Delivering yourself to a kidnapper

If you are interacting with somebody and the offer seems too good to be true, it likely is. If it is a non standard communication you know that you're receiving from your bank or a peer, it is likely to be fraudulent activity.

Hello everyone, and welcome to the Cyberwires Hacking Humans podcast. This is the show where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner from the Cyberwire, and joining me is Joe Kerrigan from the Johns Hopkins University Information Security Institute. Hello, Joe. Hi, Dave. We got great stories to share this week and later in the show we'll have my interview with Matt Devoe. He's from a company called OODA LLC and he's going to share some stories about impersonation. So stay tuned for that. But first, a quick word from our sponsors at KnowBe4.

So what's a con game? It's fraud that works by getting the victim to misplace their confidence in the con artist. In the world of security, we call confidence tricks social engineering. And as our sponsors at KnowBefore can tell you, hacking the human is how organizations get compromised. What are some of the ways organizations are victimized by social engineering? We'll find out later in the show.

And we are back. Joe, why don't you kick things off for us this week?

This one comes from the Military Times and they have a section called Reboot Camp. They had a story about one of their sites. The US Military has a program for servicemen and women called the Transition Assistance Program.

Okay.

Or tap. And this is a program that helps people at the end of their service transition to civilian life.

Ah, okay. Makes sense. Yep.

Of course this program has a website. It's dodtap Mil.

Okay. MIL is generally the military. Or that is a military domain name.

Right. It's almost. I think it's exclusively US Military.

Okay.

If you go there, you will most likely get a certificate error because many DoD sites require the installation of their own root CA certificates.

Okay, what does that mean?

That means that the DoD doesn't trust people like VeriSign. They have their own root certificates that are usually installed on computers at the DoD and at a lot of contractors.

Oh, I see.

Someone set up a website called dodtap.com. this is presumably to lure in people who are going to dodtap mil or should be going to dodtap Mil. And it then tries to collect some personal information from them and install malicious software. I went there On a Chromebook, not on a Windows machine. And I got a voice prompt saying to continue, click Add to Chrome. It took me to a page that looked very much like the Chrome Web Store. I closed everything and walked away from this. This was obviously some kind of malicious site. I think it's still a malicious site.

So they're trying to get you to install a Chrome extension, right?

Yeah. And God only knows what that does. But the root of the problem here is the social engineering technique that they're registering domains that look similar to other domains.

Right.

And it all hinges on this thing called a top level domain, or TLD.

Okay.

And you all have seen TLDs? We've all seen them, but without getting technical. It's the last part of a domain name.

Right.

And your computer reads these domain names backwards. So if I type in www.google.com and my computer doesn't know where to find it, the first thing it does is it. It knows where the dot com directory is and it goes to the dot com directory and it says, where's Google? The dot com directory says, Google's here. And then it goes to Google and says, where's www?

I see, right. Okay.

Yeah.

So you can think of it as like the old phone books, right? You remember the old phone books, they had a. They had three sections in them. They had the white pages, then they had a little blue section for government pages. And then after that there was another section of white pages that was businesses. If you wanted to look up a person, you'd look in the front, a government person, you'd look in the middle and A as you'd look in the back.

Right.

Originally There were only seven TLDs, top level domains. There was the.comorg and.net, that anyone could register.

Right.

There was.int and these all still exist, by the way, of course.

Okay.

There's.int for international organizations that are formed by a treaty that require at least two people to be in the organization. And then there was Edu Gov and mil, which are pretty much only US Educational, government and military organizations.

Okay.

Then we started getting these country levels TLDs. These are all the two level TLDs that we see. So like if you go to a page in, in the UK, it'll usually end in.uk right. And a lot of times governments will maintain their own directory services and such so that they can allocate their own domain space within that. So a lot of times you'll see like.com.uk which is not a.com address, it's a.uk address. So your computer goes out to the.uk server, says where can I find.com? and it goes to a different.com server that's different from the one when you enter something like google.com.

I can't imagine how any of this could be confusing, Joe.

Exactly. That's kind of the point. Because this is so confusing and convoluted, it starts to be a great point for social engineering.

