HS 111 - Social Engineering with Chris Hadnagy

Welcome to the Holistic Survival show with Jason Hartman. The economic storm brewing around the world is set to spill into all aspects of our lives. Are you prepared? Where are you going to turn for the critical life skills necessary to survive and prosper? The Holistic Survival show is your family's insurance for a better life. Jason will teach you to think independently, to understand threats and how to create the ultimate action plan. Sudden change or worst scenario, you'll be ready. Welcome to Holistic Survival, your key resource for protecting the people, places and profits you care about in uncertain times. Ladies and gentlemen, your host, Jason Hartman.

Welcome to the Holistic Survival Show. This is your host, Jason Hartman, where we talk about protecting the people, places and profits you care about in these uncertain times. We have a great interview for you today and we will be back with that in less than 60 seconds on the Holistic Survival Show. And by the way, be sure to visit our website@holisticsurvival.com you can subscribe to. Our blog, which is totally free, has loads of great information and there's just a lot of good content for you on the site. So make sure you take advantage of that@holisticsurvival.com we'll be right back.

Here's your chance to catch up on all of those creating wealth shows that you've missed. There's a three book set with shows 1 through 60, all digital download. You save $94 by buying this three book set. Go ahead and get these advanced strategies for wealth creation. For more details go to jasonhartman.com.

Hey.

It'S my pleasure to welcome a very interesting guest and a very interesting topic. It's Chris Hadnagy. He is the author of Social Engineering the Art of Human Hacking. And if you are not sure what those things mean, we are going to find this is a lot of lot of ground we're going to cover here in terms of what is social engineering, what is framing, what is personal hacking, how does it relate to national security issues and business security issues and personal security issues. So a lot to cover here. Chris, welcome. How are you today?

I'm doing great. Thanks for having me on the show, Jason.

My pleasure. Where are you located, by the way?

Actually, in Northeast USA and Pennsylvania in New York.

Good stuff. Well, what is social engineering?

I define social engineering as any act that influences a person to take an action that may or may not be in their best interest. It's a very broad definition. That's because I don't always think social engineering is a negative.

Sometimes it's a positive and so human hacking though, is that a part of.

Social engineering, focuses on the negative parts of social engineering. So the human hacking aspect takes all the principles, the psychological and physical principles of social engineering like persuasion, influence, manipulation, rapport, building, and it focuses on how those skills are used to make someone do something definitely not in their best interest.

And so what you do as a business is quite interesting. You're like sort of a different version of a private investigator almost. You basically you are hired by companies to hack their people and hack their systems. Is that correct?

Yes. Yeah. Companies will hire me and my company to test their employees susceptibility to common scams like phishing or phone elicitation or even on site attacks. And we'll test their people's net, their people network by actually sending phishing emails or making phone calls to them, or visiting their people on site and seeing what information we can gather and how far we can take an attack, then reporting that back to a company so that we can fix those holes before the real attackers come in.

So what you're doing then basically is a company will hire you and you might call their employees up and ask them questions and see what you can learn, right?

Yes, exactly.

Huh, Very interesting. Well, talk to us a little bit about influence, if you would. And you know, I mean, you've got chapters in your book about NLP or neuro linguistic programming and persuasion, influence manipulation. Let's kind of dive into that subject and drill down on it a little bit if we could.

Sure. I think influence is a very, very important topic, not just in what I do, but I think in everyday life, things like I always start off with building rapport. Building rapport is just an essential piece of communication between people. If you and I had absolutely no rapport, this conversation would be horrible for your listeners. So we have to have a rapport in order to just be able to converse. And social engineers know that. And they're masters at setting up a nice rapport establishment between them and their targets, either through charm, through a smile, through the way that they ask questions, even through fake accents or other things like that. But they are very good at building a common ground and quickly developing a friendship between them and their target. And that of course makes the rest of influence, which is asking for their help, trying to get information from them, trying to elicit little pieces here and there that a normal person maybe not wouldn't. The red flag wouldn't go up when that kind of question is asked.

You know, it's interesting because I'm sure everybody listening has been taken advantage of at one time or another in their life. And I remember the times I have, I'll talk to a mutual friend about the person who did the wrong, or at least in my eyes, did wrong, and they'll say something like, well, he or she is so nice. I really like them. Well, duh. Of course, every con artist is nice. I mean, that's the tools of the trade, is to be nice and likable, and otherwise you can't pull off your con. Right?

