Are second-hand devices vulnerable to cyberattacks? #9

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to The Security Guy and the CIA Spy. I am Robert Siciliano, and this is Peter Wormka. Hey Peter, how you doing today?

Life is wonderful. Crazy, hectic, but everything is really good. I think we both have news to share, I believe. I see you got something hanging around your, your neck. Yeah, buddy.

So, um, I ran the Boston Marathon yesterday.

Wow, congratulations! Awesome.

It's my 10th, uh, it's the 10th time I've ran, and I've been running all these years for Boston Children's Hospital, um, MR8, which is, uh, the Martin Richard Foundation, which was the little boy that was, uh, murdered basically in the, um, 2013 marathon. I ran for his team and raised money for them and, um, for Dana-Farber Cancer Research Institute. So I've raised, um, my family and I, along with all our friends and family and colleagues, have raised over $90,000 in the past 10 years for charities that we support.

Wonderful. Well, congratulations, and good for you that you're able to keep on running. I don't think— I don't know if I could handle that.

You know, the whole point and purpose of, um, of doing it is, you know, uh, for to raise money and, uh, to challenge myself, to provide a leadership role for my daughters, to show them, you know, what, what the possibilities are. And, um, you know, just to— it's just all overall good karma, you know. So yeah, it's a good thing.

Well, where you were doing that, I was traveling. I was crisscrossing the, the nation here and doing a number of presentations, doing two include two TED Talks.

Nice, congrats!

In, uh, uh, Bay Park and also in Greensboro, North Carolina. And right when I was rehearsing up in on the stage, I get a call and my daughter went into, uh, emergency because she was giving birth 7 weeks in advance. Oh, water broke and she had to go to the hospital. And I'm in the middle of this TED preparation for the TED Talk My wife, I got my wife on the airplane. She flew back immediately to Orlando. I had to stay one more day so I could give the presentation. Then I drove because we were, we were driving. Uh, but everything's great. Baby and mother are fantastic. And, uh, my fourth, fourth grandchild now.

Excellent, excellent, excellent news. Congrats. Congratulations. Scary at first, but, but good outcome. And that's phenomenal. Yeah, good for you and her.

Fantastic. No, that's why I'm kind of high. I'm high, high as a kite right now. I'm just happy.

Excellent. All right, so, uh, Peter and I have been doing some research this week. Uh, we have a lot to talk about, so let's get, um, right into it. Um, give me one second. All right, so check this out, right? This is from the Washington Post: how to get rid of your unwanted electronic devices safely and responsibly. You might, uh, take your old iPhone, iPad, your old Android, your laptop, your desktop. You might sell them on the secondhand market. You might trade it in, uh, you know, to, uh, whatever, AT&T, Verizon, or even Apple for that matter, uh, for money off of your next device. So there's a number of things that you might do. You might donate it to the church. Heck, you could put it curbside and let somebody pick it up off the street, you know, sell it on Marketplace or Craigslist, whatever it is that you might do. But there's a way to do it, and there's a way not to do it. You know, recycled goods, uh, or aftermarket or secondhand goods, you know, they have some chemicals in them, uh, some, uh, metals that could pollute waterways and landfills. And so there's a way to go about it. And there's also sensitive data on those devices that if those devices fall into the wrong hands, then, um, that could be problematic. And most people, when it comes to their, their old digital devices don't really think it through. So we're here to kind of guide you in that direction. Uh, this is, uh, a bit of, uh, you know, information slash personal security and a bit of digital literacy, okay, in this particular podcast. So here is an article from The Washington Post, How to Get Rid of Your Unwanted Electronic Devices Responsibly. Uh, we love electronic devices until they get old, we already tired of them, and we want a shiny new diversion. This constant upgrading to the latest and greatest, although, is bad for the environment. Things like computer monitors, smartphones, TV sets, and video game systems contain a mix of hazardous chemicals that must be handled properly when you dispose of them. You can't just toss the stuff in the trash, but many people do. So, uh, and it doesn't even say anything about, um, the security aspect of it. I'm going to go right down to the security aspect, aspect of it. So privacy first. Which, uh, I was interviewed for this particular article. It goes on to say that before selling, donating, or recycling any device with onboard storage, follow the manufacturer's instructions about how to properly wipe the memory. This is a big deal. Simply deleting the files is not enough to prevent crooks from accessing that information, says Robert Siciliano, digital security expert with ProtectNow, uh, recommends the following steps. So On Windows machines, Apple machines, again, follow the manufacturer's suggestions in regards to, you know, reinstalling your operating system. And if you don't know how to do that specifically, Google it. So search the terms, uh, Windows 10 reinstall, or Windows 8 device wipe, or Mac, uh, install OS, or a Mac wipe device, whatever.. And then from there you'll find a zillion tutorials about how to go about that process. It might require old disks that you have on file, it might require hitting a couple of buttons or navigating to certain, um, software built into the device itself. And then from there you go ahead and you wipe the device. Peter, do you have any experience with this?

