Unspoken Security Ep 38: Why is Fighting Cybercrime Worth the Effort?

We're using GenAI to talk, like follow these conversations. You start the scam, scam might be like a high, might literally be a high, and then it turns into a, you know, eventually turns into a romance scam.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hello and welcome to Unspoken Security. I'm AJ Nash, your host, as you know. And you might see that we're coming from a different location. This does not look anything like my normal studio because we are at RSA Conference live. It's pretty exciting to be out here this year. As usual, huge conference, a lot of people, 45,000, 50,000 probably paid. And so we wanted to do a special episode out here of Unspoken Security. Again, my background for those who are new to the show, about 19 years in the US intelligence community, counterterrorism, counterinsurgency, counter-trafficking persons, chased war criminals for a while. Been in the private sector about 9 years, primarily building intelligence programs, doing a lot of that thought leadership thing, public speaking, podcasts, obviously. I also have a background in servant leadership with a master's degree in organizational leadership from Gonzaga. Go Zags! So I'm very passionate about that. And this podcast brings all of these things together, all these professional components I was just talking about and the human components., and we talk about what really matters in this industry. It's meant to be unfiltered conversations, really just what we normally talk about when nobody's listening, right, at some of the conferences that we go to. And today I'm really excited because the guest we have today is Robert Duncan. Robert's the VP of Product Strategy at Netcraft. And Robert, tell us a little bit about yourself.

Oh, thanks, AJ. Great to be here. So I've got a bit of a boring but, but interesting background. So I studied computer science, graduated straight into cyber. I, I felt really passionate that I wanted to combine technology with doing, doing good, and it was a really great way to combine both of those things. So I was able to use my engineering skills and then be able to combine that with how I combat crime, think about threat actors, and then combat that on the internet. So that's really what I love doing. I played a really broad variety of roles. I've been here 15 years. I've done everything from cyber pentesting. I've been cleaning the toilets.

I feel like that might be a little less exciting.

Yeah, I won't give you the full story, but yeah, I'll ask some of my colleagues.

I may want to know that story.

Maybe back at the end. But yeah, I've done everything. So I've had a variety of roles and been kind of scrappy and enjoyed playing those roles.

Very cool. And so today we're going to talk about the topic for today is why is fighting cybercrime worth the effort, right? So listen, cybercrime, there's a lot of talk about it here, obviously at RSA conference this year. There's talk about it everywhere, right? It's been around Well, as long as there's been cyber and as long as there's been criminals. And we're all really familiar with it, but it just seems like, it seems like an endless contest, right? There's billions and billions of dollars in fraud, criminals are everywhere. I've seen some organizations, it just feels like they're sort of giving up, but I know this is a big part of what Netcraft does, so, you know, topic as I said, why is fighting cybercrime worth the effort? So, let's jump in though and talk about cybercrime first. Like, what are the most common forms of cybercrime, you know, that we're talking about?

I mean, your list is endless. So you, I mean, you can think about some of the most, the most obvious things. So thinking about breaches, ransomware, data theft, but then you've also kind of got the, the financially motivated crime. And that's primarily kind of where my most of my experiences is thinking about how threat actors use the internet to benefit financially. And that really, there's a few different ways that happens. So I mean, I've been here 15 years, I've, I've worked at the same place The things I've seen, so things like stay the same, but change every day. So it's the same threat. Criminals, bad actors, they want to make some money, they want to use the internet to do it. It's a great place to be a criminal. You don't get caught, you can make loads of money. And if anything, you— it's a growing industry. Like, if you look at the FBI IC3 report that came out maybe a week ago, 2024, The numbers are up. They're not going down.

Every year.

They're going up and up and up. They're not going down. And then thinking about like how that manifests itself, there's things like investment scams, there's the kind of bread and butter phishing, fast fee fraud, the Nigerian print scam. We still see that. Like it still happens. It still works. Your malware, your ransomware, your C2, romance scams, pig butchering. The list is endless. And really there's a few different things the way we think about it. How— well, the way I think about it is, how do you take that insight? How do you find these threats and actually do something interesting with it? It's somewhat— it's great to know what's out there, it's great to detect, but you actually need to do something. And that's kind of where I've really relished being able to take both components of detection and countermeasures. So being able to actually go out to providers and say, hey, we found something bad, don't you want to do something about it? And the, the kind of experience I've had, we're not— I've heard, I've heard us referenced as the cyber police by some really happy customers, but we are not the cyber police. We ask nicely, and sometimes that works and sometimes it doesn't work. The nice thing about how we work is that we— certainly the way I've seen us being successful is playing that, that whack-a-mole game. I mean, I don't know what you've heard, AJ, but whack-a-mole is— I actually embrace the term.

So you are the exception then.

Everybody says, oh, we don't want to play whack-a-mole. That's not what we want to do. Well, like, if you don't play whack-a-mole, what, what game are you playing? Like, that, that's actually the, the kind of flip side of that.

Yeah.

