Episode 27 - Protect Yourself Online: Mobile Carrier Breach, Password Tips, and QR Code Scams

Okay, welcome to Cybersecurity 101 with Larry and Joe. But yeah, it's been a while, so we're very excited about this episode and hopefully everyone will enjoy it.

Yeah. Good to talk to you again, Larry. I know there was some specific topics you wanted to, to chat about on, on this one. What, what do we have in store for us today?

So we have in store for us today the breach that happened with the mobile phone services with AT&T Verizon and I think it was T Mobile. What people should be looking out for, what may have happened and people that's in the cyber security world, what we should be looking for when someone is trying to change their, they're changing their, their method of authentication, we should be looking out for, to make sure that, that it's, it is a, especially when it, especially when they're changing it to, with their cell phone.

So my understanding what happened is the hackers from China got into eight different mobile phone carriers, including AT&T Verizon and T Mobile. There was five others that we don't know the exact names because that hasn't been publicly, you know, you know, announced. But it's believed that they came in through a vulnerability in Cisco routers that were end of life, meaning they no longer had a support contract to get security updates on those public facing Internet routers. So the hackers came in through those devices and it's believed that there's so many devices that would have to be replaced that it's going to be quite some time before they'll be completely evicted out of these telecommunication carriers. Now what the attackers did when they got in is they accessed the wiretap system, which means that they could essentially have the same content that law enforcement would have if they had gained a subpoena or a warrant to obtain all of your text messages and phone calls. So essentially they're able to listen in and retext. Now what we understand is that they specifically were targeting political figures and a limited number of people. They weren't, you know, spying on people like you and me. And so while the FBI did issue a memo recommending for people to use encrypted messaging apps as opposed to just, you know, generic text messages, I don't think that the general public has much, you know, to really worry about there because it's, you know, everything we understand is that they were really after, you know, top political figures. Now it's also worth mentioning that when you're a iPhone user and you communicate with another iPhone user user using the iMessage protocol that is already encrypted. And you don't need to change your behavior. You don't need to switch to WhatsApp or Telegram or any other kind of app. If you're communicating iPhone to iPhone, you're fine. The challenge is that when you're communicating from an iPhone user to an Android user, it goes over standard text messaging. It does not actually, it's not encrypted. And so that would be, you know, where the vulnerability, you know, would happen. And under that scenario, if you really wanted to be secure, you would switch to say, you know, WhatsApp or you know, a similar app like Signal or Telegram to have those kind of, you know, communication. So, you know, that, that's what we know about the situation.

Okay. Okay, that's, that's great. So as a sock out which I work as a site security analyst, I brought that up in our meeting and what to look out for, what we should be looking out for. And I, I can't remember. It was a side that he, I can't remember what he said, but it was, it was a way that you could find out if it's, if it's a bad actor that, that, that changed the method of someone's authentication that maybe if one of the, you know, serious hackers have got into like Verizon or something, what to look out for. I forgot what Assad told me and, and I was wondering if you have heard of anything in that manner.

So I think what he's probably referring to is if you were using SMS text messages as a form of two factor authentication, then you want to switch away from SMS text and use authenticator apps instead of text messaging. And, and that's been a best practice for several years now. But yeah, I mean, theoretically, if the hackers got into the wiretap system, they would have copies of the sms, two FA codes. Now obviously they'd still need your password to be able to fully get into an account. But yeah, it definitely is good practice to move away from text messages in general even before this attack occurred.

Okay, all right, so my second question is how can just a regular, you see a regular Joe, a regular person hardener security, definitely when it comes to cell phone usage or maybe anything that's there on the Internet or anything like that. I don't know how you, I don't know what your thoughts on that.