Yeah. Okay.

There are now 1500 top level domains that we can all use. And let's say, for example, I wanted to spoof a military website. You know, the first thing I would do.

Go on.

I would register a domain using Molly's address. Right. Their top level domain is ML, which looks very similar to mil. And anybody can register a domain name there. Some countries have actually monetized this. Like Tuvalu sells all of their top level domains because they end in tv and that's easy to remember, right?

Oh, right.

So they actually have a company that they work with, Verisign, where they've set up this thing and they own 20% of the company and they get 20% of the revenue.

Right.

Some companies like Tanzania and Africa don't do that. Have a presence in Tanzania to get a TZ address. But Mali will sell it to you. So if I was going to attack a military address, I would go out and register ML address. If I wanted to defend a military address, I would do the exact same thing. I'd go out and buy that domain under the ML address. Top level domain. Yeah.

And we hear these stories about folks who go out and do that proactively. They go and look for every possible variation that they can think of of their own domain name. Buy them up so that someone else doesn't.

Exactly. So that no malicious actors can get in there. Like to your point, Dave, Google. Actually, if you put in three O's in Google, it'll take you right to google.com.

Really?

Right. Yep. Because Google has gone out and bought Google and they've redirected it back to their page. So.

So how do you protect yourself against this, Joe, As a user?

Yeah.

You just have to make sure you're going to the right website. My best recommendations, Vigilance. And I would say just go to Google and search for the URL. Don't type it in yourself on this one. You know, I do this with a lot of my financial websites. If I want to go to a website and I don't have a bookmark for it, the first thing I do is I go and I search the site because they'll come up as the first hit on Google.

I guess Google's pretty good at keeping the bad guys from bubbling up to the top.

Yeah, it's not foolproof. Nothing's foolproof. The. The only solution really is vigilance. Yeah, vigilance on the part of the user. And if you own the domain that you think is going to get spoofed, go out and buy the spoofable copies of the domains too. But you can't buy them all. You really can't buy them all.

There isn't enough money in the world to buy them all. It's interesting. It's a good story. My story this week also has to do with Google. Google has a home security system, by the way, I should mention this came from our friends over at Naked Security at Sophos. They have a home security system which is part of the Nest line of products that Google bought up a few years ago. So this is a smart security system. You have a base station and little units around the house that you can put on windows and doors.

It's one that you can install yourself, right?

Yes, you can. You can. You can sort of dial in how much you want it monitored or not, or how much you want it to alert you and all that good stuff that these smart systems enable. So Google sent out a message to their users recently that said, good news, you can now use Google Assistant from your Nest secure system. Now, Google Assistant, of course, is Google's smart device where you can say you can summon the assistant, ask it a question or ask it to play a song, or in this case, you could ask it to enable the security system and so on and so forth.

Right.

Well, this sounds like a good thing.

I'm not sure it is. Old Suspicious Joe has his doubts.

Yeah, inquisitive users started wondering, how exactly does this Nest security system hear commands? It must have a microphone.

Of course it has to have a microphone.

Right. And Google said, oh, you mean this microphone, the one we've been building into these devices but didn't list in any of the technical specs?

They didn't list it on the technical specs?

No.

Interesting.

Yeah, it's active now. But good news, you can disable it if you choose. So this is an interesting case here I wanted to talk with you about, because people are taking issue that none of the previous technical specifications for this device listed that it had a microphone built in.

Yeah, I don't know if that's an oversight Or a deliberate omission. But that's not right.

Well, the Google spokesperson, they said the on device microphone was never intended to be a secret and should have been listed in the tech specs. That was an error on our part.

Okay, this is from Nest though, right?

Well, it's a spokesperson from Google.

Is this a product that's like a legacy product from Nest?

That's an interesting question, but I would say I think it's been around long enough that we can probably have Google be on the hook for this one.

Yeah, okay, I'm with you on this. I'm not trying to excuse Google.

No. I thought to myself, well, I'm surprised no one had discovered the microphone because what's the first thing that happens when any new device comes on the market? Somebody buys one up and tears it down. I couldn't find any teardowns of this particular device. I did a couple of quick Google searches, searched on YouTube, all the usual places, and I couldn't find a teardown of this specific device. That surprises me.

