Thursday for your HR thing and you'll talk to Bob, your manager on, you know, Friday, you know, so it's really well done and these people will just fall for it. And ultimately that endgame for them is money laundering. Hmm. They recruit you, they social engineer you, you start opening accounts for them, they start money laundering through your stuff. And then you're the one left holding the bag. Yep. So it's really, it's really awful in, in, in that sense.

Yeah. Well, and there's another component that occurs to me. So you, you talk about fear and you talk about greed, and there's a third component that comes to mind that I think in a sense is greed actually, just in my definition. So a lot of social engineering, you know, leverages sexuality. So I just literally today had something happen, you know, I don't know, an hour before we started talking. Well, maybe two, cuz we spent like 40 minutes working on sound today cuz my computer was all messed up. But before we got on, at least I got a message on, it happened to be on LinkedIn. Somebody, you know, messaged me out of the blue and they really enjoyed following me and getting to know me. I've never talked to this person before. And there was just something off about the profile. So I took a look and like, somebody says they're like a fashion designer or whatever, you know, pretty girl. Just didn't make any sense. Not part of the industry. Not somebody I've ever talked to before. And I had a little time to kill. So I was like, let me go down this rabbit hole a little bit. Didn't take long. I'm actually in that process of, I'll probably write something on this, but Next thing I know, I've got 5 or 6 profiles, same company. They're all the same profile, different name, different picture, but you know, the exact same opener, the same background. Boy, you've worked the exact same months and years at all the same places, same titles. This is very interesting. It's very hard to believe that this company has like 6 women, all very pretty women that all have come from the exact same place. They all went to university in Kyiv for some reason. They have all worked in Paris. Very, very confusing and very, very unlikely, right? But that happens because the idea is that, you know, they're going to go after somebody. I would be, I would guess there's a very good chance that every one of these profiles is targeting middle-aged men. If I had to guess, maybe not. I mean, I don't want to judge on sexuality or whatever, but I'm going to guess a lot of these are targeting middle-aged men and somebody's going to take the bait and say, oh, this person's interested in me. And they're going to start this whole conversation and wherever it's going to go. And the reason I say it's sort of a greed factor, and this is, this is probably bending it a little bit. But listen, I'm 50 years old. If anybody's curious, the hell with you if you are, but I'm 50 years old. The 24-year-old European model that just comes out of the blue and pings me, probably not. Probably not. So if you believe in that, there's a sense of greed. They're like, ooh, I deserve this. Now I'm also very happily in a relationship and I have no interest anyway, but there's a greed factor in my sense, in my mind that somebody fools themselves. Maybe there's a pride factor. Maybe there's some others you can talk about. Fools themselves into thinking this is real, right? This is the old honeypot scam. If somebody who— let's be honest with yourself— if somebody who's not in your wheelhouse is suddenly very, very interested in you, it's not real. It's no different than the Nigerian prince. All right. It didn't just happen. You didn't suddenly win the lottery. And this, you know, this person who's been modeling fashion for years and is half your age and doesn't know you at all suddenly is enthralled by you. Seems really unlikely, but it happens all the time and people fall for it constantly because we lie to ourselves or because I, like I said, I kind of feel like it's a greed factor. Like, oh, I, I want this thing that I, I don't deserve. I'm not, I'm not entitled to, I haven't earned it. It's not real. And people get sucked into it all the time. And of course I did respond to her and I'm really looking forward to meeting her now. No, I'm just kidding.

Wedding bells. So it's fun. It's, you know, I'm glad you brought that up because that, that ties into, you know, there's a lot of things that, there's a lot of things we get into the psychology that ties into, but you know, I, when I put my counterintelligence hat back on, you know, I would tell people, you know, if you're, if you're out and about at the bar after work and you've got your intelligence community badge in your top pocket,, you know, prominently displayed in your top pocket and she's a 10 and you're a 2, she's not really into you. She's out to get you, you know, and having that sense of humility, because it's, it's, I think it's ego and id, right?

It's delusions, you know, and men are great at thinking they're a lot more than a 2. Like no guy thinks he's a 2. I know guys who are lucky if they get to be a 2 and nobody, no guy thinks he's a 2. Every, every guy seems to be 2 points above what they, you know, they think they're 2 points above whatever they are. And women tend to downgrade themselves. It's a weird part of the world, I think. But I don't know any guy who doesn't think he can pull 9s and 10s all day long. I don't care if they're just a slug. Like, they can be dumb and ugly and like have nothing to offer. And for some reason they think they're, they're, and by the way, I should stop this for a moment for anybody who's getting offended that we're using numbers to rate people. You get the point of the message. All right. This is, I'm not really trying to go down that path, but you get what we're saying. And if you haven't noticed, we're really denigrating men more than anything in this particular part of the conversation. But There's guys just think they, they're in, in domains that they're not a lot of times. And we're, so we're easy suckers for this. I don't see the, the honeypot, the sexual ploy working as well with women generally. I think women are, are brighter in this area at least.

Yeah. I, I think, I think they're smarter and wiser when it comes to, comes to that. Men, sorry guys, we're, we gotta take this on the chin. Too bad, so sad. We're suckers for it.

Yeah.

We, we, we, you know, like, like AJ, like, like you said, You know, we tend to think of ourselves as the best football player on our team when it may not be the case. You know, we always think we're hotter than we really are. We're more attractive than we really are. We look younger. I only look 25, right? We have these really weird perceptions of ourselves. And threat actors know this, understand this, and definitely will try to take advantage of it. Whether it's a used car salesman, you know, I mean, come on, you know, whether it's real estate, whether it's, you know, You know, no kidding, nation state spy games, you know, coming up to you in a bar in Paris, you know, oh, AJ, you know, what are you doing? You know, it, it, it, it's, it used the right bait to catch the fish you're fishing for. And well, it speaks for itself and it's not just in the cool spy stuff either. You know, uh, you know, it, it's, it's in, it's in scams. It's, it's in, you know, when you look at impersonations, nobody impersonates Jabba the Hutt. They impersonate Princess Leia.

That's a good point. That's a fair point. I've never heard it put that way, but it's, I mean, you're right, right? I mean, there's, I mean, listen, there's psychology. We know this. People who are taller are more, are statistically more successful. People who are considered to be better looking are statistically more successful. Life, life isn't fair. Society's not fair. Social engineers know this though. They're not going to go outta their way to, you know, impersonate the person who's just on stats alone, less likely to be engaged or interested, right? I mean, it's just, it's a thing. Like I know a lot of people who do physical pen testing, physical security testing, and women are really, really good at this. One, because I mean, listen, these women are smart and they're brilliant and they're talented. I'm not taking anything away when I say that. The other advantage on top of it is, is the gender advantage. It is not the reason they're successful. I'm not gonna take anything away from these women. I know some brilliant women. It is an advantage on top of it. They can, they can cry and, and people will, you know, men are suckers for criers a lot of times. They can fake pregnancy, which guys really can't do very well as it turns out. They can, you know, they have other advantages, right? They can do damsels in distress, they can play the sexual card, all the things that men just generally aren't really good at in social engineering. So they have advantages on top of the fact that the women I know that do this are brilliant and very good at it. But it's just a different, it's a different thing, right? This is an area where, you know, men and women act a little bit differently.