Yeah, so just kind of, you know, to double down on what we were just kind of talking about, you know, the first thing to do is to definitely set up Some form of two factor authentication, you know, and text messaging. Even though it's, it's insecure, it's still better than not having any two factor authentication at all because someone can guess your password or, or if you're like many of us, if you're human, you probably do what's called password recycling, where you use the same password on multiple websites. Like, I think studies have shown that people use maybe four, maybe five passwords. And that's it. Because that's about all the human brain can kind of remember for passwords, right? So you could actually use programs like LastPass to randomize passwords. So every site you go to would have a totally different password. And that's really considered a good practice because then if that, you know, when that website, not if, but when that website gets compromised, then the attacker is only going to have access to that one account, not all your accounts. So using a different password on every website is not really practical unless you actually had a password vaulting solution. Now, LastPass is commercial solution. There's also password safe, which is free. It's something you download, put on your machine. And if you want to get really fancy, if you're IT pro, you can actually configure it to require the use of a physical USB key to actually unlock that password safe. That way if a hacker got on your machine and they copied your password safe, they wouldn't be able to unlock it because they wouldn't have your, your passkey, which is like a Fido 2 USB key. So, you know, again, there's, there's levels to this stuff, right? There's you got your freshman football, you've got your jv, you got your varsity, got your semi pro. So the pro would probably be using a local password Safe with a Fido 2 key. Because if you think about LastPass, they've already been breached a couple times. And so the last thing you want is your password vault with all your passwords getting compromised. And so the absolute, you know, most secure thing would be, you know, to do that. Now what happens if you lose, you know, that laptop or that safe or that USB key? That's the trade off. One of the benefits with LastPass is you don't have anything to lose. They're hosting the data for you, right? Whereas if you have the safe locally, what happens if you lose that safe or you lose that USB key or, you know, whatnot. So there's pros and cons, there's trade offs there. But the first thing I would do is I'd Recommend people to stop using the same password at every website they go to. I'd recommend that they start doing some type of 2fa. Text messaging is better than nothing. But given that the current telecommunication care has been breached, it'd be very wise to use an Authenticator app. But it'd be even better to use a phishing resistant form of authentication like a USB key or a passkey. Passkeys can be installed into Windows. Hello. Or they can be installed in the Authenticator app now. Yeah, yeah, as of May, you can put them in the Authenticator app. So, so there's, you know, that's basically kind of one thing. Now why do we talk about identity? Identity is kind of the, you know, the security perimeter. If somebody has your account, they can get into all your, all your data. Right. So we want to harden the identity first, in my opinion. Right. And, and that's why we talk about, you know, not doing password recycling, which means you're going to have to use a password safe. You just have to decide if you're going to use like a web based one like LastPass or if you're going to go super paranoid and have a local one on your disk. But then if you do the local one on the disk, make sure you don't lose that thing. Right. So, so that's kind of the first thing. Now the second thing is, you know, you can enable. You know, a lot of people talk about VPNs and this is a hotly debated topic. Right. You know, right now it's a big topic. Now the cybersecurity community is kind of divided on it. There's pros and cons to vpn. So let's talk about some of the benefits of a VPN. Right now in the United States, if you browse the Internet, then your Internet service provider by law can see your DNS traffic. And DNS by default is not encrypted. So your Internet service provider, let's say it's like AT&T, or maybe it's Google or maybe it's, you know, Cox or Time Warner, you know, whoever you're getting your Internet service from, they actually know exactly which websites you go to and then they sell that information to advertisers. So that is currently allowed, I believe that law passed under Obama, where the FCC allowed Internet service providers to sell your Internet traffic to advertisers. So now the advertisers know exactly what websites you go to so that they can better advertise to you. So if you don't want that to happen. There's a couple things you can do in your web browser. You can enable a feature called DNS over HTTPs, where now your DNS traffic is going to get encrypted. So every time you're on that web browser, then they don't know where you're going. So if we're talking about personal security and you didn't want your Internet service provider to be able to sell or even know where you're browsing, probably be a good idea to go in your web browser and enable DNS over HTTPs. Now the other thing you could do is you could use a vpn. The VPN will do the same kind of thing. It's going to encrypt that DNS traffic, you know, if you set it up right.

So you set it up right, and that's the key. So I brought up that question because a lot of, of my elders and my family, my mom, my aunts and them, they're very concerned about you know, not, not just being hacked. But I always try to tell them to stay off social media. They don't really need it, but they want to follow, like their, you know, grandkids and.

Yeah. See all the pictures?

Yeah. So they have it. So I did tell them, you know, there's, there's two, there's things that I use, like, because one of my cousins, he had, he was on Instagram, got cloned. And then he started, he started asking the guy cloned him, started asking me for money. And I, I know key things about him that I, I, I asked him. And the guy didn't know that was one way that I, I did it. So I always tell them, you know, always ask the second or third question, even when someone calls you nowadays. And then I always tell them the junk mail don't go in there if you didn't purchase anything. And you get something in if you didn't purchase it from that Amazon or Kohl's or whatever and you haven't sent to your home. Don't pay that if you already paid it. You know, it's just things like that because I feel that the, especially the older ones in my family, they've been preyed upon. I think my uncle got hacked because he clicked on something that he wasn't supposed to.