If you— there's like no law enforcement agencies would be saying, we're not going to play whack-a-mole with criminals. We're not going to play whack-a-mole with With crime, you know, with financial crime, that, that doesn't happen. I don't know why you would say that in cyber. So actually what you want to do is you want to be really, really good at playing whack-a-mole, and you want to change the odds in your favor. You want to change the game. So you don't want one player, you want to multiply a whack-a-mole. You don't want the game to be, you know, in the criminal's hand. You want to switch it to your way. Well, I mean, that's a good point. You know, everybody—

listen, you are the outlier here. Most everybody says, I don't want to play whack-a-mole, right? It's, it's difficult. It's endless, the mole's here, then he's here, you know, the whole concept, right? But I think you made an interesting point, and that's because it's always one-on-one, right? If you play a team game of whack-a-mole, listen, if there's 9 holes with 9 moles possibly coming out, and you have 9 mallets with 9 people, that's a much better game to play at that point. That's not how the game's designed, so if you're redesigning it in the cybersecurity space, cybercrime space, then yeah, it's a pretty good place to be, and it should defer future criminals, or deter, I should say. The idea is to make this less desirable, right? I mean, I wrote an article a while ago that said, is cybercrime a viable career choice? Because, you know, we have a whole generation of people coming up who've got a lot of college debt. They've gone through school, they've done all the right things, made all the right choices, they have all those skill sets, and then the job market's very difficult. Meanwhile, cybercrime, as you said, the odds of getting caught are incredibly low. It's less than 1%, really, and even less in terms of being prosecuted. Yeah, it's fractions of a fraction of a percentage. So I posited the question, at what point do these young people who spend all this money and have all this talent and don't find career paths say, hey, I'm just going to go into cybercrime? And so we have to make it less palatable, which means a lot, as you said, a lot better game of whack-a-mole, right? Make it more risky for criminals, you know, those that are within jurisdiction that could be handled, obviously.

Well, that's actually the interesting bit, because if you think about, oh, there's no point, you know, everybody's in Southeast Asia, or if you're talking about certain types of scams, what's the point, you know, you're never going to stop them, it's their whole, you know, you know, it's larger than their legit economy, right?

Sure.

So that's actually an interesting question. It's like, well, what does it matter that they're in a different geo? Well, if you're playing the, the changed whack of the, the multiplayer whack-a-mole, if we change the rules, if you actually think about a kind of the kill chain model, you actually want to be able to hit every part of the kill chain.

Sure.

And some of them will fail. Like, certainly whenever I speak to, to partners and And part of my role is I work with loads of these infrastructure providers, the kind of domain registrars and the hosting companies. And they're actually saying, well, you know, we don't have a legal obligation to do what you're doing. You know, you're— we don't want criminals on our platforms either.

Sure.

And so you do find providers that have that attitude and they're great. That's great. Sometimes even if they have that attitude, they might actually struggle. And the volume is just so large they feel like they can't do anything about it, so they don't bother. That is something— that's an attitude that we can change. And certainly with sharing threat data, we share threat data with providers like that for free. Yeah, because it's, it's in our interest to do that, like, from a kind of commercial perspective. Like, we want threats to be taken down, so we share some of that data with providers. And the providers that do react to that, they they say, great, thanks. That's helpful. We can use that data for our own platform and make it a safer place to be. And there are loads of crime-as-a-service platforms that aren't deliberately criminal. They try to do a takedown. They say, no thanks. No, they say nothing.

Yeah, they don't even respond, right?

They don't respond. It's a demo. Sure. You're not talking to anybody. They say nothing. But because of the way we're playing, we changed the game. It's the multiplayer whack-a-mole. We've changed it. There will be some providers that will take action. There's not one provider you can talk to and they say no, and then you think, okay, well, I'm just gonna stop. Right, right. You wanna talk to the— and if you're talking about like a domain-based attack, say you're using a web hosting provider that's deliberately criminal, they're not gonna, you know, Proton 66, for example. Exactly, yeah. So great, okay, well, we're not gonna have much success there, but you know, the domain registrar you've picked, oops, you know, you've just picked one of our customers, and as soon as you, as soon as we find an attack, great, it's gone. And then, okay, well then, you know, you say, okay, attackers are going to adapt, they're going to pick a new registrar, and yeah, they do, but we adapt too. And it's a cat and mouse game. I think everybody in the industry realizes that it's a battle. You're not always, you know, sometimes you're a step ahead, sometimes you're a step behind.

Sure.

Well, it's a tricky game. It's a game. It's cat and mouse. And I certainly, that's how I see it. I don't see it as a game that we can win. I see it as a game that we're gonna, like, law enforcement isn't a game that we're gonna win.

Well, I mean, that's a good point, right? People talk about wanting to win, and I think, you know, I have seen people who just talked about, you know, it's pointless, it's fruitless, let's just give up, I can't do it anymore. But you make a really good point. That's not how we do anything else in the world. Law enforcement, we don't— crime hasn't ended. There's no city that says our goal is to have zero crime. It's not realistic. But if you just said, well, we're not gonna bother to try to stop any crime because it's just too hard, you'd certainly have a lot more crime. So, you know, the idea is to continue to make it difficult, to make it more expensive, maybe to steer, you know, some crimes should be harder than others to accomplish so that, you know, you steer people away, which, you know, makes me think like in terms of types of crimes, what are the most difficult types of cyber crimes to defend against and how are we succeeding or failing against those right now?

That's a good question. Where I've had experience being really successful is like described when you've got providers that are willing to take action. You can detect attacks. I think things like phishing, I think like the, the bread and butter fishing still works, sure, but it's well, well understood. You can explain to somebody what phishing is, which is good. Yeah, some of the types of attacks that we deal with are pretty hard to explain.