The taking advantage psychology, you know, like men and women have different psychology. Are, are we wired differently? We see the world differently. We have different, you know, if you think about our hierarchies of needs, you think about how we, how we operate. You know, there, there are significant differences and pulling strings and understanding how to pull the strings. This goes to what I said earlier, weaponization, right? Every single human being on this planet social engineers to a degree. These incredibly intelligent, incredibly talented people can weaponize that to great effect, you know, and that's, that's where the success comes in. And, and, you know, we're gonna get, we're gonna get heat for this, but men are suckers.

So we're gonna get heat from everybody knows it's true. Like any man who thinks otherwise, it is true.

Anybody upset.

Yeah.

Anybody upset is lying to themselves.

Right. Yeah. Women are gonna love this show. They're like, give it, it's about time somebody said men are stupid. We are, we're, we're, we're suckers. Like, yeah. You know, it's, there's a lot of things that we could be doing better as a, as a, as a gender. But yeah, go on.

But coming, leaning back into psychology for a minute, you know, like, and I, I mentioned Maslow's, you know, and, and there's also Hofstadter's, you know, those are two very powerful psychological tools. I'm gonna call 'em tools.

Sure.

Let's, let's go with that.

They're models, whatever you wanna call 'em.

Something. Yeah. I think models is probably, is probably more accurate. But for those folks listening today, you know, who are interested in social engineering and how the human psychology behind it works, I would encourage you to go look at those. Maslow paints a picture of the basic needs for a human being, you know, with self-actualization at the top, you know, food, shelter, things like that at the very bottom.

Mm-hmm.

Well, as a social engineer, as a threat actor, you know, if I'm not gonna use fear, you know, oh my God, this thing's happening, you gotta do this right now, or greed, whatever. You know, you can look at that and spend some time, some time in targeting, reconnaissance, intelligence gathering prior to the engagement, and find out what in that pyramid is missing. If they're disrespected at work, show them some respect. If they feel like they're smarter than anybody in the room, play dumb and let them teach you. You know, elevate, promote them, and they're gonna wanna talk to, they're gonna wanna show off. You know, if it's Jabba the Hutt, go be, hey, you're so handsome, you're so strong, you're so nice, you're so whatever, whatever.

I like big men without feet.

This is, this is the rapport step. This is the rapport. You're, you're buttering the toast. You're getting them ready to talk. You're get, you're loosening them up and you're skipping the, the snapshot fear greed thing with you see in like, you know, phishing, phishing emails, things like that. You're torn on your desktop, whatever, whatever. And you can have a much longer engagement. Hofstadters is, is, is secondary to that. And I would say that's the graduate level work. And that's where you start looking at the cultural impact on their psychology. Are they, are they a, a more team slash family oriented culture? Are they individualists? Are they high power distance? Are they not? The United States, we are not high power distance. You can call your boss Tom all you want to, right? That doesn't make us crazy. That doesn't, that doesn't throw us off. But if you go to a high power distance culture, East Asia, Russia, those examples come to mind. You'll have 55-year-old men calling their 25-year-old boss, sir. Hey, let's go out. Let's go get it. Let's go get lunch. Oh, I can't do that. That's, that's too crazy. That's, that, no, this doesn't work. So that's, there's differences in culture. Now you can exploit that. So for an example, if you're going to call in, let's say you're doing some call center fraud and you know your target uses an Indian-based call center or an Asian-based call center, come in there hard with a high-level identity. I am the CFO. I am the CEO. I am the top lawyer for the firm. My billables are $2,500 an hour. Just, you know, you can be as rude as and crass as you want to because that's what they expect.

Mm-hmm.

And you are, you are forcing them, you're impacting fear and greed in one big swoop. They're gonna lose money. They're gonna lose their job. You know, it comes in really well. But again, understanding Maslow's and Hofstadter's can, can really help you put those pretexts together to hit 'em, hit 'em where it counts.

Well, and that's a really good point because, so that gets into some sensitive areas for people. Like when we talk about social engineering. I think it's important to remember, because I'm about to dig into some more of this too, what you just said isn't about what we believe or what we think is right. It has nothing to do with that. It doesn't matter. It's what is, and recognizing what is and utilizing that. And it, and that can be really challenging because it gets into discussions of what you're stereotyping people or you're, you know, that sounds racist or biased or whatever it might be. And it's not, it's not intended to be that way at all. There are cultural differences and ignoring them doesn't make you successful, right? As you said. You know, there are cultures where losing face is incredibly, you know, important. And America does not, we want to that, right? Most Americans don't care about being embarrassed in terms of how the rest of the world would look at it necessarily. Shame isn't a really big part of our culture necessarily. It exists, there's a level, but it's very, very different than say, you know, Japanese culture for shame, right? And so, you know, and, and it's the same thing again with dealing with, you know, men and women sometimes dealing with different races within the US, which is what makes this a really challenging place to work, I think, is there's a reason stereotypes exist and, and there are times and places when you have to take advantage of those, at least if you're gonna do social engineering, especially if you're gonna go after, you know, the bad guys, right? Because then you've gotta know their culture and their background. Are they, are they Eastern European? Are they Middle Eastern? Are they US bad guys? You know, what are their fears gonna be? What are their motivations gonna be? Where are you going to, to get inside of their, psyche, right? And be able to, you know, to turn the key to, to get in where you're trying to go. And that requires being brutally honest about our understandings of people. And, and sometimes that, that requires going down paths where I know people who've been in this or have been exposed to it who, who think terrible things of people who do this stuff. And it's like, listen, I, I'm not saying these are right or wrong things, and I'm not saying they're general to everybody necessarily, but if I've done some research on somebody and I have found out what their motivations are, and their motivations happen to really line up well with, with with just a stereotypical version of their gender, their race, their culture, whatever. I'm not going to ignore that just because it's there. Like, I can't be like, well, that's, I shouldn't, I shouldn't do this because it looks bad. That's who they are. I've done the research on it and they, they line up with these stereotypes. And now I'm going to lay into those stereotypes because my job is to accomplish the mission, right? To, to get inside of them, to take advantage of them, to, to turn them to do whatever it is I'm going to try to do, which I'm going to ask you more about. But I think it can be challenging when we talk about these things objectively and openly. To make sure people understand. I'm not saying any of this is right or wrong. I'm not saying this is general to everybody. I'm not saying, you know, these horrible things, you know, other than the fact that they fit sometimes. This is, this is how cultures work. Hofstede is a really good example of that. You know, I've done business around the world and I've said like, if you do business in Japan, it's going to be very, very slow. The Japanese are wonderful people. I've enjoyed working with them a lot, but the Japanese culture is very much about consensus. Even if you're talking to the highest ranking person, in the US, you, you get ahold of the CEO, you convince the CEO, the CEO goes do it, and everybody else just has to follow along. That's how it works. Not in Japan. The CEO could decide on day one they want to do it. It's going to take a long time. They're going to get consensus from other people. There's, it's a way the culture works. And it's important to know those things because it also affects how you're going to compromise somebody, right? Whereas in the US, it's a lot more fluid and things are different and one cowboy can kind of get a whole lot done or a whole lot broken as we're seeing some parts of the world right now. Because the culture is different, right? So anyway, I gotta stop talking and kick it back to you, but I wanted to, to make sure I, I wanna make sure I got that point out that this is, this can get very sensitive and it's, we're not talking about what we think of the world. We're talking about what we know of different cultures and how it fits.