Yeah, they use very simple principles. You think about Robert Cialdini. He wrote the. The book about persuasion and influence. The man's a genius. You know, you think about the principles he talks about, like reciprocation. Very simple. You know, just a simple example. If you're walking into a building and someone holds a door for you, and there's double doors, generally, what do we do with the next door? We hold it for them. It's just a simple psychological principle. Something as simple as that. If somebody gives us something, we have this feeling of indebtedness to give them something back. Whether it's a compliment, whether it's a physical gift, whether it's information. Social engineers or con artists, they use that. They maybe give a compliment or they give a little bit of information out with the expectation that that feeling of reciprocation will then cause the person to do the same in return. And that is used very heavily in social engineering because that psychological principle is something we just can't get away from. They give something away, they create those feelings, and then they make their request to the target. And usually that request is then given. That's just one out of the many principles of influence that are used heavily in this type of work.

Reciprocity. Right. Is that the one you were referring to?

Exactly.

Give us a couple more of those if you would.

Sure, sure. I think another one that's probably used heavily is concession. Concession is generally thought about as a principle of influence when it comes to sales. You have this offer and you concede something, you give a discount. But in Social Engine, the act of yielding is actually something that is very important. People today aren't yielding. They tend to be a little less humble, a little more arrogant. So anyone who is yielding is an attractive personality to another person. So someone who can concede, who can actually kind of come into the target looking a little more humble, looking a little more conceding to them, that is something very attractive to the target. And then when they make their request, the request is more easily granted because of Those type of feelings. We see this actually in phone scams a lot. They'll do things. This is not even a scam, let's just say in legitimate purpose. And then you can see how it can be used in a scam. You'll get a call from a company trying to solicit funds, and they'll start out with something high. Most people are donating at least $200 to our calls today. Can you do $200? Oh, no, I can't do $200, man. The economy is just killing me right now. Oh, okay. Well, you know what? We have some who are willing to donate just 20. Now, 20 sounds so much less than 200. But if they started out with 20 and you rejected that, there's not much more place to go. 5. And that's really low. But by starting out with 200, such a high number, when they concede to something lower, then it becomes. It becomes easier to grant that request. Information is the same way. If a social engineer asks for something that maybe is too high to give, the next time they come back, they'll concede with something lower. And that probably was their true target, was to get that information anyway. But it seems less important because you started out with something so high. That's another big one is social proof. This is probably the one that's used very heavily. Social proof. Probably the funniest examples of those you might think of, like the old candid Camera where they had people in an elevator and the people who were part of the show would turn a certain way in the elevator that made no sense, like facing the back wall and total unknown targets would come into the elevator, see everyone standing the wrong way.

They'd face the other way.

Yep. A matter of seconds. Right. And they would be facing the other way. And that's social proof because we want to psychologically want to fit in with others. We want to seem like we're part of the tribe, we're part of the crowd. So if we. A social engineer knows that and they will portray things as. And we probably all have been approached by people selling things from door to door. In our area, we have. This is. I don't know if this is in other areas where your listeners are, but in our area, we have people actually sell meat from door to door. They have these big freezers on the back of their truck. And their approach is always something to the sense of, I'm almost sold out because all your neighbors bought everything in my freezer. I only have a couple packs left. And I thought, hey, I saw you in the yard. Let me stop and offer it to you before I leave. Now, that kind of social proof is used because they're letting me know that all my neighbors, everyone else around me, trust this guy and was willing to give him money.

Yeah, better follow the herd.

And most people will fall for something like that. I want to be just like that. Social engineers use that type of social proof, even sometimes on a very personal level. Calling and letting you know that it's okay. Because I was just talking to Melissa yesterday, and Melissa gave me some information. I just calling back to see if I can get a little bit more. Maybe you can help me out with this next question. And by using something as simple as that, someone's mind can. The red flags are put down, the guards are down, because, hey, Melissa did it, so it must be okay.

So what is framing then?

Framing is a very interesting concept if we think about frame just in the sense of a building. The frame of a house is its structure. It's what holds the rest of it together. It's very similar to us as people. Our frame is our structure. It's what makes up our beliefs, our understandings. It's what makes up where our thoughts and processes come from and go. And that's a very important topic for social engineers to understand because you need to be able to quickly decipher someone's frame in order to determine if you're in line with it or if you need to change it. So someone's frame could be, let's say, their beliefs, either politically, religiously, morally. You know, it can be just their beliefs because of their job, their frame of mind. We use that a lot. Their frame of mind and what they're doing with their job, whether they're doing their job mindlessly or whether they're doing it in a lot of intent and concentration. You need to understand that about a person before you approach.