Well, I was going to ask you, Robert, um, I mean, a lot of times people are returning their devices for upgrades, right? You know, maybe they get it, they go from a iPhone 11 to a 12, and they trade in the, you know, the 11. And if you're trading it back into the same company, provider that you, you got it from, like, say, let's say Verizon, for example.

Yep.

Is there much of a concern if you're trading it back into the service provider that pretty much has access to everything anyway? Or what are some considerations in that vein?

So, you know, there is a level of quality control that these companies have, and the people who are handling your digital devices, which may or may not have sensitive information on it, are trained, and they have certain protocols that, you know, insist that they handle it effectively, or they're not, you know, digging into your devices looking for additional or sensitive information, right? So as long as those protocols are being followed, then you should be fine. But, you know, you've got 100 employees, there's a good chance that one of them might be up to no good, and that's really all it takes, right? And so, and that, that one employee has your digital device that day. So as, as much protocol as there is, uh, I think it's still important that you as the consumer, you whose personal information essentially would be at risk that you follow these basic guidelines. So whenever you— so for example, I upgraded recently to a newer iPhone, and AT&T provided me with, you know, some basics of what to do and so forth. And I did all that, but I also did additional things, you know, uh, because it's, it's not that I'm concerned that AT&T is going to hack my device. My concern is, is that somebody at AT&T might be a little, you know, frisky with my device, and I don't necessarily want to take that chance. So not only did I wipe the device, but I also had gone through additional steps by doing some basic research to make sure that that information was wiped. Okay, so you're absolutely right.

I mean, a lot of people don't think about— they think about, oh, how do I secure my phone that I'm using right now, or the device I'm using? But the one that you're discarding has pretty much all, you know, most of that same really sensitive information as the phone you're using today. So it's extremely important to be careful with how are you going to discard that device or recycle that device that you don't have all of that really sensitive information that makes you vulnerable. I think it even one step further that some people don't realize even when you're using a device, you carry your mobile device with you. And if you go into a situation where you might be separated from it, for a moment, whether you're going through the airports, you're going into some facility that requires you to check in your cell phone, you can't carry it with you and you have to leave it with security. I mean, especially if you're traveling overseas and going through that situation, having to surrender for a period of time your cell phone, you just make yourself very vulnerable when someone else has access to that phone. Something to always consider.

And at a minimum, that device needs to be password protected, right? At a minimum. So whenever you're not going to have any control over it, whether that's because you have to put it in a bin or in a locker of some sort or just turn it in wherever, you want to make sure it's password protected. So whoever has access to it for whatever reason, they can't just rifle through it. That's number one. Number two, if— I guess—

sorry, from intelligence standpoint, standpoint, law enforcement standpoint. I mean, I've seen, I've seen how phones have been exploited, uh, and tremendous amount of information gathered from someone's phone, uh, for intelligence purposes, or along, you know, something has to do with law enforcement. So you definitely don't, you definitely don't want to lose control of that information.