Yeah, SQL injection, man-in-the-middle, yeah, not as easy for, for Grandma to understand at home, for instance.

But one of the examples I come across a lot that's harder to explain that we see quite a bit is a shopping site gets a digital skimmer, some JavaScript, so they're using a vulnerable version of WooCommerce or something like that. They've been compromised, somebody's installed some JavaScript, you know, steals credentials, steals credit card numbers. That's actually sometimes pretty tricky to explain to somebody, hey, there's nothing wrong with my site. It's great.

Your site's great, but—

It's working great, but— 'Yeah, by the way, criminals have got access to your customer data. You're probably gonna have a bad time.' And actually, where we've been— I mean, that's hard to explain, but once you've done that, you can actually be really successful, and you can take the kind of time of exposure down from days and weeks down to hours. And that's really, like, great because that's massive. Yeah, a load of people. And that's an attack that's— I guess maybe it's, it's like low to medium complexity on in terms of attack complexity. But from a victim perspective, it's actually really hard. You don't know that you're gonna be a victim. That phishing, you could say, okay, well, we can go for user education. You can say, well, I mean, I don't— I'm very against victim blaming, but some people will say, oh, you should have known better. You should have, you should have said, oh, you know, it's, you know, paypal.login.fish.com. You shouldn't have typed in your credentials. It's on you. But for this, that type of attack, you know, you're on a legit shopping site. You have no idea your credentials have been stolen. And so those are harder, but maybe I'd set it at medium. The really hard stuff is the types of scams, the investment scams, pig butchering, the job scams that we're seeing. Those are happening on platforms. Those are happening on things like, like RCS, SMS, email, WhatsApp, Telegram, Signal. Those are happening in conversations with individuals. It's like one-on-one. You can't use the same threat intel feeds. They don't exist, right? They're encrypted, they're deliberately peer-to-peer, and those platforms are proud that they deliver those secure communications, but it comes with a price that the communication isn't visible. Sure. You can't go out and say, hey, I'm interested in finding a load of— I mean, take PayPal as another example— a load of PayPal phishing sites. Great. Well, you can actually go out and explore the internet and you can find those.

Sure.

You can't say, hey, I want to go and find all of the job scams that are happening, they're impersonating PayPal. You can't do that. That doesn't— that data—

there's no database.

That data does not exist. Those are really hard to find. Once you've found them, you know, you can go through the same process and actually say, well, okay, can we take this down? The answer is yes, you can, but you have to have found it. Yeah. And that's actually really hard. Some of the research that we've been doing. So we've got a team that I work with doing AI-based, effectively like honeypotting plus plus.

Oh yeah.

So we're using GenAI to talk, like follow these conversations. You start the scam, scam might be like a hi, might literally be a hi, and then it turns into a, you know, eventually turns into a romance scam. I'm sure we've all received those and I've fallen for a few of them.

Yeah, they're fun. It's quite fun. It's a hobby of mine when I get those hellos and, you know, oh, I'm sorry, it was the wrong number, but we could be friends. Yeah, sure, we could be friends.

Let's have a chat.

Right. I love doing those.

I've never been to San Francisco. What's it like?

That's right. Yeah. Oh, there's a party on a boat coming up. I love this. I've entertained plenty of people watching me do this on Signal or LinkedIn or wherever it might be. Right. It's a lot of fun to play it out if you know what you're doing, right? Play it out and have fun with it. But it also works for a lot of people.

The really sad thing is that it works. And I've heard victim stories of people who've lost hundreds, tens or hundreds of thousands of dollars into these scams because they're really effective. It's social engineering and it's really effective. Yeah. Turns out people are both the problem and the solution. Like, social engineering works really, really, really well. And especially if you can pick the victims. And like, for example, like exactly that scenario, like I've played along with these scams and guess what? I get a load more.

Oh yeah.

Because they share data. They say, well, this person responded, this person, like, they're called sucker lists for a reason. Like, people fall for them and then you then get targeted again.

That is the downside of playing along. Yeah, I do find I get a lot more of these emails.

I should not have used my— I should have used a burner phone. I should not have used my own phone number for those. But anyway, I have. So I'm like a honeypot anyway. But yeah, we've used AI to do that in a way that we probably couldn't have done 5 years ago, because it, you know, it would have been expensive human time to actually follow along with those scams, and it's not scalable. Yeah, pipe it into an AI model. I mean, I'm not saying it's easy. Obviously, we've spent quite a lot of time, right, building this. It's not easy, but it's possible. It's possible. And then once you've done it, it's scalable, and you can actually say, well, I want to continue these conversations. I want to find out what's happening in these scams. You obviously don't see all of the scams, but you can actually find out what's happening. And what's really great is that you can get some really great intel because, A, you can see what the scam is. You can find out, you can see all the IOCs, the indicators, you know, they're using this email address, this WhatsApp number, this Telegram number. Great. But you can actually get to the end of the scam. That's really cool because then they're asking you for a gift card.

Oh yeah.

Send, oh, please send me, I mean, this is maybe more in a business context, but it's like, hey, I'm, I'm, uh, I'm the CEO, I'm in an urgent meeting, please send me $500 in iTunes gift cards. It's probably not called iTunes anymore, but you know what I mean.