There was a recent, I think it was hacker giraffe who found a bunch of printers online, but also found Google assistance open to the Internet with universal plug and play that when you connected to them you could actually get in and look at the noise levels that the microphone was seeing. You could hear what was happening, but you could see the levels to, you know, I guess you could extrapolate from that whether or not they're somebody's home or not.

Yes, yes, I did see a story about that.

I'm wondering if this has the same kind of vulnerability. I'm not sure it does. It's speculation on my part. One of my favorite pastimes.

Yeah. But I'm curious, you know, part of why I wanted to include this is that I think this is kind of representative about shifting attitudes towards our privacy.

Right.

That people are more and more feeling not okay with these sorts of capabilities being in devices without being informed about it first.

Right.

Let me know that it's in there. That way when I'm making my purchasing decision, I can make a purchasing decision based on that and whether or not I want to include that.

Here's the most. I don't know if it's ironic or what, but I can actually see a legitimate reason to have a microphone on a home security system.

Sure.

Right. Let's say that you actually have the. Have a service where someone can talk to you while you're in your house.

Right.

Or your security system goes off and then some security service provider is listening in to see what's going on in the household. Yeah, right. What's being said is somebody in danger. That's a legitimate use case to have a microphone.

Sure. And I think there are plenty of security systems that they sell that as a feature.

Right, right.

Also, someone pointed out it could be used for sensing broken glass.

Yeah.

Broken glass sensors sound of that sort of thing.

Yeah, yeah, absolutely. No, but tell me it's there.

Exactly.

Tell me it's there.

Right. That's the point. I guess it's a tough oversight to forgive when you're listing all the tech specs of something. The fact that something has a microphone.

And you don't put it in the tech specs.

Right, right. So that's my story for this week. It's time to move on to our catch of the day. Our catch of the Day this week comes to us from a listener. His name is Kevin. Kevin actually dropped off a postcard at our studios. Now that is fan dedication.

That is f dedication.

He flew all the way across the country to deliver this postcard by hand. I'm kidding. He works here at Datatribe, but he brought it in and dropped it off at the studio. And this is a postcard and it says FWT reference number, and it has a handwritten reference number on it. And it says, our attempts to reach you have been unsuccessful. Please call us at this number anytime, day or night to reschedule your delivery with our automated request system. FWT cannot accept calls from spouses, roommates, or any person other than the name that appears on this notification. And on the side it says missed delivery notification. There is a. The most clip art looking. Bit of clip art that looks like a paper airplane, which I suppose is some sort of delivery thing. Here, let me hand this to you. You can take a look.

Let me look at this here.

So I went and looked this up on Google and sure enough, it's a scam.

It's got a handwritten number on it, too.

It does. It's a scam. This is an attempt to get you to call them. So let's think this through. Someone comes to your house and they miss a delivery. They're then going to leave address, a postcard and mail it to you, right? No, they're going to leave something, a.

Post it note on my door.

Exactly, exactly. So evidently this is a common scam, that people are sending out these postcards and they're trying to get a live one on the phone. You call them and then off they go with you.

Should we call this number well, if.

We weren't in Maryland, we would.

Okay, yeah, that's right.

But we can't. It's not illegal here. But what's interesting to me is that there is expense that goes with this.

Right.

They paid for a postcard to have.

That mail postcard to get printed up. They paid for a stamp, they hand wrote an address.

Right. It must be worth the return that they're getting off of this. But if you go and look this up, there are lots of scams that follow this pattern of being sent a postcard that says you missed a delivery and that's how they get you to call them back. And then once you're on the phone, then you start down the path with them and I imagine they want you to pay something to get a fake package delivered.

Or who knows?

Well, I mean, if you call this number and then you enter this code, this reference number, I can imagine that happening first. I don't know what happens when you call this, but they immediately now have your telephone number as well as your address.

Right, right. And so like we've said before, some of this could just be a filtering process.

Right.