No. And so at a minimum, password protect it. And then in addition to that, it may not be a bad idea to not even store any information or sensitive information on there at all. That the device itself is merely access to cloud-based information, so that the device itself, if it is lost or stolen and someone is able to physically plug that device in, there's nothing on it that would be sensitive in nature. Okay, so this particular article, which we're going to provide in the show notes, uh, from the Washington Post, talks about for Windows computers, do a factory reset and use a disk wipe utility such as DiskWipe or Dban, both are free, to shred any files on the hard drive from Macs, do a factory reset, and use the built-in Disk Utility or third-party program such as ShredIt for Macs. Okay? So what that basically is telling you is, is that while both Windows and Macs have a factory reset option, there's additional software that you can install ahead of time that is designed to wipe out or wipe off or shred or delete any further residual data. And that's a problem. Because what that's basically saying is, is the factory reset is not as effective as it needs to be to remove all your information. Okay, further it says for Android phones, make sure the data is encrypted, perform a factory reset, remove the SIM card, then overwrite the data with an app such as ShredIt, uh, Data Eraser Free, or AVG Cleaner. Uh, for iPhones, remove the SIM card and destroy any stored data by using the Erase All Content The SIM card is either in the side panel or behind the removable battery depending on the model. And it doesn't say anything about, um, there being additional software for the, um, iPhone, uh, which is interesting. And what that means is, is that iPhones basically do a really good job of removing any residual data with that factory reset, with that erase all contents. Um, That's a good thing, actually, you know, that, that there's no third-party software that can contribute to removing any residual data due to the fact that there isn't any residual data to be removed. That's why there isn't a third party. Uh, for a little bit of background info on this, Peter, years ago I had bought 30 devices. I bought laptops and desktops, I bought iPhones and iPads, I bought Androids, I bought, um, I bought printers, I bought a bunch of devices that I had bought off of Craigslist at the time. And I asked everybody via, you know, chat, via text, via email, did you remove any of the data? Did you set it back to factory? Did you delete your files? Did you wipe all your information? And everybody said yes. Every single person said, yes, I did. Yes, I did. Okay. And then in that process, you know, we bought everything for short money, you know, a fraction of what it would cost if you were to buy it new. And I sent all the devices to a colleague of mine who's a forensics guy. Uh, he also is a hacker, a good guy hacker. And I said, listen, find out as much information on the— off of these devices as you possibly can. 17 of the 30 devices that we bought had enough information on them to steal identities. 17 of 30. So more than half, which as a data set, that's pretty significant, you know. So 50-plus percent of the devices, even after they'd gone through a factory reset, still had information. And the ones that had the most information were Windows machines and, uh, Android mobile phones. So yeah, so the iPhones and iPads had nothing on them after a factory reset, but the Windows machines and the Androids had a ton of data. And that was after a factory reset. So what that meant was, is that maybe some of those people went through the additional protocols and installing third-party software to remove the information, but many didn't. And we reached out to both Google, who owns Android, and Microsoft for comment, and neither of them responded. But, um, you know, that tells you that if you have a secondhand device, whether you're going to turn it in, you're going to recycle it, you're going to sell it or donate it, you really need to take the extra effort. What are your thoughts, Peter?

Oh, absolutely. I agree with you. That's something that I think few people really think about when they're recycling. And it is an inconvenience, right? Like security is always inconvenient, but it doesn't take that long really to clean these devices of that information. So it's just one additional step that could really— I mean, if it saves you from having your identity stolen, just think about that. It's a small investment of time.

Yeah, and even for small businesses, right? You're a small business, you have, you know, 2 or 20 or 200 computers, and you're upgrading all of your systems to something, you know, the latest and greatest. You've got all these old hard drives, you— all these old boxes, all these old laptops. You can't just, you know, turn them in and recycle them. You've got to make sure that, you know, your client's information, your proprietary data, your, your, your customer information is properly removed from those devices. Now there's a few other things you can also do besides installing additional software programs. You could take all of the hardware itself, and I would suggest, you know, in the form of, say, laptops or desktops, physically removing the hard drives themselves. Like, so there's a physical hard drive—

you—

they're smaller on a laptop than they are on a desktop, and it's easy to open up the box or take a couple screws out and physically remove those drives and then take them to a shredding company, a company that deals with, you know, industrial, uh, shredding. Generally they have machinery that will physically destroy those drives in such a way where, you know, they become, you know, uh, metal confetti. And so in so many words, uh, that way, uh, they're completely inoperable. The other option might be if you, if you had the the wherewithal, the fortitude, throw some safety glasses on and at a 3-pound sledge and on some concrete, and you could beat all of those devices, uh, into a pulp where they would be unusable. You know, that I've seen that.