Yeah, Amazon, all the gift card scams, right? Yeah, exactly. Like, okay, great.

You know, I'm surprised that— again, I'm surprised it works, but obviously it does.

Yeah, well, and they're smart, right? I mean, I've seen stories— actually, it just happened, so I'll give an example, right? With my company, first time I've hired somebody, right? Part-time employee. She's fantastic. She hadn't been hired for I don't know, a couple of days maybe. And she, so she messaged me and said, hey, I got this, is this from you? Because the announcement had gone on LinkedIn that she joined the company, right? Well, and people wait for that. So yeah, she had gotten a scam that had been sent to her saying, hey, this is, you know, this is AJ, I'm on a different number for whatever fake reason it was. And it was just the entry, they hadn't asked for anything yet. And so she pinged me, I said, no, it's not me. I explained the scam. I said, yeah, that's not me. She's like, I don't even know how they got my number. I said, because your resume probably exists someplace and we posted that you just joined the company. This is a really common scam. They get new employees because new employees don't know. It's like, oh, welcome to the company, et cetera. And then suddenly it's asking for something, right? And yeah, it doesn't work for everybody, of course, but they're smart enough to connect those dots. They'll watch LinkedIn and see who's joined a new company. They have org charts, they know who works where. Same thing, you know, you get to the tax season, right? They know who to go to in payroll, pretend to be the CEO. I need a whole printout of everybody's, you know, W-2s for the year and I need it immediately and work on pressure and get people to give these things up. You know, the OSINT works everywhere. We do OSINT, so do the enemies, you know, so do the bad guys and they're really good at it. And so as a result, the targeting is good, which makes it a more believable scam, right? Which is how things like business email compromise do. So everybody talks about ransomware, but BEC is like 10 times worse financially and probably easier to stop, frankly. But that's why, right? Because these adversaries, they're not dummies. Like we're not fighting against guys and gals who don't know what they're doing. This is a wise opponent who learn and continue to iterate. I imagine AI— why, no, actually AI is a part of their world as well, right? Yeah, we're not the only ones using AI.

Well, there's some really cool examples of some of the stuff that we've seen. So some of these conversations we have, like when you get to the end of a conversation, maybe it's a gift card. Sometimes they'll send you crypto, you know, Bitcoin wallet address. Other times they'll send you a bank account and say, please wire me some money. Great. You know, great. Old. Super. I mean, it depends which year you're in. Like, like in the US, maybe that's, that's, you know, that's old hat. But like in Europe, they're the instant payment, faster payment. So once, once criminals receive the money, they're off.

Yep.

We see that quite frequently. We see thousands of mule accounts. So these mule accounts coming through these scams, because we're using AI, we can do this at scale, which is cool. But criminals are using AI too, and we're pretty confident. We see the really obvious indicators. Is like, as a large language model, I can't, you know, I can't respond to that. But, you know, you also see some like more subtle indicators. Like, for example, we say in these scams, you might say, okay, please, you know, they get to the end of the scam and it's like, please wire me $500. And that's the start. Like, that's their build after that. That's the kind of start amount of money. What we've been able to do is actually say, oh no, it didn't work. Please send me another one. We've got 17 in one conversation. Oh, nice.

And they didn't catch on that you were dragging them along.

We don't think it's a person.

Oh, right.

It's an AI. It's an AI. Yeah.

So, well, it's great for collection.

They're happy to— yeah, happy to keep going and feeding more. And it's like, great. Like, this works really well for us. I mean, it's either AI or it's, you know, in the scam compounds, it's not one person, right? It's, you know, there's 50 people and they're on shifts and you see that behavior. It's really both scary and like interesting at the same time. Like, it's something where I feel really passionate that we can protect people and potential victims from doing this by, by using technology to do cool stuff. And I think that's where I think it's really important to remember that, like, for example, if we, we didn't play this, you know, whack-a-mole game, are we happy that, that people can be victimized like this? And we're just gonna say we can't do anything about it, we can't, we can't take it to zero, therefore we shouldn't bother, right? It's ridiculous. I don't think that's a good idea. Like the broken windows theory, like, like kind of theory that once you see one broken window, you're kind of letting yourself in for more.

All right. The neighborhood. Yeah.

The neighborhood crime theory. Yeah. You go down, you know, one broken window, you leave it alone, you know, you end up with thousands of broken windows and you're— Yeah. The same. I think the same principle is true in cybercrime. If you don't defend your territory, you've got the same problem. And like, that's part of the story for why doing this, this take analytics obviously you want to do everything else as well. You want to do all the threat intel, you want to do the collection of phishing kits and analyze those and see what's going on, look at TTPs, and you definitely want to do all of that. And I'm very, very much in favor of doing that, and then like a lot of experience doing that as well. That's where you find cool— maybe cool is the wrong word— like, but interesting, you know, interesting developments. You know, you see phishing as a service platforms using like, they're not just PHP anymore. You know, you've got modern platforms using Docker and JavaScript, Node, and you know, you're using the same modern technologies that everybody else is using. You've got criminals using it too. And you see, you see all of that and you look at disruption and you look at disruption, disrupting groups and everything like that. But if you're not doing the bread and butter, we found a threat, let's get rid of it, let's make their lives more difficult, you end up in that same broken index.