Humans are messy. And when you think about Maslow's, well, Maslow's is much more to a point. Mm-hmm. When you think about Hofstadter's, you know, it's cultural norms. You may find the guy who doesn't fit his culture because he's the anomaly. You know, it's all bell curves, right? It's all bell curves. And that's Hofstadter did, you know, it was lots of study, lots of research, you know, but these are bell curves. You know, the chances are solid you're gonna hit in that middle, and these are what the cultural norms are going to be, you know. And it doesn't matter what their ethnicity is, it's the being part of that culture, you know. So that's, that's, I think that might be another key point there, is it's not about the ethnicity, it's about really being part of a culture. And lots of ethnicities can be parts of lots of different cultures. I mean, shoot, just a few days ago everybody was Irish, right?

So, right. Briefly.

Yeah.

Except for the Scottish. They're, they're always Scottish.

They don't wanna be Irish.

That's true. I saw, that was actually a shirt I saw on St. Patrick's Day. Everyone's Irish except for the Scottish. They'll, they're always Scottish. Anyway, it was, it was fun at an Irish bar seeing that on a shirt. I was like, oh, that's, that's, that's one way to go.

That's a good point. But it's a good point. You mentioned the culture. It really isn't about race, right? I mean, there are countries that are very conservative, right? I think, was it Iceland? I think is known for being kind of stoic, right? And the Fin, the Finns are known for being sort of stoic. You don't see a lot of, you know, worldwide comedians coming outta Finland or Iceland. It doesn't mean there's nobody funny in Finland or Iceland, but their culture tends to be a bit more stoic, right? And Americans tend to be loud and out there, right? That's kind of our known international existence, right? Canadians are notoriously polite. Doesn't mean every Canadian's polite, but I have seen Canadians get in car accidents that they didn't cause and get out and apologize. They're very nice people in general. So it does help to know these things as a place to start, right? And then you got to focus on, I think, your actual target, see if they fit, right?

Yeah, that's when you start pushing buttons and pulling levers, right? You know, I mean, you're trying to get in, you're trying to get the ball moving, you're trying to get things happening. You can't, you don't walk up to somebody like, you know, look at a picture and say, all right, I know these are the buttons to push. Oh, you got to start the conversation. I mean, we talked earlier about bad guys shotgunning it out. Your generic phishing, your generic phishing, that's going to be the most basic level stuff. And really quickly, I'm gonna interrupt myself. Go ahead. That's how, that's how awesome I am interrupting myself. We actually had a significant debate, me and some colleagues, around why is phishing so bad. Because you think about all the phishing education, all the educational material you see, it's always look for typos, look for grammar, look for this, look for that. And it's like, why are they so bad and why do people fall for it? The best theory we came up with, we being the people who were, you know, that I was working with, always looking at these things. Was that it's about numbers.

Oh, yeah.

If I have— if I spent a whole lot of time crafting a perfect message, then I get someone like AJ Nash on my hook, I have a very long road ahead of me till I get to the monetization step. Because he's gonna have scrutiny. I can't pass it off to another threat actor. I can't, you know, well, I'm gonna go to bed, Bob, your turn, your turn to talk to this guy. It's going to be a lot of uphill sledding to get him from hook to, from weaponization to monetization. That's going to take time and effort, and it's gonna be hard. And time is money, and I'll come back to that later in the show, I'm sure. But time is money, so they don't want to have— they don't want to work. Predators are inherently lazy. So if you dumb it down a little bit, if you make some mistakes, if you're not perfect— and I need to actually get one of these guys to confess, but if you're not perfect, the theory stands right today that potentially there's a little bit of intention there because if I weaponize with imperfection, the road to monetization might be downhill, not uphill.

Well, yeah, you're targeting dumber targets, right? It's, it's net fishing versus line fishing. Like, do I want to cast the perfect line with the perfect bait and fight, you know, a, a sailfish for the next 8 hours? Or do I not just throw nets out there and catch all the salmon I can get my hands on? Right. It's, you know, it, the, the sailfish is probably worth more in and of itself, but I'll just take the—

catching the crappy over the tuna.

Yeah. Yeah, that's right. I'll catch the small crappy fish and, and make sense. I know you say crappy like the kind of fish, but I'll catch the small fish and it'll add up over time and it's, it's less effort, right? Than trying to get the perfect one. So, you know, it's the difference between fishing and whaling, right? If, if you have a specific target you need to get, you know, if you have to get the person that you know is, is crafty and is experienced, then you're not gonna get them with the easy one, right? Yeah. But for most it's just like, hey, just throw it out there and see what happens. Email is basically free, right? So you can just send 'em to the world. You know, you mentioned that like 90-some-odd percent of, of all cyberattacks, you know, involve social engineering. And that's because phishing and business email compromise are still the top attacks out there. And it's 'cause you can still send 'em for free. You don't have to put a postage stamp on an email. And so you can send out millions of these things and just wait. And there's a percentage. Yeah. And they got AI to it.

Oh, scalability. Oh yeah. And AI, you know, AI is lowering the bar. You know, we've, we've, I've had, numerous conversations around AI and what does that mean to social engineering. And I always take it back to, you know, let's jump in the DeLorean and go back in time. I take it back to when scripts, you know, like Metasploit, things like that were written, when you started having script kiddies, the birth of the script kiddies, sorry, script kiddies, the level of entry, the bar of entry to get into hacking was lowered.

Oh yeah.

It was easier to get into and be a quote unquote technical hacker and, you know, doing exploitation with software because you had Metasploit, you had, you had tools. People started doing software as a service. People started creating tools and passing those tools around, and that lowered the bar. Talent mattered less than what tools you had access to, what communities you're tied into. And the same thing applies to social engineering. You know, the, you know, the Frank Caliendo or whatever who could do all the voices, you know, that was the OG deepfake. You know, that's how I want to pretend to be somebody else. I got, I gotta do voices, or I have to hope they don't know them and do some other tradecraft. But today you can literally take our image on this podcast right now, our voice on this podcast right now, and come up with whatever you want to come up with. And that's where we're headed. So the bar is being lowered. And so the social threat scape is going to get worse and worse and worse. And unfortunately, I think that the road we're on, and this is my opinion, but see my opinions, the road we're on, that road ends with 100% effectiveness in the deepfake zero percent effectiveness on the defense. And we're going to have to rely on process and policy to protect ourselves from deepfake. We do not have CEOs calling and making— requesting transfers to random people. There's going to be an internal process for that. You will have policies around what authentication looks like. Recognition cannot equal authentication. But the sad truth is, every industry in the world— make it easier for customers and clients, make it easier for people to authenticate. Let's use voice and that's gonna be fine until one day it's not.