Just said, I like that. That's what I do. I just like to destroy everything, and it kind of like relieves me a lot of other stress.

I love it. Good. Yeah. So, um, You know, you have options, and the key is— and then eventually with those hard drives and devices that you, you know, beat to a pulp, you can also then stick them in a bucket of salt water if you wanted to and further destroy any data on there, and/or just go send them right to the recycling plant, whatever that might be. And if you look up digital recycling in your locality, you'll find various outlets where you can drop all that stuff off. So yeah, good advice. Yeah, and this way, you know, you're, um, you're gonna make sure that you're not gonna fall victim to any potential fraud. And obviously, you know, you don't want your identity stolen. All right, so next we're going to talk about phishing, in this case, uh, spear phishing. Uh, spear phishing, of course, is when the bad guys go directly after you. Uh, the difference between regular phishing and spear phishing is like Um, in the sales process, they talk about shotgunning. And shotgunning is when, like, if you think birdshot, it's lots of little BBs and it just goes after everybody, uh, or you spread it wide. Whereas, uh, with a pumpkin ball or a buckshot, you know, it's like one or two BBs or balls, or, you know, it's a direct shot, it's like a bullet, uh, it just goes to one person or one beast. That being said, um, spearfishing is a, is focused campaign to go after you specifically. Bad guys are stalking your Facebook, your LinkedIn, your company pages. They're going after your email address. They know who your co-workers are, and they're doing anything and everything to get either you or your colleagues, uh, in their, uh, web of lies. So Security Magazine talks about human error, psychology, and specificity, the power of spear phishing. The threat landscape continues to expand with unexpected or an exponential rise in pandemic-related phishing campaigns targeting companies, governments, and individuals. The FBI issued a notification of ongoing phishing campaign attempting to steal corporate accounts and credentials for network access and privilege escalation from US and international-based employees. With remote workspace as the new norm, there have been an increased use of corporate VPNs and elimination of in-person verification allowing cybercriminals to gain access to employee tools at multiple companies with indiscriminate targeting. Well, that's a mouthful. So Peter, like, what experience do you have educating, um, your audiences on spear phishing versus phishing?

Yeah, Robert, what I usually tend to talk about fishing is just like throwing out that net, right? They're throwing out that net and they're gonna, they're gonna pull in quite a few fish, a And these are small attacks. But the spear phishing, as you mentioned, they're going after those individuals and it's like lancing that spear with such great precision that probably 95% of the time they're going to catch that fish because they studied the target from various sources, especially social media. They know what's going to resonate with you, the target. They know what your motivations, vulnerabilities are going to be. And then they can develop their approach. And their approach can be, You know, it might be using the same social media channels with messaging features and approaching you with a fake profile, or even, you know, maybe using an email, but they're going to send you something and it's going to hit one of your central motivating, you know, things that really motivate you. Uh, you're not going to imagine that this is a phishing, you know, email, because I think a lot of the phishing simulation products that are out there kind of like are training individuals about kind of like these normal phishing emails that are sent out in volumes versus those direct spear phishing. And so you're right, this is becoming more and more popular. I think there needs to be much more education and sensitization regarding this. And there's kind of like two phases here. One is, how much information do I put out there that could be used in preparing a phishing attack against me? And then also being sensitized, what might these different approaches look like? Play. Yeah, yeah, both sides of that coin need to be addressed.