Well, yeah, I mean, the hope is, you know, obviously as a guy with an intel background, I talk a lot about proactivity, right? And the only thing that is proactive is intelligence. So the goal is to get ahead, but that doesn't mean you're ever going to stop everything. That just isn't how it works, right? Ideally, if you have intelligence, the more you have, the better, hopefully, and you get more proactive and you're able to prevent things from happening, right? So you wanna get earlier and earlier in that kill chain, right? Ideally, you know what the adversaries are talking about and thinking about before they do anything and you can stop 'em. You know, the next step, maybe they've registered a bunch of URLs and you see those and you lock those out. But there's always things for down the line and you can't just say, well, it got past the first few steps and now that's it, they're out in the wild, you should ignore it. So you also have to be able to do something on the backend to say it's out there, we gotta knock it down, push 'em back to the start, you know, and keep running that game over and over again, right? And it's an entire ecosystem of defense, right? Everything, you know, everything proactive, everything reactive and everything in between has to get accomplished. And as you do the reactive, as you do a takedown, they just go back to start. It's not like they just appear, they're gonna go right back to start and start over. Maybe Intel will pick 'em up next time. Next time as they try again and you get them earlier. Or maybe it goes all the way to the end and you've got to do the takedown again.

There's a business element here too. Like, you can use all the intelligence in the world and the answer from the— the final answer from the intelligence is don't have any customers. Or the answer is, you know, there is a risk appetite. And in order to do business, there will be some acceptance of risk. And you do everything you can to mitigate the risk, but sometimes you want to have a balance and you want to say, actually, no, I can't— like, this is the kind of story with deploying passkeys, which are great. Like, you know, everybody should be using passkeys.

Sure.

But, you know, do— is everybody and their grandma and their kids, are they all going to be able to use passkeys to access their bank accounts? Maybe someday. Yeah, maybe, maybe, you know, as the technology builds. Yes, maybe. But in the meantime, you need to be able to say, well, okay, the, you know, we're not going to accept the risk we're going to not accept the risk of losing those customers because you can't bank with us because you won't use a passkey. There will be an element of saying, OK, well, we're going to accept the risk that we know that phishing can happen. We know that the way we're using, the way we've deployed technologies, but we've got all these other mitigations in place, which is great. And thinking about that and then extending that, some of the cool technologies that we're really excited about in defense for using AI and GenAI is also being used by criminals. Sure. They're saying, great, that's a really cool tool and it's really useful. It works for both.

Well, yeah, it's cheap, you know, it's effective, right? I mean, we've seen, you know, phishing emails have gotten way better, you know, with AI now. It used to be incredibly easy, frankly, to understand a phishing email. It was clearly somebody whose English was a second language or a third language or or whatever. It was very broken. And then, you know, that started to improve just with things like Google Translate. But now, you know, AI can do amazing things. Somebody can sound like from almost any country they want to, in any tone they want to.

Personalized.

Yeah, very personalized. And now, you know, agentic AI is going to be next. So they'll have people, the agents actually do it all for them and run the whole thing. And so you're going to have, you know, these, the pig butchering scams, for instance, where you have these farms of people, sadly human slavery usually, in like Myanmar, right? And so For anybody who doesn't know, if you're getting hit with a lot of these scams, these texts or emails or phone calls or whatever, listen, these people aren't— most of them aren't doing it of their own free will. So I have some empathy. Obviously, I run out eventually. I get tired of the scams, but I have some empathy. But they're also going to be replaced by AI because that'll be even cheaper and more efficient, and we'll see even more of this. And then so it's going to be this AI versus AI battle of how do we have more technology to stop these things before they get through as they continue to make better and better technology and use the same technology to make better and better scams. So it's this endless cycle that's always gonna require somebody to have knowledge and expertise and also the ability to take action. As you said, the intel's great, but if I tell you there's bad things going on and we can't do anything about it, it's not that helpful. A lot of training, but if you're relying on people to get smarter, we've proven that's not necessarily gonna be the answer to cybersecurity. People get somewhat smarter, but people are always gonna be a vulnerability. And it's not even a matter of whether we're smart or not. It's time. Like, we're just all very busy, we're overwhelmed. Listen, I don't know anybody who hasn't fallen for something, including myself. If it's gonna happen, it's probably on my phone where I don't have a chance to see the email address in the header and whatever, and I might click on a thing because I'm in a hurry, and it— somebody hit me at the right time, at the right place, with the right context, and boom, there it is. Now I've got to deal with this problem. So it happens to everybody, but it's an ever-ending problem. But, you know, keeping that in mind, with all the struggles, like, we're back to where we started. Why do we keep doing it? What happens if we don't? If we don't do this, and I think we answered some of this already in advance, so I may pivot a little bit here. As we said, if we don't do this, it just keeps getting worse, right? So you can't just decide you're not gonna do it, which is why you have to do it. But what do you see going forward? I mean, you mentioned the FBI reporting this year. Every year, crime goes up. Every year, cybercrime goes up. So I could ask you what's gonna happen next year, but I have a hunch we know the answer. How do we change that trend? Like, what are the options there? What do you see in the next 5 years? Are we going to turn that number back downward? Are we just going to accept that it continues to go up and our job is to limit it? What targets should we be looking for as to where that— those numbers should be? Are they just going to grow with the growth of economics in general? Because there's some of that. Like, what do you see as the future for the next few years when it comes to this?