No, you're right. I mean, and I've talked forever now ad nauseam about a post-truth world that I think we're, we're heading towards just, you know, very, very rapidly. And AI is a good example. We're already at a point, you know, where it's like, well, was this story true? Wasn't it true? You know, the audio may not be anymore. The video may not be. I mean, we're past the point of just regular old phishing emails. I mean, I've seen scams and I'm sure you have too, where people get on Zoom calls and there's 80 people on the Zoom call and they're all fake. You're, you're the target. Everybody else in that call is fake. It's all AI generated. But I mean, who's gonna, who's not gonna fall for that? If you get into some kind of a meeting and everybody's there, there's dozens of people and they're all interacting and they're all looking pretty realistic and you're the only one who's not, you know, who doesn't realize it, right? You're the target. Yeah. You're done for probably. And that's for sure. Technology's readily available. It's inexpensive. So it is gonna, like you said, it's gonna come down to process. You wanna talk about business email compromise all the time. It's a really stupid, simple scam, frankly. You know, somebody pressures you to do something. Hey, I, I get ahold of the payroll department and I say I'm a C-level whatever, and I need you to, you know, push money right away. And you push back a little bit. Well, this isn't the process. And that guy gets more and more aggressive. And, and at some point the person who's in charge of making the decision on where their money goes has to decide what's more dangerous for my career. Standing up to a C-level who's telling me they're gonna fire me if I don't do what they tell me to do immediately, or potentially creating a fraudulent transfer of money. They're probably going to move the money because they have more fear. I tell people all the time that the solution for business email compromise is A, culture, be able to stand up to senior leadership without fear of losing your job, and B, something as simple as a rotating daily password, which any dope can create, and it could be a passphrase or whatever it is. That's going to knock out a vast majority of these, not all of them, but almost all of them. Just simple as that. I don't care what rank you are or position you are, sir, ma'am, what's the password of the day? That's it. I mean, it's going to vex them, period. And know that you cannot be fired for asking that challenge question. The C-level or whoever it is, nobody has the authority to hold it against you. And as long as that's a policy, most of this business email compromise would just disappear. I don't care how much the bad guy screams and yells and gets more and more angry and more and more threatening. The truth is they're not the C-level. They're not actually capable of doing these things. They'll eventually give up and move on because they can't get past that. And it's a very simple barrier that most companies just don't have.

I mean, you said the word fear, right? You know, we talked about earlier, earlier in the show, fear, fear drives a lot of these, we'll call them incidents, you know, and going to your point about passwords, I mean, I mean, that's pretty, that's a pretty sophisticated answer, you know, like it, but almost every business has Teams or Skype or Messenger or some kind of internal communication tool. Hey, AJ, are you trying to make me transfer a quarter million dollars out of our account? Yep. I don't think that Unspoken Security should be doing that. Oh, you really is you. Oh, apologies, sir. I'll get right on it. I mean, it, that shouldn't be a fearful moment, but in, in too many businesses, too many companies around the world, that is a fearful moment. How dare I? And this goes back to high power distance, low power distance. Mm-hmm. You know, it doesn't scare me to, to, to ping the, the boss, but there are people that terrifies.

Oh yeah.

You know?

Yeah. And I think we're getting worse at that in our culture even. Like it's the, the more American culture has been like, hey, I'll reach out to whomever. But I think we're actually seeing in, in my lifetime, I've seen a shift. I think. People are less empowered for a lot of cultural changes we've seen to do that, right? I think it's, it's more frightening than it used to be to run something up the chain. And, and I think it's gonna get worse. And as it does, I think we're gonna see more of these kind of events actually work because again, what's more scary, you know, risking standing up to the boss or just sending some money someplace? Well, the money went away. Everybody gets compromised at some point. Happens. Companies don't seem to care as much anymore. Well, I'll just raise the prices on customers, whatever. So you're less likely to have a problem if you end up sending money someplace. I think, I think we have to reverse that trend. I think people have to have, you know, an avenue of approach where they're 100% protected because it's in the best interest of the company, you know, to work that way. And if they do, then this really is not a complicated thing. You know, we have all sorts of, you know, 2FA, right? Any sort of, you know, two-factor authentication code that rotates could, could solve that problem. And you just, you just have to be locked in on it and say, this is it. You cannot move money without doing this, this thing. And then somebody has to compromise that. It's a lot harder process.

Well, yeah. And that, and that goes into Social Engineering 101, right? You know, when you think about controls, you know, there is, I mean, this, the, all the best control is, you know, a healthy dose of sca— of cynicism. Mm-hmm. Well, paranoia is like, you know, salt and pepper. Yeah. Salt, paranoia and cynicism is the salt and pepper for social engineering. But every control, every speed bump you add complicates The calculus for the social engineer. I have to defeat, I get, I need an identity, then I need to win the rapport, like rapport step. Then I've gotta know what I'm going after. You know, like, I mean, it's, I mean, I, I've seen, I've seen case studies of social engineers. It was like dogs chasing cars, right?

Mm-hmm.

You know, I'm gonna quote that scene from Batman. I would, you know, when the Joker said, I wouldn't, I wouldn't know what to do if I caught it. That's right. Right. Bad, bad guys who got in and they're like, okay, now what? I don't know how to play the piano. I've never seen a piano. What do I do now? Because they didn't, if they knew how to, they knew what to do, there would've been real damage. But as it was, it was just a, it was just an uneventful penetration, you know, great. Dodging a bullet, right?

Yeah. So I, I want to jump in real quick, uh, cause I, I gotta move on to another question in a minute, but before we do, I, I kind of sidetracked you a little bit when we were talking about, you did, you know, how you, yeah, a lot, right? That's what we do. But how, how you actually apply this to bad guys, right? So again, we're dealing with the bad guys. You know, you, you've talked about, you know, the fear and the greed and, and they're still humans. They're like everybody else. They have the same, you know, weaknesses. But, you know, what are you actually doing, right? You're reaching out, are you, you know, you're getting, you're letting them come to you and then you're turning it around. Talk a little bit about that and, and like how you're, you're actually targeting bad guys with this stuff.