You bring up, uh, really good points, which, which leads us into how to defend against spear phishing attacks. So Security Magazine goes on to talk about how, uh, all security teams should be concerned with spear phishing due to its effectiveness in reaching critical targets, right? So then it says, because attackers rely on a combination of platforms for reconnaissance, like LinkedIn and Facebook and your websites and so forth, Attack planning and execution. It's critical for security teams to have visibility across external platforms. Understanding your organization and its high-profile employees' social media presence is critical since attackers often leverage public information on social media to build convincing profiles to conduct attacks. Uh, multi-channel spear phishing can include creating or impersonating accounts on social media as other means of reaching target audiences. You know, they're spear— they're, they're fish. Um, quickly identifying or removing any sensitive information that is shared publicly on social media or elsewhere on the web, including personal information, travel plans, credentials, and more, is a critical stop to the spread of spear phishing campaigns. So really, it's up to the user to understand, you know, how much information is out there about them, what they are providing the world, in this case the bad guy, the enemy, and how that information might be used against them. Uh, further, uh, that, that corporate IT person, the CIO, the CISO, the CSO, whose job that is, should be providing a level of intelligence to those employees as to what information could be garnered off of their various social sites, personal pages, and so forth and how that same information can be used against them. So let me give you some information. Like, if you wanted to fish me, it's not that difficult to gather basic intelligence about me. Okay? So for example, and I'm, you know, I'm making it easy for the bad guy here, but look, I know what to look out for as well. I just ran the Boston Marathon. Who would I run it for? Well, this year I ran for Dana-Farber Cancer Research Institute. And so if you go to my social pages, you'll know that I ran the Boston Marathon this week. And you know that I raise money for Dana-Farber Cancer Research. Now, it wouldn't be too difficult to create an email that looks like it's coming from Dana-Farber Cancer Research Institute thanking me for my participation in the Boston Marathon, even congratulating me, and at the same time maybe even offering me a free gift, uh, something for me to click on that would get me to a website that might look like Dana-Farber Cancer Research and when I click that link and get to that website, it might be a spoofed website that would, uh, require me to maybe sign up for an account, enter various credentials, maybe provide credit card information or routing information for a bank account— any number of, uh, sensitive information that it might be required for me to enter in order for me to claim a prize or a win or to access whatever gift they might be providing me. I mean, there's a number of ways to skin that cat, right? I'm just giving you a bunch of, you know, scenarios that might be a possibility. That being said, you know, just looking at my profiles, could putting together a ruse to further, you know, get me down that rabbit hole, right, to— for me to, you know, uh, bait on that hook, uh, to hook me, uh, wouldn't be too difficult. I'm not gonna fall for it. That said, um, anybody's pages out there that has similar critical sensitive, or at least public information, is what the bad guys are using to get access to you and your people.

Okay, Robert, what if I were to decide to set up a fake LinkedIn profile, and this profile will also be a fellow marathon runner who had participated a couple of times in the Boston Marathon and want to connect with you? Would you— I mean, would you find that that is something that would be of interest? You might have already radically have rapport with this person, fellow marathon runner, right? And then exchange a couple of messages with you and then all of a sudden send to you in the messaging feature of LinkedIn, hey, I got some information here for an upcoming marathon in, in, I don't know where, Singapore, or, or I got some pictures that, hey, I want you to see from a recent event. You know, how you, you would probably trust. I mean, how do you, how would you be able to say, well, should I trust this individual or not, right? You see how that, that can really be difficult at times.

And that's it. And then that link that you would click on to access those photos or access that website, that link itself could be infected, so to speak, meaning that By clicking that link, you could download an executable, a destructive payload, uh, basically a software malware, malicious software, spyware onto your device that would infect your browser and all your operating system.

That's why when I get an invitation from someone who wants to click on LinkedIn, and I mean, first of all, I take a look at the profile. A lot of times I do that reverse image search to see where else on the internet is this photo.. And I also do other Google searches where I might use the name of that person and some other thing that they mentioned, maybe about Boston Marathon or their name and maybe the university where they claim to have gone or their employer. And if the only thing that pops up is that profile, I'm very suspicious. These days, in our age, almost anybody, you know, are from our, you know, especially people that are our age or younger, have significant social media presence, and it's not going to only be one profile like on LinkedIn. They're going to have other things that are out there, and that's, I think, a very way to be cautious about a pro— incoming connection request from someone you don't know. You might just want to conduct some easy due diligence, um, on Google to ensure you that, hey, this person is real versus, hmm.