They're looking for folks who are susceptible to these sorts of things. And we got a live one on the phone.

Away we go.

And who knows what they're going to hit you with next.

I really call this number.

I know you do. Well, tell you what, you call it and we'll follow up next week and you can tell us what happened or you can describe it.

I wish I knew where there was a payphone.

Just borrow your wife's phone. No.

Can I borrow your phone, Dave?

No, you may not. No, you may not. All right, well, thanks very much to Kevin for dropping off this postcard for us. That is our catch of the day. Coming up next, we've got my interview with Matt Devoe. He's from OODA LLC and he's going to share some stories of impersonation, among other things. So stick around for that. But first, another message from our friends at KnowBe4.

And now we return to our sponsor's question about forms of social engineering. KnowBe4 will tell you that where there's human contact, there can be con games.

It's important to build the kind of.

Security culture in which your employees are enabled to make smart security decisions. To do that, they need to recognize phishing emails, of course, but they also need to understand that they can be hooked by voice calls. This is known as vishing, or by SMS texts which people call smishing. See how your Security culture stacks up against KnowBeFor's free test. Get it at knowbefor.com PhishTest that's K-N-O-W-B-E the number4.com PhishTest.

And we are back. Joe. Recently I had the pleasure of Speaking with Matt DeVoe. He is the head of a company called OODA LLC. He joins us to share some stories about impersonation and some other things that they do there at OODA. Here's my conversation with Matt DeVoe.

I've seen multiple types of impersonation take place, usually against high net worth individuals or folks that have some sort of celebrity status or influence. And it takes multiple different forms. The first is where they might set up some sort of presence or impersonation via an email address that is not affiliated with the individual. And in that instance, they're obviously trying to establish relationships, push a particular agenda. There's some kind of detailed examples I can give surrounding that as well, but it doesn't involve the compromise of any personal information. And the individual target does not know that this is happening unless they're monitoring for it or somebody alerts it. Another type of impersonation is one that actually involves a direct compromise, typically of the email account for the individual that's being targeted, in which case they will study the habits of that person. They will study the manner in which they engage in business. I've seen it multiple times in which it was used for engaging in fraud and it was fraud around investment in international companies. So they might break into the email inbox for a person who is a high net worth individual. They see what types of companies are they making investments in, who do they tell on their staff or in their family office to send the money in order to make those investments. And then using that person's legitimate email address, they generate a fraudulent request to that individual. They say, hey, I'm investing in this company overseas. I need you to wire money to xyz. Here's the bank account information and the transaction processes. And they continue to do that for as long as they can until they get detected. In the cases that I've worked, the individuals actually spend months studying the target because what they want to do is develop a plan that has the highest probability of success. I've also seen them map it to the travel patterns of the person that they're impersonating. So if they know that they're getting ready to go on an international flight or there might be some sort of anomalies in the way that they communicate or time zones, et cetera, they'll take advantage of that access to that person's schedule to try and time it in such a way as that it might not be detected. I have also seen these attacks be persistent for months at a time before they were detected.

Now, how does it happen that someone could be hanging out in my inbox and using it for these sorts of things and I won't know about it?

Yeah, it's typically they're reading email, so they're studying habits and patterns and then they are generating a message from your inbox the same way that you might via the web interface. And then any responses, they're going in and deleting them or immediately archiving them or kind of moving them out of the inbox. So it's a dynamic monitoring is required in order to kind of remove that message thread. But in these instances, it tends to be individuals that get high volumes of email, they don't get immediate attention. There is a window in which the attackers are able to go in and kind of manipulate the inbox to make sure that the response to a request is not being seen by the authentic individual.

This notion of social engineering being used as a lure for kidnapping. Can you take us through what have you seen here?