So that's why I said earlier, it's a little bit of luck, right? You know, how do I get, how do I get in their way? How do I find myself connected to the bad guy? And, you know, those scenarios are, are, there's a variety of ways, right? You know, ignoring the luck aspect of it, you know, ignoring that, you know, so let's, we'll go lean on business email compromise because you just talked about, all right. So when a business email compromise message comes in, you know, assuming it's a financial industry, you know, could be somewhat, but largely, it's largely a financial industry. They ping into the bank, you know, hey, you know, AJ Bank, I want to make a transaction. I am, you know, Dog Company, you know, whatever, whatever, you know, whatever, right? And you recognize it. It's, it's BEC, you recognize it for what it is. Maybe it's a lookalike to me. Maybe the language doesn't make sense. Maybe there's some, something about it threw you off. Mm-hmm. You know, so you refer that to your security team. The conventional response is what? You notify the client, you don't do anything, you shut it down, move on, forget about it, whatever.

Mm-hmm.

That's fine. That's a conventional response. That's how grandpa did it. That's how dad did it. You know, that's a Tony Stark thing. You know, that's how, this is the way it's been done. You know, well, what I would suggest. As an alternative would be play along. Let's see where it goes. Of course, we'll make that happen for you. What would you like to do today? How can I help? And they start telling you what they want. I want to do this. Now you have to— obviously, you know, the financial industry has a lot of privacy rules. You have to protect your people, you got to protect your clients, you got to protect your customers, you can't share data, don't give them anything to quote King Leonidas, take, take everything, give them nothing. You know, but let them play, let them play along. And, you know, well, why don't you use, why don't you automate this? If you do it for real, you can have human contact, you can report. So I see that you're from California. How's the weather out there today? Oh, it's great. You can collect information while you're talking. You can elicit from them while you're talking, while they think they're winning, while their greed is driving the train, you can collect against them. What's on the television in the background? Do I hear other people? Is it a call center? Oh my goodness, the call center fraudsters, we bust them so fast because you hear 15 conversations in the background, all very similar. Or it could be a regional thing. The TV is in one language, but the guy's speaking perfect English. Okay, okay, that's notable, right? So you just play through them, you play along with them, you elicit from them, and you have to bury your ego. That's probably one of the biggest points of this. You have to bury the ego because They have to think they win. It's like playing, it's like playing kickball with a 3-year-old.

They, of course they're gonna, no, I'm gonna make that 3-year-old pay. Believe me, I'm not, I'm not letting them win, but you could go all Adam Sandler and catch a ball right in the skull.

Yeah.

I'm not playing kickball with 3-year-olds. I'm winning those. But, but I hear what you're saying. Like, I do this in my private life. Like I get calls once, you know, you get 'em, right? The border patrol, we've, you know, we've seized a package of yours and you're in a lot of trouble. Oh no, really? I mean, I've, I, if I have time, like sometimes I just hang up with people. But right, if I have the time, I'm notorious for it. People will be in the car with me and I'll, I'll play the whole game. I'll run it down and, oh no, this is really scary. And what do I need to do? And, 'cause I wanna catch out what the scam is, right? Whether it's the, yeah, the Border Patrol with the fake package of, you know, whatever they claim it to be.

Buy some iTunes card to pay your fines.

Yeah, exactly. You know, the IRS scams that come up every year, you know, we're gonna send the police to your house if you don't send me, you know, whatever it is. It's always like crypto or some, you know, like you said, prepaid cards. I don't think the IRS works on those, but I'll do it if I have time. 'Cause it's fun. Or the, you know, the old, scam where it's like, oh, we've, you know, scanned your computer and there's a virus and we need you to get on it. That's a lot of fun when you gotta go, okay, I can't understand. You act like some old person who doesn't understand computers and you're like, I don't, where's the start button again? And you run around in circles and then finally it's like, oh no, I have an, I have an Apple, I think. I don't know. Oh. And then they gotta go get a different person and then they get in and you're like, no, no, I, I'm pretty sure I have Microsoft. I don't really know. I couldn't figure out how to turn it on. It's my nephew's computer. Like all this stuff and you just run 'em in circles so they get mad and then they curse at you. And then, and then, well, then the game's up. They get it, they get far frustrated eventually.

We have, we have a joke internally that you, you've not done your job until you've been cussed out.

Oh yeah.

Because then you know, you, then you know you've created an emotional moment. Excuse me, but that's part of the long-term play. Mm-hmm. You know, but along the way you are gathering data points, right? So put your intelligence collection hat on. We're gonna do some intelligence collection analysis here. You know, I'm getting data points, I'm grabbing puzzle pieces from the bad guy in real time. I'm gathering this information and I can take that information and feed it to an analog process and we can do a couple things. 1, improve our detection response capabilities. 2, further attribution, try to see if we can figure out who it is. And I think 3, create some kind of mapping of whatever infrastructure they're using as part of their fraud scheme. Now you take number 3, and any company worth their salt, and you can start executing takedowns, taking away email address, taking away phone numbers, shutting down call centers, you know, whatever, feeding that stuff, you know, not only doing that on your own, but sharing that with whatever governmental body that required is FCC, FTC, whoever, however, you know, and start having an impact. So going back to what I said earlier about time is money, they have to retool, rebuild, re-engineer, do all this stuff over again. And somebody just went, oh, come on, that's too easy. Well, time is money, you know. Yes, it's not costing them dollars, but it's time is money. They might rather play World of Warcraft. They might rather play video games. They might rather go drink vodka. They might rather be out at the dance club, or they might be under intense pressure by somebody who's old and doesn't understand technology and wants the crime to happen right now.

Mm-hmm.

You know, why are you taking so long to get this done? What is wrong with you? Why is this failing? And then now you're creating these emotional moments where the bad guys have to make real decisions about how are they gonna continue. Mm-hmm. They might choose not to mess with your bank anymore, or your, or your company, or whatever, whatever the scenario is. They might go somewhere else because it's just not, the juice isn't worth the squeeze.

Yeah. You're making a difference.

That's the, that's the output.

Yeah.

That's the goal.

No, it's a good point. I had a, you mentioned the cursing. I had a Russian scammer curse me out. It was a couple of years ago now. He asked, you know, he calls up and I don't remember what his scam was going to be, but it was something about, you know, I think it was an Amazon scam or something. I don't remember. But, you know, do you know anybody in Moscow? And I was like, yeah, I do. He's like, no, you don't. I said, yeah, I do. My uncle, you know, whatever I said, my uncle Boris is in Moscow. He's like, no, why you lie to me? And I had just, funny thing is I'd just been to Moscow not that long prior. But so I started talking a little bit about having been there and whatever. And the guy got very frustrated. He's like, Why you bullshit me? You bullshit the bullshitter. All right, you know it's scam. I know it's scam. Just give me Amazon card. I was like, what? Is that how this works?

What? I won. Negotiate a settlement.

I won. And you're just like, no, give me money. That's not how it works. You lost.

That's it.

You got beaten. Like, go away. And he was like, ah, you know, he said some choice words and, you know, went about his business. And it was like the most fun I had all day. And it just showed up like it was a Saturday morning and the guy bothered me. I was like, all right, let's have some fun with him. So listen, I know we gotta, you know, keep this moving along. So we talked a bit about like how you get inside with these guys and, and how you turn things around. And, and the reasoning obviously is so you can better understand the scams and, and, you know, whether it's tracking them down, you, you talked a little bit about being able to do that and understand, you know, what country they're from or, or getting their infrastructure and architecture, or just be able to better report to other people that this is what the scam looks like so they can compare. I mean, it leads to the, to the obvious question, which is with all that experience, you know, what do you think companies should be doing that they're not doing, or should be doing better to protect against social engineering? And, and what is the average person gonna be able to do to avoid becoming a victim of these things?