Yeah, in, in certain security circles, this is called zero trust. Yeah, and I always say, you know, everyone or everything or even inbound communication, everyone's a liar until proven otherwise, you know. And that might sound like a real cynical way to look at the world and maybe even a little paranoid, but I just— that's just not the case at all. It's just making sure that whatever it is or whoever it is you are engaging is in fact who they say they are, or that opportunity or that request is in fact a legitimate one opposed to one designed to, you know, hook you or spare you, right?

Yeah.

So yeah, all good stuff, but scary, but good stuff as long as you're diligent to the point where, um, you're making your best efforts to uncover what might be potential fraud and/or the truth. It's always a good thing, especially in our, you know, continually complicated digital scary world, right? All right, Peter, so next in line, and you should be able to see— if you don't, let me know— Apple releases Urgent iPhone and iPad updates to patch new zero-day vulnerability. So this is via the Hacker News. If you don't see that, let me know. So Apple released a security update for iOS and iPad to address a critical security vulnerability that it says is being exploited in the wild, making it the 17th zero-day flaw the company has addressed in its products since the start of the year. It's kind of significant. The weakness— and it has an identifier number— concerns a memory corruption issue The technical specifics about the flaw and the nature of the attacks remain unavailable. So basically what's happening is, is that Apple, uh, Macs, iPhone, uh, you know, um, iPad, the operating system itself is becoming, you know, so much more ubiquitous. It wasn't more than a decade ago that the majority, 80, 90% of all computers, of all digital devices had the Microsoft operating system, uh, and then Android came along and iPhone came along, you know, Mac came along, and, uh, actually Mac came next and then Android and then iPhone. All that said, um, the Mac operating system, especially the iPhone and iPad, is so much more ubiquitous today than it ever has been. More and more viruses are being deployed exploiting it. That being said, again, Apple does a really, really good job of detecting all of this with their own research teams and deploying critical security patches within their OS, operating system, as quickly as possible to patch it. I am unaware of Apple devices being hacked in such a way where it has caused, you know, devastation, major security breaches. Apple's pretty on top of this stuff. That just might be the limits of my awareness. But that said, Apple does a really good job of it. And as long as you are going to your OS and looking for that little red dot in your— what is it— your settings menu or your system preferences that says you've got an update that's available to you either on your iPhone, iPad, or your Mac device, you should take full advantage of that as quickly as it comes out.

Peter? Yeah, I echo your advice, and I think overall from a security standpoint, Apple is pretty good, but it's really important to keep those updates, you know, as soon as they're available. Take care of those because there's some people that maybe like let it go for several days or a few weeks, but that's enough time for something to happen. So as soon as it's available, definitely, definitely update it.

So Peter, what are you up to these days? What can you— what do you have to promote?

Oh boy, still a lot of— I got a number of training courses that are coming up, uh, programs. I'm going to be up in the Washington, D.C. area for an entire month conducting a training. I have a fundraiser down in West Palm Friday for a major, uh, major group. They, uh, they're going to talk about cybersecurity. They want me to do a keynote this Friday. So just a lot of, uh, a lot more things that I anticipated for this year, but it's all All good. What about yourself?

Where can, where can people find you?

Oh yes, of course, uh, www.counterintelligence/institute.com or my LinkedIn page, Peter Warmka. And there's a lot, you know, there's links there too, so to Facebook, Twitter, uh, Instagram, etc.

Excellent. And as you all know, you could find me online to find my company online at protectnowllc.com and We are actively engaged in training via our CSI Protection Certification Program, which CSI is Cyber Social Identity and Personal Protection. CSI Protection is a designation that service professionals such as accountants, attorneys, real estate agents, even doctors and dentists all can achieve. All those service professionals that handle sensitive client employee proprietary information need to get up to speed regarding all things cyber social identity and personal protection. And you not only become certified, but you also get this cool certificate you can hang on your office wall. Yeah, there's a digital version of it you can send out to family, friends, clients, and colleagues. It definitely, uh, ups your cybersecurity hygiene/intelligence, and, uh, it's just really good to help you protect your, your business and the information you are entrusted with. So all that being said, Peter, you have the last word.

Well, Robert, once again, it's been a pleasure sharing security tips with you, and I wish you the congratulations once again on running a great marathon in Boston, and I look forward to seeing you again in about 2 weeks.

All right, bye everybody, have a safe day.