So that's just basically relating to the person then, right? Understanding their frame of reference, Is that what you're saying?

Yes, very, very true. And it's hard to do a lot of times because we come into a situation with our own frame of mind. And our own frame of mind sometimes blocks the view of someone else's frame, and that can make it real difficult. But now social engineers and scam artists, they've been able to master that. And being able to come into a situation with a clear frame and looking at it from someone else's frame of mind, being able to align the two frames is a very difficult thing at times. But Again, this is where social engineers have mastered that art and finding a common ground, a bridge between your frame and my frame, and being able to say, you know, here's where we meet in the middle.

They're basically exploiting the concept of people who like people who are like them. Right.

I love that. I love that statement. Yes. It is so true. It is. And you can even take that a step further with framing. People like people who actually like them. So con artists and social engineers take that even to one step. Not even making themselves like the other person, like birds of a feather, but then they come in with that natural rapport and charming. And when you feel liked, when you feel accepted, boy, that. That goes a long way in creating that bridge between two frames.

Yeah. What are some of the physical tools? I mean, we talked about some of these intangible tools, personality traits, gift of gab type stuff. But are there actual physical tools that these hackers use?

There are. I mean, from simple things, like on a pretext, maybe an outfit, you know, it could be a physical tool. Tell you the truth, something as amazing, as amazingly simple as a clipboard becomes an amazing tool for a social engineer. You wouldn't believe the authority that a clipboard gives a person. So it could be an outfit, something like clipboard, hard hat, you know, things like that. Or it can be even more serious tools like lock picks, software tools, things that help with information gathering, other tools like that that are used by engineers.

Right, right. But I mean, you know, when you get into lock picks, I mean, that's completely illegal. These people don't have any qualms about breaking laws, right?

No, I mean, if they did, they wouldn't be in the business they're in. And to tell you the truth, lock picks are only illegal in certain states right now.

Oh, well, I didn't mean it's illegal to own one. I meant it's illegal to pick someone's lock and break into or something. Right, that's what I meant.

Some of the recent scams that have occurred, especially using some of the horrible things like the tsunami in Japan, you know, 9, 11, these type of things, hackers and social engineers and scam artists will use those events to pilfer money and information from people. So they already have no qualms about pulling on the heartstrings and using some of the worst scenarios on earth to steal from people. Picking a lock is not. Is like probably small on the scale of what their conscience allows.

Wow, that's just amazing what they do. So give us some, maybe some Case studies. I mean, in your book, you talk about hacking the dmv, the, you know, Department of Motor Vehicles, the Social Security administration, how some CEOs are just overconfident and they're. I guess they're. They're easy prey when they're overconfident.

You know what's interesting, let's say about that account with the CEO is in pen testing. A lot of times with social engineering, people will automatically assume I don't fall for that. I'll never fall for that. Someone can ask me questions all day long and I'm relatively secure.

Pen testing.

Penetration testing.

Oh, penetration testing.

Okay, sorry. Pen testing for short. I'm glad you asked. But a penetration test is just testing the ability for an outside person to penetrate your inside network. So in this sense, social engineering penetration testing is testing the people network.

So the CEO isn't stupid. I mean, the CEO. Look, they got where they got because they're smart, right? And they think they're smart. So what kind of thing do they fall victim to then?

Well, a lot of times. And this is exactly the way we have to work. And it's kind of a sad story, this one in the book. It's not something I'm proud of, but it is the way social engineers, malicious social engineers will work. So this particular CEO had a liking for cancer drives because some in his family had battled with cancer. So every year he worked with a local bank on putting on a cancer drive. And they left some of their documentation about it on their server in the open. So it wasn't something that had to be hacked, something you can find on Google. If you went to their URL and you searched their server, you saw some PDFs, you downloaded them, you saw that they had put a few thousand dollars into a cancer drive. Every year they helped a local bank put on this drive. So we knew that that's where their emotional heartstrings were attached, was on this cancer drive. So we were able to utilize that by basically calling, pretending we were from the bank, saying that we were interested in helping them set up this cancer drive for this coming year. And I had a PDF that I wanted him to take, download and open up on his computer. But in order to do that, I needed to know the version of his PDF reader. That way I can make sure that it works because I have brand new software, and if he has an older version, it might not work. He was more than willing to give me that information. And of course, like most people who haven't updated recently, he was Using an old, outdated and vulnerable version of his Adobe software PDF reader, we were able to encode a PDF with malicious software, which means that we can take what looks like a legitimate PDF and in the background put like a virus or a Trojan, something that would infiltrate his computer and give us access to his computer remotely. I sent him that PDF through his email, he opened it and we gained access to his network through that type of attack. All because of using something that was close to his emotions, asking him questions that he was willing to answer, and then utilizing that information in an attack against his company.