Well, you know, going back to this earlier, you know, a healthy dose of cynicism and paranoia, right? You know, that, that's obviously good advice. You know, if continue to critically think as you're going through the thing, going through the process. I mean, you mentioned yourself, IRS does, you don't, you don't pay taxes with Apple iTunes cards.

You know, oh no.

The, the sheriff's department isn't going to put you in jail unless you pay them with some Lowe's gift cards, right? You know, there are things that just, that break, break the illusion. You know, it's, it's, it's inception, right? Look for the thing to break the illusion. Ask questions. If it's the actual police, they'll send somebody to you. A cop car will show up to validate who they are. You can call them back. I think that's, that's, and this, and we're talking about victims.

Mm-hmm.

You know, if you're unsure, say, all right, well, you know, who, where do you say you're from? You say from the Hard Rock Cafe? Let me call you right back.

Mm-hmm.

And then call them back, you know, and you'd be surprised how that will unravel these, these, these social engineering attacks. But from an industry perspective, from like a business perspective, You know, I think it comes down to education and awareness, and I break those into two different fields because everybody has education. Yearly, yearly training modules, yearly seminars, you know, whatever the case is. Education's great, but education lasts about two days. You took the, you took the thing, you took the course, you took the test, two days later you've moved on with your life and, and, and, and you're done with it.

Mm-hmm.

Awareness is, is, I think awareness is as important, if not more important, than education because it's about letting your attack service know what it looks like. You know, quite literally, if you think about, you know, going back into the Wild West and the old wanted posters, they put those in banks and post offices because that's where robberies took place. Oh, this guy looks like the guy on the poster. He does bank robberies.

Ha! I should probably rob a bank right now. That's a bad sign for us.

That's probably it. That's probably an indicator, right? You know, in cybersecurity, everyone listening, cybersecurity, we love our indicators, right? And every malware team, every, you know, every, every DDoS defender, constantly sharing indicators. These IPs are bad. This is, this is a bad URL. You know, we're always sharing indicators. Why don't we share indicators for social engineering? Why do we have call centers not told, hey, you're gonna get called by a guy named Bob, he's gonna claim to be this person from this company. That's the, that's the scams we're seeing. Why aren't we sharing that data? Or these numbers or these, you know, I should say accents. That's, that's, that's, that's actually an error, but identify the tradecraft, the pretext, and the things that are happening. Look at the, analyze it, have your security teams analyze it, get the indicators and blast those out to your attack surface. And for those who don't know what I mean by that, where are the bad guys going to come? If you're a Fortune 500 company with an international call center, probably the international call center. If you're a smaller company with an 800 number, probably 800 of them. Look for your attack surface and make sure those people know what the attacks look like. That's, that's, I mean, if I were a CEO of anything, that's, that probably is where I would go with that is strong education and then awareness. What's going on in the world awareness. You know, I remember when I did terrorism work, we had a calendar. Every single thing of note that ever happened in the history of ever was on that stupid calendar.

Sure.

And those would often lead us to, oh, this terrorist cell's gonna do this because of this thing that happened 300 years ago. Yep. The anniversary of whatever is gonna be the anniversary of a guy stubbing his toe. They're gonna attack today because they're gonna honor that. I don't know. But it's about understanding what the threatscape actually looks like and then maintaining awareness what the threatscape looks like. And then giving guys actual timely data they can use to do something with it.

Yeah.

I think, you know, when we were talking earlier, much, much earlier, it's like, you know, if, if the bad guy looks like Big Bird and Big Bird shows up, You know where the bad guy's here, right? You know, so go with that, you know, and, and take steps and take steps to prot— to make sure that people know that it shouldn't be like, you know, hey, AJ, weirdest thing happened today. Big Bird came in to the, to the, to the, to the office, withdrew $17 million and left. It was crazy. And then later I found out it was fraud. And you're like, oh, but I knew Big Bird was a fraudster all along. I should have told you. That's a failure.

Well, yeah, that's an intel failure, right? We talk about that intel failures. Aren't always about the lack of knowledge. It's about the lack of distribution of that knowledge. You know, small group of people that have this knowledge and they hoard it either because, you know, they don't understand how to get it out or you have bad systems in place. Or some people are like, well, it's not perfect intel. We're not sure. We don't wanna be scared, whatever. Or some people just like to hoard, you know, knowledge. And then yeah, as a result, you find out afterwards like, oh, we could have prevented this if somebody had told somebody else, but we didn't.

Right.

You know, we, we were afraid to, or we were discouraged to do it, or we didn't know who to tell cause we don't have our systems in place. Or whatever it might be. And then after the fact you go, well, geez, if we'd only done the thing we were supposed to, we spent all this money and this time and this energy gathering this intelligence, but we didn't get it to the people who actually needed it. Well, lesson learned. I guess we'll make that mistake less in the future. But meanwhile, you know, something happened that was preventable, you know, and, and it happens all the time. Unfortunately, it happens in the government space too. But I think I want to, I want to hit on one point though. You, you mentioned that we're seeing awareness and training, right? And, and listen, like you said, everybody's annual training. And most of it's just junk. And it's no offense to the training companies. It's not your fault necessarily. It's the people, right? I have, I have 4 screens in front of me right now at all times. If I do annual training, it's going to be on a screen over there. I'm not paying any attention to, I'm going to hear it in my ear. And then when I stop hearing things, I'm going to reach up and click the next button. I'm never going to pay attention to it. And then I'm going to keep clicking buttons till I get to the end. I'm going to take the test. I'm going to pass because I've done the same thing for years and years. And you could argue, well, it's because he's an expert. He can pass. That means he has the knowledge. Maybe, but I'm also not paying attention or thinking about it, right? What it should be is that awareness component, which is a cultural thing. Stop doing annual testing. Just get rid of it. It's garbage. I mean, I, it's a check the box thing that somebody had to do for some regulator somewhere, but it's, it's useless. It should be ongoing all the time. Don't do annual training, do constant training, you know, phishing, whether it's phishing training, whether it's, you know, lunch and learns, whatever it might be, something that you can document, but it should be all year long and it shouldn't be— a stick. It needs to be more of a carrot, right? Hey, if you didn't do well in the training, how do we get you more training so you can do better? How do we encourage you to improve? I've talked to people about gamifying training. Hey, let's put teams against teams and be like, hey, you know, the sales team's gonna be up against the marketing team and let's see who, you know, can root out the most phishing attempts this month or whatever the hell the thing is you're gamifying. But make it fun, make it interesting, make the, make it an experience so that people have that, that constant, you know, paranoia you talked about, you know, a little bit of skepticism and paranoia there. That they look for these things, but it's fun, man. If it turns out I was wrong and I challenged somebody and it wasn't fake, oh, okay. Now I'm really on my toes.