Happens all the time.

Yeah, of course. Who they call me.

Yeah, yeah. You know, it's, it's, it's a shame that, and it's wrong that hackers are targeting the elderly. And those that are not into technology, they're taking advantage of the most vulnerable among us. And it's just, it's not right. So I think the wisdom that you passed on to them is very sound. I think it's safe for them to ignore most emails. Right. So most emails are going to come in saying, hey, you overpaid on your Amazon. Do you want your refund now? Right. Ignore those kind of stuff. You know, just have them, if, if there's ever a question, have them go directly to the retailer website as opposed to clicking on any kind of link, you know, in the email. And if you ever get a phone call from someone, hang up and call the company to verify that, you know, they are, you know, in fact trying to contact you.

Right.

Because, you know, this time of year, it's, it's, you know, you often get some kind of a call from the IRS saying that, you know, you owe taxes and who doesn't, right. Owe taxes. So you're going to get some call. And this is, you know, Jeff Webb, Iris badge number five. And, you know, and, and they're just going to, you know, scam you. So, yeah, it's, it's. And until the Internet changes where you have to have an ID to get on the Internet, until something like that happens, it's just going to continue to be the Wild West.

Yeah, exactly. And, and that's, that's just kind of how I feel. I mean, I'm so suspicious. QR codes. I really very, very, very, very skeptic of that. So I don't usually do that. I kind of told them that I know a lot of restaurants nowadays, when you go in there, they don't have a menu. They might have the, the QR code. And they started that during COVID and that. And they just continue that. Maybe that's where they said save money too. I don't know. I know there was a big scam going around my area with that, with, with the QR code. So what they'll do is they'll mail you out, they'll send you a package from, from Amazon saying that, yes, this is your package. If this. Oh, if it's not your package, scan this QR code to return it back. Once you hit, once you scan that QR code, then they have access to your phone. Yeah.

The other thing is in restaurants, if you have a local hacker in your community, they'll put a sticker over the restaurant's QR code with the hackers QR code. So you think you're paying that restaurant's bill on your phone. You actually are just sending money to the hacker.

Oh, that's crazy. I haven't heard about that one yet.

Yeah, so you'll, you'll see that. So just people putting stickers over QR codes with their. And it, it'll look identical. It'll, it'll say, you know, the name of the restaurant and you'll put your money in and, and the restaurant will be like, hey, you haven't paid your bill. And be like, yeah, I did. Look. And then, yeah, there's a sticker over the QR code.

Okay, so, Joe, in your view, if we were just, if, if you was just to walk down the street, somebody to say, hey, do you know anything about cybersecurity? You said yes. What would be your suggestions for them? The best way, the best practice for them to kind of just, I mean, you're not going to be just kind of secure. So if you're not going to be 100% secure, but to the point to where they feel safe, like they can do stuff over the Internet or.

Yeah, you know, one, one thing that people could do is, you know, they could keep a password book. And if you think about it, when you're at a company, if you actually go into an office building, say it's never a good idea to write your password down on a post it note and put it on your monitor because everyone in the building can kind of, you know, walk by. But if you're at home, right, let's say it's your aunt or your grandma or mom, you know, if they have a local password book that they write their passwords down and they are writing a different password at every website, that can save them some money and some complexity because now they're not having to purchase and pay for LastPass and, and if they're not an IT pro, they're not having to deal with like a local, you know, password database with like a Fido 2 key, you know, they don't have to deal with any of that. So I would say for the average person, home user, have a little password book where, you know, you maintain a different password for every website you go to. And that's going to solve a lot of problems because again, the, the big thing that happens right now is credential stuffing, right? Where the website that you were using that gets hacked, the hacker now knows that your password is, you know, scooter 1, 2, 3. And now, and now all your websites are now vulnerable. And so they have hacking tools called credential stuffing tools where they type in your email address in Scooter 1 2, 3. And it's going to log into a thousand websites as you. And now they know exactly which websites you're using that password on. It's all automated. So it's called a credential stuffing tool. So that.

Is that through, like, metasploit or something like that or.

No, it's not Metasploit. It's actually just tools that you can get on GitHub. But, yeah, they're called credential stuffing tools. And we could put some of them in the show notes for people that want to be aware of what they are. Obviously don't attack anyone other than your own account.

Exactly. Yeah, we do not. We, we don't want that. You know what I mean? For, for that to happen. Joe, that was a great, that, that, that's a great way probably for someone to, to practice, to, to do that. So.