Wow, that's just amazing. So PDF files can definitely carry malicious.

Malware then they can PDF especially, and I hate to bash a company, it's not necessarily against Adobe, but especially Adobe because they're heavy on JavaScript. The PDFs themselves are evil in a sense, but JavaScript is. Java has a plethora of vulnerabilities. So a program that relies heavily on that needs to be updated, monitored. And people who think more critically when accepting files that cause those vulnerabilities.

Sure. One thing that Apple likes to brag about is that their computers just don't get viruses. Can you do this? Can you hack a Mac, you know, as easily as you can a PC?

It's funny that you bring that up because I just wrote an article about this. For years Apple on their website had a banner as one of their sales pitches as the reason to buy a Mac was it's not susceptible to PC viruses. Now that statement itself is true. A Mac is not susceptible to. So in essence it was kind of a neat marketing ploy because you could say that 100% not susceptible to PC viruses. Yes, that is true. But there are enough Mac related viruses and Mac hacking attacks out there that Mac people should still be aware of those and they should realize that those attacks are realistic. Now, are they as prevalent as Windows based attacks? No. And that's merely because 90% of the computers in the world are Windows based. So if an attacker is going to go after, they're going to go after low hanging fruit and where there's more availability for them.

Yeah, a hacker, just like any quote, business, unquote person, wants a big market, right? And so the PCs have the bigger market. But what should the Mac people do? What should the PC people do? I mean, I've never understood the world of the antivirus software. How can they possibly know about every piece of malware out there and you know, update? I mean especially the Mac people because I think they're kind of like the overconfident CEO, what should they do? I mean, every PC person with half a brain runs an antivirus system like Norton or something, but Mac people, I don't find that they usually do that.

You know, this is a very bold statement and I might flack for this, but antivirus software is an administrative tool. It's not a security tool.

Interesting. What do you mean by that?

Because of what you just said, the virus that comes out today is not going to be updated in my antivirus until tomorrow or next week. If I'm the unlucky recipient of a virus that is brand new, I cannot be protected from it from an antivirus software package. So do they help? Let's say the majority of users get protected from the everyday Trojan worm and virus. Sure, sure they do. As long as you're using a good one and as long as you're using one that's updated. Now, more important aspect of keeping yourself free from viruses is critical thinking, in my opinion. You know what we see a lot of times with our clients, those who are infected are because they downloaded files without thinking, they opened things without thinking, they clicked on links without thinking. They download every screensaver and toolbar and they let it install. There's a brand new thing out there called ransomware. This is scary as heck. So you download a program that looks legitimate, it comes from a legitimate looking website. You know those really long contracts that you just click yes, yes, yes, yes on? Well, on the bottom of one of these contracts, it basically states in ransomware that we're going to install this program on your computer. We're going to then stop your computer from accessing anything but our website. And if you want us to remove the software, this free piece of software that you allowed us to install, you're going to pay us 19, 20, 30, 50, whatever dollars. And you click yes on it because no one reads the 19 pages of small print. So you click yes. Now your computer's locked up, there's a problem. There's banners that come up and say you want it removed. Click here. You get forced to go to their website and people. Now, of course there's manual ways to do it, but most people don't know that. So they end up paying them the money. And it's all legal because on the legal contract you click yes, I agree to these terms and conditions. So I'm allowing you to install this and I'm going to then pay you to remove it later on. And when you try to sue them or complain, they say, hey, you clicked the legal contract. So I'm sorry that you feel bad about this, but you shouldn't have clicked yes again. Could be stopped by critical thinking and not just downloading programs and installing them by clicking the yes 300 times and then allowing people to take over your computer.

I hate to say it, but there ought to be a law. You know, I'm the last one who wants more government regulation, but some of this stuff is so highly technical that people just don't have time to deal with it. You know what I mean? It's, it's just amazing. Okay, well, what, what other hacks or things do you want to talk about? I guess just kind of take it where you want. There's so much here. This is such a big area.

