40 billion wreckage being compromised in 2021! #15

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to the Security Guy and the CIA Spy Podcast. I am Robert Siciliano, and this is Peter Wormka, the spy. Hey Peter, how are you doing, Robert?

How's— how are you doing with the weather up there?

It's, uh, it's about 13 degrees today.

Not bad. I mean, not bad. It could be— it could be worse. We're down here, not even with jacket weather. People are in shorts walking around in Orlando. It's crazy. I'll take it.

Yeah, I don't want to hear it. Uh, I, um, saw a snowy owl about 30 feet outside my window today, perched on a rock right near the ocean.

That's beautiful. I don't get that.

Yeah, it was awesome. Yeah, well, my father— I took a picture of it, sent it to my father. My father's a birder, like he eats birds, and he's been all over the world birding. He's seen like, like 1,000+ different birds, and he said it was a female because of her size and her color. Like, he knew that from just seeing it from a photograph, which is kind of cool. Yeah, uh, the reason I learned about it was because my dog started barking at it and brought attention to it, and so the whole family was looking at the window going Wow, look at that snowy owl.

So yeah, no, they are beautiful. That's a great treat. I don't— that's, that's nice.

Yeah, yeah. So, uh, look at lots going on out there as we know, right? Let's get right into it because, uh, time's a-wasting here. Um, look at Security Boulevard says that more than 40 billion records exposed in 2021. Okay, 40 billion, right?

That's incredible. It's— how do we get our hands around even a billion? I can't It's very hard to comprehend that amount of records, and it keeps on going up, doesn't it, Robert?

It does. So I believe in the first half of 2020, I saw some stats like $27 billion. And so here we are, 2021, about $40 billion exposed. Now, Security Brief Asia is reporting new research from a company called Tenable, and they calculated almost 2,000 data breaches And look at, you know, long story short, it's getting worse, it's not getting any better. And that means that, um, there are misconfigured, uh, systems out there where your CISO or CIO isn't properly configuring them, and/or you have users inside, employees that are, are engaged in workarounds to circumvent the system or circumvent security. And they're creating vulnerabilities in that network. And/or people are being tricked, socially engineered, into providing access to those various networks, like access to VPNs that may not have two-factor authentication, access to email that might not have two-factor authentication. They're coughing up usernames and passcodes, they're downloading viruses. So, you know, this all boils down to the organizations themselves taking control of those networks, engaging in proper cyber hygiene, and making sure they're teaching security awareness. Peter, what do you think?

Absolutely. You know, for those out there who say, well, it will never happen to me, I'm sure many of those said that last year, and I think it causes all of us to pause and say, listen, with 40 billion records and growing, the probability that it will happen to you is, is there. So this is— there's no time like the present to really, really, as you mentioned, Robert, beef up your security, uh, at the organizational level, as well as for the individuals to really, really take ownership of safeguarding information.

And individuals, everyday people, moms and pops, small businesses, like basic stuff, do-it-yourself stuff— updating your operating system, updating your hardware first. You have to have a newer device, right? You can't have an older Windows 7 machine from 2013-14 that can't support, say, Windows 10 and newer antivirus. So update your hardware, update your software, which includes your operating system. You should be on the latest version of, uh, Macs— what, Monterey? Uh, and/or Windows 10, coming upon Windows 11. And then making sure you have antivirus, which also includes anti-spyware, anti-phishing, and a firewall, which generally is a paid version of that. Having a VPN, a virtual private network, if you're on any free Wi-Fi networks to protect your data and device on free Wi-Fi. And of course, you know, using password-protected Wi-Fi at home, in the office, and just being smart about not getting scammed via social engineering scams and phishing. So do the basics, do the fundamentals, uh, watch and listen to this podcast, and you'll be fine, right?

So yeah, the investment is so small. And it can save you so much.

Yeah, it's small in time and money, right?