Yeah, I've seen one case in particular that I'd like to highlight for folks where someone was impersonating a broker for a high net worth individual. So, you know, claiming to have this person in their network as a potential investor and then also impersonating the high net worth individual themselves. So was a entrepreneur who had successful exits previously. You know, was a successful entrepreneur starting a new company that was looking to get funding. An individual reached out to them saying, hey, I know you're trying to get funding. I'm happy to broker an introduction to this high net worth investor that I know. Would you like that? They said, sure. Anybody who's in that fundraising cycle is willing to talk to anybody. The broker makes the introduction, business plans get exchanged, et cetera. And it turns out that the attacker was impersonating not only the broker making the introduction, but also the high net worth individual. And where it gets really interesting is that the impersonator basically said, hey, I really like your business plan. This sounds like a weird request, but I've got to speak at a conference down in South America next week. How about you fly down? I've got this afternoon open. Let's spend the afternoon together. If I like your business plan, then I'll invest in your company. That individual was very, very close to Buying a ticket and kind of hand delivering themselves down to South America. Keep in mind they're already a successful business person, so a nice lucrative target from a kidnapping perspective, something. And this is what usually happens with social engineering, there is some gut intuition that caused the person to pause, caused them to try and reach out to this broker through an alternative mechanism and quickly discover that the broker had not been communicating with them, had not facilitated this introduction, and therefore did not make the tr. So we didn't send a decoy down to see whether the person was in fact going to get kidnapped. But we felt like that that was the intent was to get the person kind of in country and deliver themselves to you, and then you've got them, you know, kind of under your control and are able to go through the kidnapping ransom process.

Now what sorts of preparations do you do when you're working with folks to help provide them with some resiliency when it comes to defending themselves against these things?

Yeah, there's a couple things that we recommend that will sound like common sense but are not frequently implemented. The first is to have some resiliency in the processes that they use or transferring of money or authorization of funds transfer. We've seen very kind of fast and loose processes where a fund request transfer request can be initiated via email with no callback, verification, things of that sort. So we always say that put some sort of process in place that has some resiliency that involves some sort of verbal communications where you can authenticate so that you don't have this instance where somebody just sends an email and is able to transfer $500,000 $800,000. Again, it sounds simple as encouraging these individuals to enable two factor authentication for access to their mailboxes. In almost every instance, having two factor authentication enabled would have prevented the attacker from being able to get access to the inbox. Another issue that is often a nexus for these types of attacks where an inbox is compromised is the reuse of passwords. One of those examples I gave you, the individual was using the same password for their email as on another social networking site. The social networking site had a compromise of credentials, the password was compromised, and the attackers were just going through the Rolodex of compromised accounts looking for individuals that looked interesting and then trying those credentials against other resources like mail accounts, et cetera. And in this instance it was the same password on both accounts. And thus they got that unfettered access into the person's inbox. If two factor authentication had been enabled, it wouldn't have been an issue if they hadn't been reusing the password wouldn't have been an issue. So simple steps you can take to kind of protect your individual accounts and then some simple steps you can put in place to reduce the fraud component of this, which typically involves exploiting the wire transfer processes that these individuals have.

I'm curious that when it comes to high net worth individuals, I'm thinking of high level executives and so forth. One of the most valuable resources they have is their time. It strikes me that they often have a lot of people who are helping them maximize the use of their time. They have people assisting them with, I guess, a lot of the things that you and I would be handling ourselves day to day. I wonder, does that make them more susceptible to these sorts of social engineering things to have more people involved with the things that they handle day to day, does that provide avenues for folks to get in and take advantage of them?

I think it does. It definitely contributes to these what we call weak processes for how business interactions take place, particularly around investments where somebody is empowered to engage in a wire transfer based on email authorization alone. That definitely contributes to it. I think also there's just also a lot of noise gets generated. I mean, we've seen other forms of impersonation where an entity establishes a social media account for an influential individual that is not them and uses it to gather a lot of followers and then uses that to generate some sort of momentum towards a, you know, kind of work from home type fraud schemes. You know, here's your best guide to becoming a millionaire like me. Click this link and they've established 20, 30,000 followers on this platform that all click the link. And that's just another instance of for some of these individuals, there's so much occurrence of their name that takes place. There's so much activity out there that unless they're actively monitoring, they're not likely to pick that up in the early instances of that impersonation taking place. So the busyness and the noise that exists in the network just naturally based on who they are and the volume of mentions around their name, et cetera, certainly contributes to the problem.