I think social engineering to me is something that's not discussed enough. So I kind of give you some high praise for being a non security related program that is actually willing to talk about this. If some of your listeners have heard about the group Anonymous.

Sure have. Yeah.

These groups, these hacktivist groups have been attacking companies, let's say, for the last 18 to 24 months. And one of their members who recently left was interviewed by a major news outlet and it was a female member. And she said social engineering was used in every attack that Anonymous launched. And you start to analyze because what happens when these attacks are released on the news. You hear about the server that was hacked, you hear about the website that had an injection on it, but you never hear about the social engineering. And you wonder why. And it's because it's not sexy, it's not elite. Let's say the server wasn't compromised. So you look at a case like a company, whmcs, I think it is, they make web based software that helps invoice and bill clients. Their hack was very simple. A hacktivist group called Ugnazi basically went to the database administrator's social media pages. They built a profile on him. They were able to develop details that probably would be the answers to some of his security questions. They then called the database administrator hotline and said, I forgot my password, can you please reset it? They said, sure, no problem. What is the answer to security question number one? They had the answer because they built the profile off a social media page. The password was reset, they downloaded 1.7 gigs of credit card numbers and then they erased the guy's servers.

Unbelievable. Scary stuff. Wow.

The details of them aren't focused on enough because. Great. 1.7 gigs of credit card numbers, that's probably hundreds of thousands or millions of credit card numbers.

Sure it is. Yeah.

But at the same time, it was done through a simple phone call and social media release information leakage. So I think programs like this are great because they focus on what people aren't hearing. And that's the amount of information that we release on the web is a danger for us. We put everything in our life out there, and it can be used by the malicious people to basically gain the information on us and then infiltrate our databases, our networks, or our personal lives.

Yeah, well, you know, I always found it amazing. You look at something just like Facebook, okay? And people put a common security question is, what's your mother's maiden name? What's her birthday? What high school did you go to? And, you know, people will put their complete school history from kindergarten on. They'll put their date of birth, they'll show who their family is because you can use them as a special, like, friend category, your family. Right. And you'll have the mother's maiden name. It's shocking that we're still using these things as security questions. You know, you can call everybody, does business with pretty much a few major banks, so you could call up and impersonate the person pretty easily. I mean, it is scary as heck. Now, granted, some of these security questions are getting a little bit better, like, what's your favorite color? Who was your first crush? Or where did you live when you were five? But even that stuff can be figured out. It's voluntarily posted, right, on Facebook half the time.

Last year, there was a string of celebrities who had their email accounts hacked, and then their pictures of their breasts or nudity all over the Internet spread. That was through exactly what you just said. They basically just went to the celebrities social media pages, built a profile on them, went to their Gmail, Yahoo, Hotmail, whatever account, said, oh, I forgot my password. Please remind me of my password. And they just answered the three security questions, which were all goofy things like, where'd you go to high school? What's the name of your dog? Which your mother's maiden name? Which all these things were on their social media pages and answered those questions, Got an email sent to them with a password reset link, reset their password, went through their sent mail, found these pictures that they posted, and then basically stole them and put them all over the Internet.

Which email accounts are most susceptible to hacking? I mean, I remember someone hacked Sarah Palin's Gmail account. I remember that a few years ago, heard it on the news, like, is there one that's better than the other.

By any chance necessarily that there's one that's better than the other. It's the security of the password. So people will choose very weak passwords. You know, when Sony hacked by Anonymous and they released 200 million account numbers all over the web, the passwords that were released were analyzed by a few security researchers and they found that the most commonly used Passwords were between 6 and 8 characters. A 6 and 8 character password can be cracked by a rainbow table in under 10 seconds.

What's a rainbow table?

Table is a database of pre computed hashes. So a hash is like a digital fingerprint for a password. And normally what you have to do when you want to crack a password is use a big powerful computer to calculate what the hash is for each character and then compare it to the hash that you have and see if it compares and then say yes, I got it. But some of these guys figured out, hey, we can pre compute all of those hashes and then all we're doing is a basic lookup in the database. They're able to crack passwords at lightning speed. Now 6 to 8 characters. Within seconds those are cracked.

So how long should someone's password be?

Well, that's a really good question. You know, they're saying that anything under 14 characters is weak.

Anything under 14, 14 characters and more. And how often should someone change their passwords?