I mean, it's definitely—

right, just, it's just 101 stuff that we, that we talk about here. All right, so, uh, the state of security. This is Tripwire and Graham Cluley, who's a rock star, uh, security evangelist in his own right, talks about mail— malicious USB drives are being posted to businesses. Posted in UK speak, I believe, means mailed. And so because Graham is from that uh, the other side of the pond, as they say, or across the pond. So a notorious cyber gang involved in a series of high-profile ransomware attacks has in recent months been sending out poisoned USB devices to U.S. organizations, also known as a bad USB attack, right? As The Record reports, which I believe is a UK publication, the FBI, our U.S. FBI, has warned that FIN7 The well-organized cybercrime group believed to be behind the DarkSide and BlackMatter ransomware operations has been mailing out malicious USB sticks in the hope that workers will plug them into their computers.

Yeah, so easy to do. This, this has been around for a long time, and it's so effective. In our penetration testing with clients, we show how easy it is for someone to get into a facility using any one of, you know, a number of types of pretexts. And then once they're in, once they have that unescorted access, how they can leave these different thumb drives around and maybe have them labeled like confidential payroll or something. But this is, this is even easier where they can just put it in the mail. And it's a numbers game, you know, if only 10% of individuals actually, or 5%, will put the thumb drive in a device, or even 1%, you know, that's enough. That's enough, and it works. It continuously works. It's amazing.

Yeah, it works because consumers, employees, we, uh, by default want and need to trust each other. As an interdependent species, trust is a given. And, uh, if you receive a mailer in this case with a USB with a legitimate reason why you need to plug it in, then you are likely to plug it in because you have no reason to distrust the person on the other end. However, simply acknowledging that this is a problem to begin with, that bad USBs are a thing, should make people think twice. And that's what we are here for, to raise awareness in that regard. Peter, you may recall back in, I think it was 2011 or '12, it is believed that the US, along with Israeli intelligence, dropped malicious thumb drives in the parking lot of the Natanz nuclear facility in Iran. With software on it, malicious software, probably one of the first acts of cyber war in order to mess with the Natanz nuclear facility's centrifuges in such a way where once plugged in, it sped them up and burnt them out and caused havoc, deleting files within the Natanz nuclear facility. And I believe they were unable to get that system back up for quite some time. Do you recall that one?

You are absolutely right. That was one of several different ploys or techniques that was utilized in that operation. And yeah, this is public knowledge, but unfortunately not enough people are aware of it. But just look at the level. This was done in a major espionage operation against the state actor of Iran. All right. Now, if it can be done at that level, think about how easy it can be utilized against a small, medium, and even a large company that doesn't necessarily have a policy or an enforced policy about not allowing people to plug in external media devices into the system. Some companies have that policy, some people don't allow it, but there's still so many companies out there that don't have that policy in place that need to.

Yeah, and some of those same companies, they actually glue those USB ports shut. You know, uh, that, that's one way to keep out any, uh, bad USBs. Uh, you know, I think it boils down to recognizing risk and knowing what your vulnerabilities are and knowing this is a fraud and it's a scam. And if you see a thumb drive like in a parking lot somewhere, that you can't just— or you shouldn't just pick it up and plug it in somewhere. That if anything, pick it up and properly dispose of it, uh, knowing that it could be malicious in nature. But if you do pick it up and forget that, you know, where you got it and put in your pocket or briefcase or bag and then put it in your drawer someday and then down the road, like, you need a thumb drive or something and there it is and you plug it in. It may be months or even a year down the road where you actually engage in that malicious thumb drive. So I would be really, really careful in that regard. And even going to conferences, like, I used to—

Oh, yeah.

—go to conferences all the time. And at trade shows, like, there'd be like fishbowls of thumb drives that were branded with that company's name, like, just as a reminder, as like a— as a token, as a giveaway, as a freebie, you know, with like, um, like a, you know, like 15, 20 gigabytes on it or something, which is a useful tool, uh, even something like that, somebody could drop a malicious one in, in that fishbowl and you'd never know it. So you just got to be really careful. I would not buy one unless it was in a blister pack and it was like— and I picked it up at the actual, you know, um, uh, office supply store or bought it online somewhere. And even then um, you need to be careful. You're absolutely right.