Well, I think that's probably a scary, scary question. Certainly it varies by geo. So in the US, scans are going up. That's not true everywhere. So like, if you look at Australia, for example, they're reporting scam numbers going down.

Brilliant.

And they've taken a whole of government approach to that, combining both kind of cyber, cyber stuff, but also human stuff. So both in terms of education, awareness raising, there's some element of taking away the shame. Like, nobody's really ashamed of being mugged, right? Yeah. That's not the case inside. People get ashamed that they've been a victim. They think they've been stupid.

That's such a good point.

It is a crime. Yeah. You've been a victim of crime.

By professionals. Yeah, it's a good point. I don't know anybody who's been beaten up in an alley and thought, "God, it's all my fault.

I can't believe I let that happen to me." I mean, the same parallels are true there, but certainly where I'm afraid that it's going to keep going up if we keep the same approach, which is, I guess, that's the kind of definition of insanity. Keep doing the same thing over and over again and expecting a different response.

But it's very profitable in our industry.

Yeah, so like, for example, like right now where I can sit, you know, I could see a police car. You don't see those on mobile. I can see a police car outside. I can see agents, I can see officers walking around. That's not the case on the internet. And so that is something that's pretty, uh, pretty like that can— that model can work. Like, it— I think it's working to some extent in Australia, where you can start— you can start like a, you know, law enforcement-based approach to this. Like, yeah, not necessarily using actual police officers, but you can take a 'this is crime, you can't do this in our country' approach. So certainly I've spoken to some people who are wanting to treat this as a national security problem. Especially when you're talking about those scam compounds in Southeast Asia. It's not just Southeast Asia, by the way.

Sure, sure.

It's spreading. But it's a national security problem. Most of the victims are in the US, in North America, in Western Europe. Most of the criminals are not. It's a national security problem. You can think of it that way because it's the same way that you could think about in the US, the war on drugs, whatever side of the political divide you may fall on. Sure. There's no war on cybercrime. There's no war on scams. And it's potentially the largest category of crime. Yeah. Like, people just don't think about it the same way they do physical crime.

Well, you talk about being national security. I mean, that's a really good point. You know, I mean, a lot of people think about cybercrime, myself included, a lot of times. I think about my family, right? How do I protect my family from these, you know, from these scams, these events, a lot of education, a lot of talking, you know, reminding them, you know, because there are so many ways and it's very personable. But it also, again, these are foreign actors against primarily, you know, Western, you know, US, North America, you know, UK, Europe, as you said. There's national security. Some of these people have national security clearances. Some of these people have accesses, you know, compromised people. It doesn't just have to be about money. You know, I mentioned I spent 19 years in the intelligence community. Compromises create all sorts of national security issues. If somebody can, you know, build one of these romance scams and get you hooked, and suddenly you reveal things that you're ashamed of or embarrassed over, can be leveraged against you. It doesn't matter if they're legal or illegal, that's not the point. You know, when you talk about security clearances, what people care about is, is this something you're ashamed of? Is this something you can be blackmailed for? And all of these actors are capable of walking down that path. It may not be their goal, But it may still happen, and it may be some that it is their goal. So there is a national security component. It's not just about somebody emptying, you know, Grandma's retirement fund, which is awful, but it could be about somebody getting a compromise and ending up, you know, getting R&D information for the latest, you know, Gen 5, Gen 6 fighter aircraft or getting, you know, critical intelligence, foreign intelligence. There's a lot of components to this. So I can see how they could, you know, how we could go down the path of saying this should be considered a national security threat. There's financial components to it, and there's protecting our civilian population, but there is a serious national security concern that goes with this.

I think you have to take that approach. If you don't, you're not going to have the unified approach.

And are you saying that's been the answer for Australia?

I mean, maybe not quite. That's maybe more of an American framing, but certainly, like, in Australia, they've taken it as like a whole of government problem. Same thing in the UK. Like, we have fraud as a— certainly online fraud as an all-of-government priority. Get rid of it. I mean, it's not going to happen, like the same way that every other crime hasn't been gotten rid of. But mitigating and reducing the impact of that is the priority. And I think if you don't take that approach, you end up in this— maybe the kind of original version of whack-a-mole, where you are one person and you've got 100 moles. And you're not, you know, you're playing a very difficult game, especially if you take it like a traditional law enforcement approach. What works is moving, you know, in that kill chain, moving left of boom, say, before the scams happen, before the cyber crimes happen, before, before, what can you do? And okay, there's lots of stuff you can do. And you have to take that approach. But you can't take a, we can't investigate it because there's been no victim. And in order to investigate it, we need 100 victims and they need to have lost. $100,000, and that's great, but most of the attacks, you know, the majority of the attacks are, you know, high volume, low, low individual loss. Right, right, right. Those obviously add up to millions of dollars, but they individually, they don't. And that's the challenge, I think.