Well, this is another big thing that that information from Sony was found a people reuse their passwords everywhere. So let's say your password is super secure. Let's say you have a 20 character password that has numbers, characters, upper and lowercase, it's got everything. And you use the same password everywhere though, then if one and now your password secure. But let's say their databases aren't and that website gets hacked. Now the first thing that these hackers do is they say your email address, they find out every social media account, banking, whatever, and they go and they test that password against all your other accounts. Because 78 percent in the Sony case it was over 80%, I think 90% reuse their password on other sites. So password reuse is another big issue.

I've always thought password reuse is a huge mistake. But what should someone do? How should they remember all of these passwords? I mean, easily anybody who's an Internet oriented person living in the modern world, especially if you're in business, you're dealing with a couple hundred different websites. I mean, what do you do?

There are some very good secure password managers out there that are both for Mac and Windows. Another great idea is there's a freeware program called TrueCrypt. And TrueCrypt creates containers, so like little partitions on your drive, little spaces for you to hold files. And the encryption on TrueCrypt has not yet been cracked by anyone. So right now, up to date, it's uncrackable. And you can store whatever you want in your TrueCrypt container. You can store a text file that has all your passwords listed in it. But then when that TrueCrypt container is not mounted, it's not active, no one can access it. So I tell people you have one really, really secure long password for your TrueCrypt container. And then all your other passwords can sit inside there in plain text. But. And that way you can remember them. So you can put, oh, my Google password is this, my bank password is that. But you have one really long one that you remember that's on for your TrueCrypt container or your password manager.

So aren't you trusting then the TrueCrypt company, or whatever company makes that software to. Well, you said, you know, it hasn't been hacked. That's great. But aren't you trusting them not to be malicious or, you know, evil in some way?

Well, you are to an extent. You know, the thing about TrueCrypt, it's not on the cloud, quote unquote, it's not sitting on the web somewhere. It's actually handled right there on your computer. But you still are. Anytime you download third party software, you are trusting that company to not be malicious and to do what they say they are doing. That is always an inherent risk. And someone in my field, like me, it is true, we can go around this circle for weeks because I'm one of those guys who's like, overly paranoid. So, you know, anybody can, can be anything. You know, anything could be a way into your life, a way to hack you. So anything could be a detriment. So I do, I do think that. But at the same time, I say at some point if you're gonna have to either the only way to truly be secure is to unplug your computer, get off technology and move to the mountains out in the middle of nowhere.

Yeah. You know, and be Theodore Kaczynski. That's. That doesn't sound very appealing. That doesn't sound very appealing at all. But yeah, you know, you're right. There's just a lot of vulnerability. We'll be back in just a minute.

Now's your opportunity to get The Financial Freedom Report. The Financial Freedom Report provides financial self defense in uncertain times. And it's your source for innovative forward thinking investment property strategies and advice. Get your newsletter subscription Today you get a digital download and even more. The price only $197. Go to jasonhartman.com to get yours today.

Just address one last subject before you go because there's just so much to cover here. I'd love to have you back on for a future episode, but you know, I think it's fair to ask you about probably the most common area in which people are susceptible and that is the area of identity theft. You talked about computer hacking and hacking one's password, and that's, that's a category, a portion of identity theft. But there's much more to it than that. Do you recommend people use these services like Lifelock and you know, I hate to mention their name because there's a zillion others, but what do you think about that kind of stuff?

So do I have time for a short story?

Yeah. Yeah.

Okay. So I had on my podcast, I had a guy who was an ex identity thief contact me, wanted to come on the podcast. I'm usually leery about that because I don't want to promote anything terrible. So I kind of rejected him a few times with his advances. And then basically one day he sent me an email that had every piece of information on me, including my Social Security number, my banking information, my full name, address, date of birth to me. He sent it and I'm like, okay, now you have my interest and me being, you know, Mr. Security. I was like, how the heck did he get all of this? So we had him on the podcast after he told me how he did it so I can fix it before we released it to the public. And he outlined how he was able to perform this attack and get all of my information on the podcast. And I was fascinated because, you know, I have everything locked down. I don't have a lot of information about myself out there on the web, that kind of information. But he was able to impersonate me calling one of these credit banks saying the company had pulled my report for a resume for a job interview and some of the information was wrong and he wanted to verify what they had. And that lady on the phone went through all the information and verified and verified it again and gave him everything that he needed. All of this was done off of just a little bit of information that was on the web that had my name and address listed. So right away I started looking into things like that, like companies that sell this software. Unfortunately, I believe that the guy from Lifelock was actually a victim of identity theft after he put his Social Security number out there.