And I like the fact you brought up the trade shows because that has happened quite— I mean, there's been targeting at trade shows and that has been a very effective targeting tool. So yeah, you're right, don't, don't plug in. I mean, these things are— I mean, are you trying to save 2 bucks by, by, by— I mean, right? Yeah, just don't even, don't even try it. Don't even try it. Great advice, Peter.

All right, so, uh, right here, the Hacker News talks about how Russia arrests, uh, our evil, evil rebel ransomware gang responsible for high-profile cyber attacks. This is crazy to me.

It's PR, Robert. This is PR. Do you think that Russia would turn on a group like this in the name of, oh, we're doing something, you know, we're cracking down on, uh, on, uh, cyber, uh, threats. No, there are some— there's a backstory to this. I mean, I don't know that I, I have that backstory, but I'm very suspicious there is a reason why this group was taken down at the time it was taken down. Um, there's always a— there's always a backstory to everything.

It might have something to do with, um, Ukraine, possibly. Who knows? Uh, it might have something to do with Russia trying to, you know, put a good face on bad things that they have going on out otherwise. So regardless, in an unprecedented move— unprecedented, right? Unprecedented— uh, Russia's Federal Security Service, FSB, and the country's principal security agency on Friday disclosed that it arrested several members belonging to the notorious REvil ransomware gang and neutralized its operations. So the surprise takedown, which it said was carried out at the request of the US authorities— at the request of the US authorities, right? PR. PR. Saw the law enforcement agency conduct raids at 25 addresses in the cities of Moscow, Saint Petersburg, Moscow-Leningrad, and Lipetsk, uh, regions that belong to 14 suspected members of the organized cybercrime ring. 'in order to implement the criminal plan, these persons developed malicious software, organized the theft of funds from the bank accounts of foreign citizens, and their cashing, including through the purchase of expensive goods on the internet,' the FSB said in a statement. Like, look at all the— what is it, rubles? Rubles?

Those are your— are those euros?

I think it said rubles. Okay. Yeah, which is Russian cash, right? Yeah, rubles. That is cash. I mean, cash is king, even rubles. So interesting.

We've known for a long time that Russia has pretty much allowed groups like these to operate without any serious restrictions other than there are certain targets that they cannot go after. They can't target Russians, they can't target inside of Russia, but being able to target outside of Russia, generally Russia has given them their blessing and even leveraged these groups in undertaking attacks that could be of interest to Russian intelligence. So I think this comes down to the point of it provides a little bit of PR where Russia can say, oh, we took down this really important group to help you, America. And there's probably some other bad blood between individuals in this group and maybe Russian intelligence, who knows. But I mean, there's, there's definitely something behind it, and it's not, in my opinion, a show that, oh, Russia is cooperating with the United States. Not at all, in my opinion.

Yeah, yeah, I, I would like to see how this one plays out and what the, what the PR motive behind that ultimately is. And I'm sure eventually that'll come out. I mean, unless of course we start to see one cyber gang after the other taken down, right, and we see like ongoing cooperation from Russia, uh, then otherwise this might be a one-off, you know. Look, the reality of it is that unchecked, if these cyber gangs go on unchecked, whether they're going after, you know, a retailer or bank for that matter, critical infrastructure. If U.S. hackers were to go after banks, critical infrastructure, food stores, whatever, like, you know, in the case of the pipeline, in the case of JBS Meats and so forth, which is considered a critical infrastructure, the food supply, If we were to do that, that would be serious stuff for Russia. Taking down water and electricity, that's a big deal. And that cannot be tolerated across border no matter what. You're right.

But you kind of bring up a topic. I'm going to just touch upon it. I don't want to get off track here, but in the news now, there's so much concern about the buildup of Russian troops near the border with Ukraine and what this could mean as far as World War III. We can't think of this if there— I mean, God forbid, I hope not— but if there is a World War III, don't be so concerned about the conventional side of this war. This is where the cyber war will begin, because I'm sure Russia, other countries as well, have looked into how to penetrate critical infrastructure, and they had those plans on the shelf waiting for the moment to do it if they decide to. And that the moment to do that will be if we were to get into a very serious confrontation, it's not going to be on the conventional— I mean, it will go much beyond that conventional battlefield. So, uh, that's what concerns me more. What will happen as far as the attacks against the home America, uh, critical infrastructure if this does turn into a full-scale war?