Well, that's interesting. I mean, maybe that's— I hadn't thought about it, but maybe that's the reason, you know, when we opened this conversation, the discussion was about, you know, Why even do this? Why bother fighting cybercrime? Does it matter? And maybe that's a very American point of view because as you said, it's different in Australia, it's different in the UK. It's this whole of government approach when it comes to cyber fraud, for instance, that hasn't happened in the States. And as a result, we have, I don't wanna say it's unfettered, but it's much more difficult, right? I mean, we have, you know, industry is working hard at this obviously, but the government is more of a monitoring, reporting, collecting data. You know, not to take shots, there's people in the government working on this too, but it's not, this priority that you're talking about in other places. And maybe that's contributing to the feeling of like, it's just, it's insurmountable. We can't win this because we haven't taken the same approach here. And, and from my standpoint, this is obviously my point of view. This is where I spend most of my time is in the States. So it is encouraging, I think, to hear that there are other, other areas having more success. Again, it will never be zero, but a whole government approach, you know, working with industry sounds like an opportunity to do better. Now again, there's politics in there and I'm not gonna get down that path either. I don't know if whole of government approach is the way to go right now. I'm not sure how we'll do with that. Some people like regulation and government involvement, some don't. But it seems that there's a model that has more success, at least, that perhaps there's a chance to follow. So I didn't prep this, we're gonna close out in a minute, but I'm curious, since we've gone down that path a bit, you know, talking about Netcraft, you work with government agencies as well? Is government part of the customer, US and international government?

Australian. UK, I could talk about because they're both public.

Sure, yeah, yeah, obviously I don't want you to tell things that aren't out in the open, but yeah, publicly, you know.

So publicly, yeah, we do a lot of work with the UK government and the Australian government taking, like, helping take that whole government approach. Like, one framing that I, like, quite like, and again, I didn't invent this term, but like, thinking about these types of attacks, like, who is the natural predator? Who cares about this type of attack? And who's— at the end of the day, doing this work costs money. Nobody's working for free.

Sure.

So the question is like, who's gonna— who's motivated to pay? So you think about phishing, pretty clear-cut, you know, say it's a, you know, a phishing attack impersonating bank or, you know, an e-commerce entity.

Sure.

Pretty obvious, like they're going to be motivated to protect their customers, right? When you're thinking about these types of investment scams, pig butchering, who's paying?

Nobody really, right? I mean, it's got to be government, right?

That's where it kind of comes down. That's what like what Australia is doing. That's what we're helping with in Australia, where we've been able to be successful in detecting these threats. And you can take this kind of multiplayer whack-a-mole, you can, especially when you've got a government backing, you can do some of the things you can't do in other in other spaces. So for example, you can say, and again, this is maybe slightly more hypothetical, this kind of a future state, but certainly an approach that's been successful in the UK is taking some of this threat data and actually sharing it with ISPs. And for customers that have opted in to this protection, you can say, well, okay, well, you know, now I cannot browse to this investment scam website because I've been protected. Again, maybe slightly different in politics. And, you know, maybe you can discuss for another 3 hours about where you draw the line.

Yeah, where's protection, where's censorship, and some of those things, obviously, right?

But then, you know, we don't talk about censoring mugging.

No, no.

So, like, criminal speech is a little bit different, I think. So then, like—

Yeah, that First Amendment gets complicated. There's constitutional lawyers talking about it. I'm with you. I don't know.

I'm not going to start a whole debate. I'm not as familiar enough with—

No, but I agree with you. I mean, if it's a website that's sole purpose is crime, and we block things now. I mean, how— the First Amendment does have limitations. I mean, everybody does know that. That's how the law works. If it weren't, then every website everywhere would never be blocked. I mean, that would be— it would all be First Amendment. I'm allowed to create a website that's whatever scam I want it to be. You can't block it. It's my First Amendment right. Nobody believes in that. That's not happening. We block all sorts of things, right? So it's where that line draws. To me, I think that's a really logical way to look at it. If you could have the ISPs in partnerships and you send them and say, hey, these are all scam sites. Sites is all they do. I guess the only question becomes then is, is how often is that reviewed? Because that site then is deregistered, re-registered. You got to look at that, right? So somebody may have to— if they buy the URL later, they may have to go back to the ISP and petition, hey, this is no longer a scam, this is what I use it for, get validation. But I mean, it's, it's a good way to look at it, right? It's another proactive approach that you can't do without government. Like, you're not gonna be able to pull that off. Like you said, it's— when you talk about phishing scams, like I said, you know, financial institutions care, etc. You talk about retail scams, you talk about Fraud. Websites that are selling counterfeit goods. Well, clearly the retailers care about that. Counterfeit Amazon websites. Well, clearly they care about that. It's easy to understand who's going to pay. Like you said, it's a lot of money. Whether it's giant retailers like Amazon, like Walmart, or really high fashion products, right? They're obviously going to pay because they don't want somebody stealing their business. They don't want somebody bastardizing their brand and putting out garbage products. But yeah, when it's pig butchering, when it's, when it's small, you know, individuals, we're not going to do that. We're not going to create a consortium of citizens. We have that. It's called government. That's why we give them tax money. And there are consortium that's supposed to protect us from things, right? So, so it's interesting to see that. And I'll be interested to see what goes forward there as you continue to grow as a business. Obviously, you know, doing well, as you said, you know, with Australia and the UK government, we should see more in the States. So listen, we gotta start closing up here, we're running out of time, they're gonna end up kicking us out of the studio. I already had one guy walk through the shot, I'm really excited about that. Maybe we'll edit that and you won't end up seeing it. But as we're getting to the end of the show, we close out, we got the same question for every guest. You don't get a pass on this one, Robert, you gotta answer just like everybody else. So the name of the show is Unspoken Security, and with that in mind, tell me something you've never told anyone before, something that till this point has gone unspoken.