So I guess Lifelock didn't work then. It didn't protect the owner.

But here's the thing that I found the credit bureaus in America, at least in this country, were able to put on, we're able to do what LifeLock does for money for free. So I'm able to go to Equifax or one of the other ones and I'm able to put an alert on my account that says if anybody tries to use my credit information, you have to first answer these three questions that I choose. You have to answer questions that, that you know, that are things that I tell them and you have to alert me. So you actually have to alert me before you are allowed to use my credit. That's the same thing LifeLock does. The alert comes to me. So now someone tries to use my credit, I'm alerted and they have to know detailed information about me before they're allowed to do it. That, that helps. That, that helps.

But that's just one form of identity theft. That one form is simply the form of credit. People can open bank accounts, they can use your medical history, your criminal, you know, they can create a criminal history on you when it's not even you. I mean there's just so I think there are five basic forms of identity theft, right?

Well, there's another one. I'm not sure you were thinking about this one too, about parents, the credit of their children now, right? Have you heard about this? Parents in bad straits, they get the, of their kids, their minor kids, they get credit cards, loans, and then they don't pay them off. And there's one kid, you know, he realized after he was like graduated from college, went to go get loans and was told he had horrible credit. What do you mean I have horrible credit? Well, you have like 17 year old debt. How can I have 17 year old debt? I'm 19 years old. You know. And finding out that his parents had used his Social Security number to obtain loans and then never paid them off.

Unbelievable. You know, usually that happens the other way around. That's the story I'm used to, is kids getting their parents to co sign on something and then the kids being flaky and not taking care of business and being responsible. But don't the credit agencies know that the kid is two years old? I mean, how do you open credit accounts with a Social Security number of A two year old in that example.

Excellent question. And I would imagine that they falsify the reports on that as far as birth date and things like that. I would imagine that there cannot be legitimate loans given to a two year old or to an infant. But these things, these things occur, you know, they occur. They also, another big one is the databases that are out there that release information about people have passed away. There's actually databases online that will give away the Social Security number of deceased people. So you find someone who just died, maybe the same age group as you, and you just take their identity.

Unbelievable. This is just amazing. It really is. So your verdict on identity Protection services like LifeLock? Yes. No. What?

Well, I'll say this. They have a value.

Better than nothing.

Better than nothing. They have a value. But there are also, with a little bit of effort, there are more things that could be done without spending the money. There are more things that can be done to protect yourself. The problem I have, and it's similar to antivirus, like when I said antivirus, was it a management tool, an administrative management tool? People get antivirus and then they say, oh, I'm protected, I can click anything because antivirus will save me. And people get things like lifelock and then they forget to critically think and they think that they're protected. So regardless if you use antivirus or you use a service like LifeLock or something else, it still doesn't absolve you from having critical thinking structure in your life. Those things are not 100% protective measures. You still have to be able to plan out what's going to happen if you get attacked. You still have to be involved in keeping yourself secure. Those things aren't a protective bubble around you.

Yeah. And in some ways they may be detrimental because they create a false sense of security and a complacency, don't they?

That's my point. You know, that's what can happen if you're not a critical thinker already. I've seen too many times people get antivirus when they buy their computer and they say, well, I have antivirus. How did I get this trojan on there? Well, you realize that since they bought the computer, the free 30 day version of McAfee they had has expired. They never renewed any type of antivirus, they never updated the antivirus database. So now here they are with the antivirus on their computer thinking they're protected, but they never did anything to take that protection further.

And one last area of this, all of these different websites out there that they're not Voluntary, they just keep databases like peoplefinders.com, spokeo, these types of websites where people can find out your mother's maiden name, your date of birth, their date of birth, it's just all pulled from public records. How do you get your name out of those things? I mean, I know you can opt out individually, but there's so many of them. First problem, there's so many of them, they all have different opt out procedures. Second problem, third problem, is that I hear that you can opt out, but six months down the road you'll be back in. You have to keep opting out. Any suggestions on those things? I mean, those are just a nightmare.

Fortunately, no, there are no good suggestions because exactly what you said is the problems, you can go and do all the hard work, get yourself opted out. And there is no 100% guarantee that the next time you apply for a credit card online that your name will not be sold to the next database list and back on all those websites.

Unbelievable. These sites have your school records, your birth records, your licensing records, if you own airplane registered, a car registered, a boat registered. It's unbelievable. I mean, and it's just free access to all this stuff for $2.95 and you can find out all this stuff about anybody. It's amazing.