Yeah, let's just hope we're not having this conversation soon, you know, or at all for that matter. Okay. All right, so, um, ABC in Boston, uh, WCVB talks about police Warn of parking meter phishing scam making the rounds in Texas and elsewhere. So yours truly was interviewed for this particular piece, uh, so we will provide you with the link to this so you can— in the show notes— so you can check out the vid. So basically, uh, QR codes are everywhere as we know these days, and some scammers are exploiting the technology to fish for credit card information. At parking meters. Okay, so police in Massachusetts are now warning people that— in the Bay State— about the scam after police in a number of Texas cities have found QR codes stuck to parking meters. These codes lead to fraudulent websites that allow scammers to steal people's credit card information. So real simple, you pull up to a, um, parking spot and there is a parking meter, okay? And that parking meter, generally these days does one of three different things. It either accepts your credit card— so if you look on the photo here, there is a card slot for the credit card— so it accepts your credit card, which is pretty cool. And I use a credit card at the parking meter all the time. It's not that big a deal. I'm not worried about fraud there. I mean, even if there is fraud, I'm paying attention to my statements, so it's no big deal. So there's a— it accepts credit cards. They often accept coins as well, because at this point, analog being coins is still the most ubiquitous form of payment. And as you can see, this one does too. And usually on the street side face of the parking meter itself, you'll see some type of a logo for a parking meter app, a mobile app for Android and iPhone. And that logo reflects the logo that you might already have on your device, and it also has some numbers like the, um, the meter number along with like the, the, there's another number that corresponds with the street in which that parking meter is on. So you're supposed to pull up the app, plug in the, um, the meter number along with like the street number, uh, corresponding with the app, and, uh, plug in the amount of time that you want to pay for, which is pre-programmed with your credit card already in the app. That said, What bad guys are doing now is they're just slapping a QR code on there, maybe over that existing mobile app logo, and with a few words saying, "Scan with your mobile for parking to pay for parking," uh, which gives some direction as to what to do next. People take out their mobile phone, they scan the QR code with their phone, it pulls up a website that looks like the, um, a parking meter app. Which requests that you plug in your credit card information and a little bit more BS that looks legit, and then they get your credit card data and they start making charges without your authorization. Nuts. Easy, simple, creative, smart, and, uh, lucrative. And, you know, scary. It's brilliant, actually.

I mean, yeah, it's one of so many different— we're gonna see a lot of different offshoots of these type of things that, that are going to be, taking place, I'm sure. Good example.

And so I was quoted in the article as saying, hey, look, you know, sometimes just— or the— in the, in the video, um, in the newscast— is that sometimes just going analog is, is, is better. Sometimes, you know, paying in cash in this case if you're not quite sure. Um, I for one enjoy the mobile app for parking. And so in my hometown, uh, north of Boston, in the Boston area. And anytime I travel throughout the country, if I'm in a rental car and there is a requirement of parking on, uh, in a parking meter and there's a mobile app involved, I'll take the time to download the mobile app right there on the spot, plug in my credit card information, because I know it's just a matter of time until I'm going to use that again. Even if it's not going to be a year from now, I, I kind of like the idea of having that. And again, I'm not worried about credit card fraud. I'm not one of those people that thinks, oh my God, credit card fraud. Credit card fraud to me is a non-issue. As long as you're plugging in your— as long as you are setting up push notifications or push alerts with your credit card through your issuing credit card company or bank, and you get an email or text message with every charge, then you know if there's fraud and you report it as quickly as possible. To me, credit card fraud is a non-issue. Peter?

I agree with you, but at the end of the day, it still increases the cost to the financial organizations because that fraud still has a cost, and it's going to be a trickle-down effect to the customer. I think for some of these things, um, we're going to have to see more and more dual authentication of everything and verification of almost every transaction out there to avoid these things from happening, uh, because this is a growing problem.