I think, I think having a strong sense of, you know, cause I mean, I wholeheartedly agree about culture. Shift the culture and everything changes cuz everybody becomes a sensor. Everybody becomes part of your security apparatus. Mm-hmm. You know, but I think a strong sense of, so what? Hmm. What does it matter?

Right.

You know, what does it matter if I click this link? What does it matter if I put this USB, you know, what, what does it matter? What does it matter?

Mm-hmm.

You know, and getting people to understand why it matters. Cause you know, everyone's in their little silo. Everyone's in their little workspace, right? I work the front desk. I work in the server room. I work here. I work there. I work everywhere. They all have different perspectives of what's important. You know, what's their world changer? Like a server room guy at the fire, if the sprinklers go off by accident, that's bad, right? So that might be what they worry about, right? But the threat applies to everybody. You know, these, these threats, if I want to social engineer the plug in a USB drive in for some reason. You know, it could be a Saudi Aramco scenario, 75% or whatever the report was, you know, I think it was like 75% of their network was destroyed, not compromised, destroyed. Literally, if I remember the data right, the cost of hard drives around the world went up a certain percentage because they had to purchase new drives. The global market changed because of the amount of devastation from a single USB drive that went into a single computer on their network. That is significant impact. If you took a, you know, I don't know, pick a company, Apple, Microsoft, you know, whatever, you know, grab, grab any company, grab any company in the US, hit them with 70% of their network destruction. The losses are catastrophic.

Oh yeah. The stock market would crash. I mean, you're talking about companies that are in the, you know, Fortune 500 that are in the Dow Jones. The stock market would crash and the interoperability, the connectivity between companies. If you take one of these high-tech companies, it's not just them. You know, if, if Microsoft goes down, everybody who's got Microsoft has a problem. That's most of the market, right? The computer I'm on right now runs Microsoft, right? You know, it's not just Microsoft that goes down and we've all moved to like, you know, online versions, you know, 365 as opposed to having, you know, hardware and software on our computers necessarily. If Google goes down, everybody's got, you know, Gmail and, and G Drives and all these things go down. Like it's catastrophic failure, economic disaster of something like that.

Yeah. But it, yeah, so I, I think, you know, when you're thinking about it, you know, because when you think about like networks and network security, you know, we tend to focus on the hardware. Well, hardware is easy. It's predictable. It patches well. It's either working or it's not. Humans are messy. Yeah, humans don't patch well. They don't even when you do patch and they forget it. Sometimes they lose their patch. You know, I've never seen I've never seen a server unload its own patch. Yeah, people, thanks for that upgrade. I'm good, Bob.

I'm gonna opt out of that upgrade and just do my own thing, right?

You know, I was bad. I was patched. I went to Mexico for 2 weeks. I came back. I'm no longer patched. Right. Exactly. Exactly.

You know, so I was patched and I had one too many beers tonight and I'm unpatched. Like it doesn't take much for somebody to lose their, their human version of a patching system. Right. And, and they're just, you know, their inhibitions drop and they make bad choices. And I mean, so it's constant with us.

Humans are easy to hack, hard to patch.

True story. Yeah. The wetware, man. We used to talk about hardware, software, and wetware. You know, people are the wetware and, and it's, incredibly complicated, which is why it has to be that culture. It has to be ongoing and not in a hostile way. You want people to see security as a teammate and a partner, not an adversary that you have to try to trick and outrun, which is the other thing people want to do is they get tired of security. They just want to trick them. They slow us down. They, they scare us. They're the cops, whatever. And then you got a relationship that's really difficult as opposed to, no, I'm here to make things better for everybody and let's work together and have some fun doing it. And if you're not picking it up, then let's find you a better way. If somebody fails a security test, It's my fault, not theirs. Like we gotta do a better job of training 'em. And if they fail all of the tests over and over again, at some point it's their fault. Like some people just can't get it. True. We'll find them something else to do with their time. But in a lot of organizations turn it all on the user and make it the user's fault immediately and just hammer the user. And it's like, you haven't trained them on anything. You haven't given them a chance to succeed. You've made them the problem because you're too lazy to, to solve it and make it a, a constant solution. And you just, you know, find a scapegoat and move on, which is, you know, really sad in my opinion. So listen, I know we gotta wrap up. We're kind of short on time at this point because, you know, we're friends, so we talk too much. I wanna, I wanna get to the closing question though. So everybody knows the name of the show's Unspoken Security, and with that in mind, everybody gets stuck with the same question at the end. You don't get an out on this one. So the question is, tell me something you've never told anyone before, something that has gone unspoken.

I will, but there's one thing I wanna get in first. Uh-oh. The last thing for the last question.

Sure.

Yeah, go ahead.

Evolution. You must evolve. The threatscape's always changing. You have to change with it. You know, if you wrote a, if you wrote a training module 10 years ago and you're like, it's good, you're going into, you're going into battle on a horse with armor and a sword. The world has changed. You got to change with it. So defenders, security teachers, practitioners, all those guys building these courses, evolve, make sure your content stays up to date. That, and then I'll move on to the question. Things that I don't talk, things that I don't talk about.

Yeah.

Well, as, as, as we've established. I am egotistical, or at least I was.

You, you were at some point. You seem to have mellowed a bit.

Yeah.

Yeah.

You know, getting old does that. And I've been all over the world. I've been to combat, you know, bad places. I've been all the bad places, you know, and I'm only afraid of two things. I think one of which is reasonable to be afraid of. I'm gonna, I'm gonna keep that one. But the other one, the other one is I get, oh, it's so bad. And whenever anyone finds out about it, I get so much heat about it.

Now the whole world's gonna know. Well, the 9 people that watch the show are gonna know at least. Centipedes.

Centipedes. I am terrified of centipedes. And you know, it's like, oh yeah, the giant ones in the jungles are like, you know, Vietnam, those giant ones. Yeah. And like Vietnam, Thailand, like those, that's nightmare. I'm, I just, I would die. I would just die. You know, that would, that would be, oh, I'm gone. Just out. No, I mean like all of them.

The household centipedes, huh?

I don't even know why I'm so afraid of them. It's like they got too many legs. That's, that's a fail. That's us. But there's too many legs. Not enough shoes for you. You know, they, they bite.

They do.

I don't know what that's— that, that's bothersome, you know. And I know that it's a real fear because when I see one, I shriek. It's not like— it's not like I'm uncomfortable, right? Like, oh, I don't really like spiders, so I don't really hold your tarantula, but it's cool. I, you know, it's not like that. Like, the uncomfortable is different. This is like, ah, okay, I have composed myself. I am manifesting through sheer willpower the ability to stay here, but I am not happy. I want to flee, you know? And I was on deployment to Colombia.

Oh, I bet they have some there.