So what are your recommendations for folks who are just living their day to day lives, not necessarily high net worth individuals? What sort of lessons can they take from the types of things that you've learned dealing with these types of situations?

The lessons are relatively similar. We always encourage people to enable two factor authentication that's true for not only access to their mail and social media accounts, but enabling two factor authentication for access to Banking accounts, et cetera. And then the other piece of it is a healthy dose of skepticism in their online interactions. If you are interacting with somebody and the offer seems too good to be true, it likely is. If it is a non standard communication that you're receiving from your bank or peer, it is likely to be fraudulent activity. Right. So to understand the ways in which the entities that they transact with will communicate with them, being skeptical, you know, making sure that they're not clicking on links and engaging, providing credentials into untrusted sites. There's just a user awareness component of this. So there's some technical mitigations, enable the two factor authentication, and then there's some kind of social engineering resiliency that you can build up to make sure that you are at least applying a first order level of scrutiny on the incoming requests that are coming into your inbox.

Joe, has anyone ever attempted a kidnapping on you?

No, Dave. I weigh too much. That's kind of my defense against being kidnapping.

There's a flop down on the ground. Undragable. Got it. Okay. Very good, very good. It's good, it's good. Whatever it takes.

That is a terrifying angle to this. They were trying to lure this guy to South America where kidnapping is actually kind of a business down there and it has been for for decades. We see these criminal organizations. Actually organized crime is nothing new, but the level of organization that we're seeing in cyber attacks kind of is a relatively new phenomenon that we're. Well, it's not really a phenomenon. It's a natural order of things, I think.

Yeah, but the ability to use social engineering to get you to deliver yourself to them.

Right, right. Through business email compromise.

Right.

It's interesting. These things go on for months and these attackers are studying your email writing habits. We're seeing this more and more. More come up in these stories and it's no longer amateurs doing it. Two factor authentication helps a lot.

Yeah. It also struck me, for example, like if you're using Gmail, it will alert you if someone logs into your account from a new machine.

That's correct.

Yeah.

And so to me that seems very helpful.

Very helpful indeed.

Yeah. But yes, two factor, absolutely. I just think we're in an era now where if something's important to you, you can't just rely on a username and password. You have to have some sort of extra factor there.

Two factor that. Yep. The other thing, tighten up your processes. If you are a high worth individual or you, or you are in a business that's high worth, have A process that says whenever I'm transferring more than X number of dollars, whatever your risk level is that that involves a phone call back to the person who requested the transfer.

Right.

A simple thing like that can prevent many thousands of dollars from leaving your organization very quickly, probably never to be retrieved.

Oh, we had a story that we talked about a few months ago where someone was in the process of spending a lot of money for an organization and the person who was being impersonated was just a few doors down the hall.

Right.

But they didn't bother to. What finally put it to an end was someone walking down the hall and mentioning this request. And the person said, I didn't make that request. So yeah, absolutely.

That was the itunes gift card, Google.

Gift cards, I believe.

Google gift cards. Right, because Google said. That's right. Because Apple would have said we could help you, but Google said no, something like that. I don't know if Apple would have said they could help you, but the retailer wind up helping.

Right? Yeah. But your point is a good one. Almost every week we say this, slow.

Down, slow down, slow down, cowpoke.

That's right. That's right. All right, well again, thanks to Matt Devoe for joining us and we want to thank all of you for listening. And of course we want to thank our sponsors at KnowBe4. They are the social engineering experts and they're the pioneers of new school security awareness training. Be sure to take advantage of their free phishing test which you can find@knowbe4.com phish test. Think of knowbe4 for your security training. Thanks to the Johns Hopkins University Information Security Institute for their participation. You can learn more about them@isi jhu.edu. the hacking humans podcast is proudly produced in Maryland at the startup studios of Datatribe where they're co building the next generation of of cybersecurity teams and technologies. Our coordinating producer is Jennifer Ibin. Our editor is John Petrick. Technical editor is Chris Russell. Executive editor is Peter Kilpe. I'm Dave Bittner.

And I'm Joe Kerrigan.

Thanks for listening.