Yeah, and the way to avoid that from happening essentially is a form of two-factor authentication within that credit card charge. So for example, anytime a card is charged, um, in person here in the U.S., uh, it is— we have what's called a chip and signature card. And that means that you insert the card or you do a, you know, an RFID tap to pay. And if anything, you're not even required to sign anymore. If anything, you just sign your name, and that is not even a requirement since 2018. But there's no PIN involved. Like in the UK, overseas Europe, you use a credit card there, it's chip and PIN. So it's you insert or tap your card, and then you have to punch in a PIN code similar to how we use a debit code here in the US. But we don't do the PIN here. And I think, like you're saying, that there needs to be an increased form of authentication. And why don't we, uh, initiate the PIN here? I don't understand why that's a thing. Maybe because it doesn't pass the grandmother test, I don't know.

I know, you know, it's a lot of this technology, you know, technology has been around for a long time for these things. Like, for example, I lived in Europe, uh, early, late '90s, you know, 1998, '99, 2000, and in Europe the chip, chip was in every credit card. It ex— you know, it existed. And only here, when did it arrive here in America?

I think sometime in early 2018.

I mean, look at, look at the amount of time So it really comes down to the, I guess, cost drivers, right? When does a company want to roll out that type of technology, use of that type of technology, you know, because it exists. This technology exists. It's just a matter of it being implemented because we see how it's implemented earlier in other parts of the world, but here in the United States, there's a lag, unfortunately.

Yeah. Meanwhile, set up push notifications, push alerts through your credit card company or bank so you're alerted to your charges in real time should there be any fraud. You can respond to it as quickly as possible. So Peter, what do you get to promote these days?

Well, I'm really excited, Robert, really excited. You know, we're kind of coming out of this— we're coming out, um, where even the— while the stock market kind of sucks right now, it's so volatile, at least in the security world, I'm very optimistic regarding what we can do because there's a growing, growing need. I'm in the process of launching a platform which will blow out of the water basic phishing, okay, uh, simulation platforms. It will focus on spear phishing. You know, we talked about spear phishing is when you target a specific individual based on what you know about them or can learn about them, and then target them, uh, whether it be an email or anything else, with something that you know they're going to click on that link or open the attachment. What we're going to be offering here in very short order is not only being able to develop those specific types of emails against individuals you know, but gamification, turning this into actually competitions within an organization where employees can compete against each other. This, the software is very easy to use, and they can create the emails, the spear phishing emails against their fellow co-workers, you know, whether it's a university, whether it's a company or association, any type of group, right? And so What it takes a lot further, because a lot of the basic phishing simulation platforms just throw out there what's the color, the flavor of the week, right? What's out there in the real world, um, versus people really understanding how easy it is to create a spear phishing attack. And when people get involved in actually conducting that activity, and, and gamification is a beautiful process where people will really get into it. Enjoy it, they'll much further understand it and be much more alert to these type of things that could come in real spear phishing against them. So we're in the process of rolling this out. I'm really excited. Anybody that has an interest in this in the future, please drop me a line. My email address at pgwormka@yahoo— sorry, pgwormka@counterintelligence-institute.com. We're going to be putting stuff on our website in short order, but That's, that's something in the future that I'm looking forward to, uh, rolling this type of technology out.

That's very exciting, Peter. Congratulations on that. Yeah, like, like, look forward to hearing and learning more. Uh, and us, we are at protectnowllc.com. As you probably already know, we've fully launched our e-learning tool, and you can check that out. Also, our CSI protection certification designation program is available to small to medium businesses, and of course large corporations, for real estate agents, accountants, attorneys, financial services professionals, all those that handle private or sensitive identifying information. So, Peter, last words?

Well, everybody stay safe, stay healthy, healthy from a physical health as well as healthy mind. We're still going to have a challenging year ahead of us, but we have to be optimistic and Help each other because the future should be bright. We need to be optimistic.

And be nice to each other. Thank you, Peter. Thank you, Robert Siciliano.

Take care. Take care.