With like you said, Spokeo, anyone can sign up. You don't have to be a pa, you don't have to be law enforcement. Anyone can sign up. You can get like the unlimited, you know, forever plan for like 36 bucks and you can search as much as you want. And the information is so detailed at times that I'll sign up for those and then do searching on myself at times and see what they have on me. And it's amazing how I'll go like, oh, yeah, I forgot about that all the way back there like 18 years ago.

But you're an expert. You understand the threat here of getting hacked, if you will, of having your life hacked. What do you do? Do you just keep opting out? You know, I suggested, I have a friend who works for LifeLock and I suggested to her, I said, you know, one of the great services they could offer is a way to opt people out of all these databases out there in addition to the credit monitoring and that type of stuff that they do. I think that's big business right there, helping people opt out of all this stuff.

Think that that kind of a service would be unrealistic because there'd be no way someone can promise that because these websites pull from so many data sources that it would literally be a full time job for a team of people to handle one client. What I do is I spend my time really practicing critical thinking. I know it sounds like a broken record, but I used to have this philosophy that if I get hacked, here's what I'll do. I now have the philosophy when I get compromised, here's the way I'm going to handle it. And it's no longer an if, it's a when because it's just so prevalent. And I start to think to myself, okay, here's the information that's out there. What can people do with it? And what do I need to do to protect myself from it being used maliciously?

And one of the other things is just stop applying for credit cards, isn't it? I was at Nordstrom the other day and they were having a sale for card members and I had a Nordstrom card. I haven't used it in forever. And so, you know, I picked out a few pieces of clothing and the clerk that was helping me, she said, well, you know, let me just call and get your Nordstrom account number. Well, it turns out I haven't used the account in so long they closed it. So they said, look, you can buy all this stuff on sale today. And the sale was actually pretty good. Plus we'll send you a $20 gift certificate. And you know, all this stuff if you sign up. And I'm like, no, I just, I just don't, I just don't sign up for these credit cards anymore.

Yeah, that. Well, you know, those, especially the cards that come from department stores. Those lists are used in marketing campaigns. You remember the. You might have heard the news story about the teenager who they sued Walmart, I think. Or was it Target? It was one of the major department stores because they sent her a congratulations on your baby notice before her parents even knew that she was pregnant.

Unbelievable.

About baby products. They assumed by her gender, her age and what she was searching for that she was pregnant. And they sent her a congratulations on your baby. Here's some coupons for your upcoming pregnancy. And you know, her parents didn't even know that she was pregnant, but because of the data collection that these websites do, they were able to discern scary stuff.

I think privacy is dead, you know, that's just. This is really scary stuff. It's amazing. A friend of mine, she got engaged and as soon as she changed her relationship status on Facebook, all of the ads in the right hand side of the column just started instantly changing the second it happened. It's amazing in one way. On the face of it, it seems kind of good that we can be offered what we want, what we're interested in. That's sort of the promise of the modern Internet. But on the other hand, it is so scary that this can just happen like that. So. So, wow. Give out your website if you would. Tell people where they can learn more. And hopefully we don't have to spend our whole lives managing our privacy and the threat of being hacked. But I think we do have to spend some time on it, no question.

Well, my framework and the podcast and newsletter are housed on social-engineer.org and then if you're interested in finding any more about the commercial services@social dashengineer.com Fantastic.

Well, thank you so much for joining us today. And where should they get the book?

The book's on Amazon. There's also a link to it on both the dot org and dot com sites that will take you right to Amazon. It's Social Engineer, the Art of human hacking. So they can check it out either on any major bookstore, actually. I've even seen it in brick and mortar stores like Barnes and Nobles and Borders and things like that. They have it anywhere.

Fantastic. Well, Chris, thanks so much for joining us today. Really fascinating topic. Scary stuff out there, folks. Pay attention. Be a critical thinker. Good advice today. Thank you, Chris.

Thank you.

Thank you for joining us today for the holistic survival show protecting the people, places and profits you care about in uncertain times. Be sure to listen to our Creating wealth show, which focuses on exploiting the financial and wealth creation opportunities in today's economy. Learn more at www.jasonhartman.com or search Jason Hartman on itunes. This show is produced by the Hartman Media Company offering very general guidelines and information. Opinions of guests are their own and none of the content should be considered individual advice. If you require personalized advice, please consult an appropriate professional information deemed reliable but not guaranteed.