Shrieked every time we go to this certain places. I, there, there'd be centipedes on the sidewalk. I'm like, you have to go first and clean the sidewalk. Why? Because centipedes, I can't help it. I was on vacation in Mexico doing some kind of trail hike and there was a guy in the hot, in the middle of the trail. I shrieked and went the other way. I had to wait for my ex-wife to go clear the trail. Now mind you, I would attack a bear. I would fight a bear.

I could tell you're one of those people who actually thinks you could win a fight against a bear too.

Black bear, not brown or white.

Black bear maybe.

Yeah.

Yeah. Black bears are just, they're trash pandas basically. But yeah, don't go after the brown one.

That's what they say. Black bear, you know, if it's black, fight back. If it's brown, lay down. If it's white, you're already dead. So there's no, there's no reason to rhyme.

That's true. No, that's, that's a good point. Yeah. That's a fair point. So I'm curious now, I, I, I mean, listen, and for those who don't know, I mean, Chris said it, like Chris has been in combat, like he has done scary things. Are you also afraid of millipedes or just centipedes?

Millipedes to a much, much lesser degree. Even though they have more legs, even though they have more legs, but they're like, they look like a giant pill bug that's been stretched out. They're not so bad. They're not, they're not as bad.

They're not as creepy.

You can almost, you can almost like put, you know, googly eyes on their little forehead and now they're cute, right? You can't do it with centipede. They got those little red antennae and just, just nothing. There's nothing good about a centipede. I mean, before the bug people get after me, I know that you go centipede.

There's probably something good about centipedes. I have no idea what it would be, but they eat spiders.

They eat brown recluses. Like centipedes are actually supposed to be really good for the environment for, you know, they eat pests.

Great.

But they just need a better PR campaign.

So centipedes, you're desperately afraid of centipedes. So listen, I'm gonna, I'm gonna push this cuz you hinted at, so you're now stuck. What was the other one? Cause you had two fears. You said you were okay with the other one, but now I'm gonna make you sit and tell us both of them actually.

All right. That's fair. That's fair. That's all right. You know, I have a weird fear of aliens.

Like, and that's the one you think is rational. Cause you said you thought one was rational. You were gonna stick with and one was—

let me tell you why. Let me tell you why I think it's rational. The centipede, I know what it is. Mm-hmm. I know there are very few that can actually hurt me.

True.

Yeah. Like the one as long as your arm. Yeah. That's, that's, that's, that's a no-go.

Mm-hmm.

But the average centipede's not gonna hurt you. I can win that fight 10 outta 10, you know?

Yes.

Crush, stomp, twist, step.

Yes.

I feel easy mode, you know? And they're not actively out to get you, right? You know, we know what their motivations are. Eat, sleep, reproduce.

Mm-hmm.

You know, it's pretty easy stuff.

Mm-hmm.

I have no basis for aliens.

Hmm. None.

What do they want? What do they want? What are they after?

You don't have a host study on them. We don't, we don't know their culture. We don't know their motivations. We don't know the Maslows for aliens.

How would it even open the rapport step?

That's, that's true.

Yeah.

How do you even start? Right? How do you, how do you social engineer the aliens? I don't know what they're interested in.

Right. I mean, you know, which, which hole is the, is the ear?

Where's the mouth on this one?

Like, is it, is it probing? What, what, what are they into?

I mean, it's a fair point. You know, it's, it's hard to get started, right? You don't know what they care about. Are they, are they coming in peace? Do they want to eat us? There's a lot in between those things. So I mean, I can see that. Like, I, I get it. I mean, I get it to a point.

Listen, that's why that's why I think it's justified because there is so many unknowns. It's easy to not be comfortable with that. Like I met, I met a true linguist once. Like he was a naval officer, true linguist. And I said, what does that mean? I said, what language? Because I speak all the languages. That's, that's baloney. It's not true. He goes, oh, he goes, I literally can sit down and this is just blew my mind. I can sit down and with exposure I can learn the language. So he could learn a language in a couple of days. So he's an alien. He's definitely an alien.

This guy's definitely not human.

But his, his final explanation to me, 'cause I was like, I don't get it.

I don't get it.

Maybe I'm being stupid.

I don't know.

Maybe he does. He goes, look, Chris, if aliens land on the White House lawn tomorrow, people like me would sit there and listen to them and try to figure out their language. They're the type of people who created the D-Lab.

Hmm.

Interesting. You know, they would be able to figure that out. And I think we, in that movie, was it, was it Contact with Lois Lane and the Hawkeye? Well, considering you just had, you just had, uh, Superman and M*A*S*H mixed in with it, I don't think, I don't know what you're talking about, but there, it was a film with, uh, the actress who played Lois Lane and the Henry Cavill Superman. Oh, okay. And the actress who played Hawkeye and the aliens came and they were trying to fit and they were squid-like. Anyway, sure. There was, there was true linguists in that. She, her character played a true linguist.

Huh. Well, that's interesting. I had not heard of a true linguist before. And, and for those who don't know, Chris and I were both linguists. Uh, that's how we met in the Air Force. I was a very bad linguist, but we were anyway. All right. So centipedes, you're, you're definitely afraid of, and that's completely irrational. I agree. Aliens you're afraid of. Yeah, it could be more rational. Makes sense. At least it's, it's a, it's an unknown, you know, anytime centipedes have never kidnapped anybody, just leave it at that. Not to, not to my knowledge. I would have been beating anybody up or probing anybody or, or anything of the sort. You know, aliens perhaps, we're not, we're not sure. I mean, there's lots of evidence now that the aliens seem to exist. At least we just don't know what they want. So, I can see why there'd be a fear. Yeah, I can see that. So, all right, listen, I'm going to wrap it up here. This has been a really fun episode. I figured it would be, you know, it's nice to catch up, man. And, and so, you know, we got a chance to talk about social engineering and how you actually social engineer the bad guys. And, and that's a really interesting thing. Is there any last words? You already screwed it up because you did it, you know, you interrupted your own exit with your last words, but do you have any other last words you want to add to this before we close it out?

Like and subscribe.

Ah, see, I love that one. This is my guy. Welcome to marketing. So, Yeah, Chris is right. Listen, if you like the show, you know, please, you know, give feedback, subscribe, you know, tell your friends and neighbors, spread it around. I'd like to get this, you know, the audience continuing to grow so we can have more people on this. You know, it's still ad-free right now because I can, but eventually I may have to start putting ads on if I have to start paying for this thing. But I appreciate it. And if you don't like the show, you know, shut up or go to something else. It's free. So, you know, it's, I don't care that much. No, I do care if you don't like, if you got ideas for making it better, obviously let me know. You can email me at aj@unspoken Unspoken Security, or, you know, leave notes wherever the hell you're downloading this and listening to it. But I appreciate you taking the time to come in and listen and talk to, you know, and hear Chris and I talk about, about these things. And we're going to have more good guests in the future. So, you know, until next time, this is AJ Nash. I'm just going to shut it down here for Unspoken Security.

Thank you for having me.

Thanks, man.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.