Well, I am a phisher. I have deployed phishing sites.

You've deployed phishing sites. Hold on, lean into the mic on this one because I want to make sure everybody gets to hear this.

I have deployed phishing sites.

You've deployed phishing sites. So you're a criminal.

I am a criminal.

But this is recorded. So this will be interesting to see how we go from here.

I immediately got blocked by my own tools.

So you're not good at this.

Well, the story was I was investigating. There was an AI platform that our team's been looking at that's being used by criminals to create phishing sites.

Okay.

I thought, okay, I'm gonna give it a try. Sure. Turns out it's really easy.

Oh, well, that's disturbing. That's a whole other show apparently on how easy it is to create phishing sites, but—

I did it in about 3 minutes.

Oh my God.

So it's a really cool tool and it's not, it's a legit tool. So it's, you know, Y Combinator backed, not designed for criminals. Clone the website. Okay, I thought, okay, great, I'm gonna clone PayPal. See how this works, right? Turns out it's pretty easy. You type in the URL, say please, please clone this, and there's some, you know, moderate protection saying, oh, it looks like you're doing something right.

Oh, it's for academic purposes or whatever, right?

Okay, no, no, this is just a test. Fine.

Sure.

You can then modify— you can— I modified the, you know, the destination where the username and password to go send it to my Telegram bot through an API, and that is pretty, it was pretty easy. So I unfortunately, well, fortunately or unfortunately, didn't capture any credentials, but I deployed it online. It took about 3 seconds. I didn't do anything. It was auto-deployed. Unfortunately, it got blocked almost immediately. So I'm not very good, not very good at evading detection.

What's the valid purpose of this tool? You said it's super easy to use. Y Combinator backed, so it's a real thing. Like what's the valid use of this tool?

I, yeah, no comment. Well, like cloning websites, right?

Yeah. So just so you have your own backup, is that—

I mean, no, I think, I think it's to say, well, okay, I want to build a UI that looks a bit like this.

So it's to create like a model to start from.

Model to start from. And then you can, you know, it's like chat-based. You can say, okay, I want to move this here. I want to do this. I want to change the logo. Okay. Change this, move this here. It's great. It works really well. Right. But yeah, it auto-deploys great sites. Phishing site deployed. Yeah, but we unfortunately, or fortunately, I got blocked in the studio at least. So bad for me. Good. Well, maybe good for me.

It makes a good point though. I mean, we talk about a lot, almost any tool can be used.

Yeah, I didn't realize it was going to get deployed. No, I was kind of just testing out.

You didn't have any idea?

I was like, I didn't realize that it actually, yeah, it's actually, it's gone live.

You didn't get any phone calls from anybody? Did PayPal then come looking for you? No. But it makes a point that, you know, most of the tools we use either, you know, can be used for good or for bad, right? I mean, that's how it works.

Well, there's definitely loads of these tools that are pure, pure play criminals.

Sure, sure. I mean, it happens. Like nuclear technology is great or it can destroy planets, obviously. We've got some of the best, you know, red teaming tools are also used for exploits. So, you know, it's— and this is another tool that I'm sure everybody who's watching and listening is now going to go look for this and try to figure out how they could do it because It sounds like it's fun to play around with creating phishing scams. But yeah, I don't recommend it, by the way, for anybody out there. If you're gonna create crimes based on this show, that's on you. I'm sure I'll put some legal waiver on this if you want.

Yeah, we've got some cool research coming out on that, actually. There was some pretty interesting problems with that site. You could actually go and see other criminals. So once you knew the domain name they deployed, you can go and see the chat that they used to create it, and you can actually see them.

Really?

Yeah.

Well, that's actually— so you said you have research coming out on that?

Yep.

When's that coming out? Good question. Okay. All right, cool.

When I get back from RSA.

Well, I guess we'll find out after RSA. All right, great. Well, listen, I want to thank you for stopping by, you know, for sitting with me for a while and talking about this. It's super busy here. You got a lot of things to do. I know it's a busy calendar, so I appreciate you taking the time. Before we wrap up, any last thoughts about, you know, RSA or about, you know, what Netcraft's up to these days, you know, how the event's gone, anything you want to plug before we jump out for today?

Eat your greens.

What's that? Eat your greens? That's your plug?

Yeah. Is that a choice?

Is that any— that's not a tagline for Netscape? For Netcraft? It's just eat your greens, right?

I've lost 50 pounds.

You've lost 50 pounds? Well, that should have been the unspoken thing. I guess everybody other than me probably knew that already, but yeah, I haven't been paying attention. But congratulations on that. Eat your greens. That's the go away here. All right. I appreciate it. Well, listen, we're going to— like I said, we're going to wrap it up here. Again, thanks for being here. You know, for everybody who's out there listening and watching. I really appreciate you taking the time and the effort. If you like the show, you know, please feel free to like and comment, subscribe and share with everybody you know. If you don't like the show, you know, let me know about it privately and I'll see what I can do to make it better, I suppose. But for that, with that, we're going to go and wrap up from RSA Conference. I want to thank you all. It was RSA. I got to get the branding right. I got to get the branding right because I'm media this year, so I'm allowed to. So from RSAC Conference 2025. This has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts.

See you next time.