Criminals don't have to meet you to steal your identity. #E38

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka.

How are you doing, Robert?

Hey Peter, you're in Orlando, correct?

Yeah, we've had some interesting times recently. The hurricane that passed by, but fortunately for us, we were sort of out of the main thrust of it. So it got people a bit excited. I was at a conference, I had to give a presentation. Over 16 speakers canceled and a lot of people started leaving. Which was unfortunate, right? But I can understand, especially when they're worried about being able to get back. But so I had a much smaller group than I normally have, but it was kind of cool because it was very intimate. And I got people— we started talking about cybersecurity and hacking and especially AI threats. People really opened up and started, you know, providing kind of like testimonials of what was going on, what they have seen, what their companies have seen, which is something I think is What we really need in the industry is those testimonials so people realize, hey, this can happen to me, it happened to my neighbor.

Yeah, I was in Orlando not too long ago presenting to, uh, uh, the real estate industry and title companies on mortgage closing wire fraud, and I had a relatively small audience as well. Uh, it was a big conference, but you know, I was up against a lot of concurrent sessions and, um, the bar, right? Meaning like there was a lot of people at the bar and you should have moved the bar into your room, right? And I was like, why? And I said to them, why? When I got on the platform, I'm like, I think that this presentation, this program is the most important session in the entire conference. 'And why isn't the room full?' I said, 'Because, like, in this event, like, we're talking about wire fraud as it pertains to mortgage closings that you as real estate agents rely on in order to, you know, get paid. And if your clients are victimized by wire fraud, it, it's over, Johnny. Like, it's game over for you because all their funds go to a bad guy. They're not getting that money back.' And so why isn't this room full? And it boils down to people don't want to think or believe it can happen to them. Okay, so as I'm presenting the program, I'm getting a lot of feedback, a lot of, you know, audience questions and a lot of feedback from them. And what I learned was there's like 30, 40 people in the room. Of the 30, 40 people in the room, probably about 80% of them have experienced some form of wire fraud.

I believe it. Yeah, but it's a shame because people don't— are not really talking about it, right? It's like if you don't talk about it, it doesn't exist. It's just crazy.

And this— so the thing is, is like the people in the room that understood the impact of the crime, that wanted to know what to do to make sure it doesn't happen in the future, and the rest of them had systems in place that they wanted to make sure were robust enough, uh, that's who showed up. So those that essentially were either affected by the crime or knew enough about it that understood the risks and wanted to further mitigate it are the ones that showed up, you know. And that's essentially who our audience is. It's like those who recognize risk and want to do something about it, like the people who stayed in the room right, for your event, uh, are the ones that, you know, but it's like everybody else is a huge target because they're not doing anything about it.

Well, sometimes it's the fault of the, of the conference organizers that they don't necessarily understand the importance of the individual sessions. And so how they, how they, how they structure the locations as well as the specific time, I mean, it can make a big difference regarding, uh, what kind of turnout you're going to get. It's just—

and you and I should be a keynote for every single presentation that we deliver.

I agree.

The entire conference needs to hear what we have to say because it's not just like, oh, you know, uh, put that, you know, speaker on what— on mortgage wire fraud up against 6 other speakers because like those 5 other programs are good but they're not to the degree of the, of the, the importance of anything that we, you and I collectively present.

That's what we continue to do, battle, Robert. That's our mission.

And we're doing battle today. So hey everybody, uh, welcome. And, uh, we have all kinds of interesting topics to speak to, uh, right here. Uh, Politico talks about officials unveil unprecedented cybercrime takedown. U.S. law enforcement has unraveled the Kakbot malware, which cybercriminals used to cause millions in damages via ransomware and data theft. So this is an interesting one, Peter. Uh, let me, uh, go a little deeper with this. Senior Justice Department officials on Tuesday revealed a major digital sting they carried out to squash malware criminals have used for decades to launch ransomware attacks, break into corporate networks, and filch sensitive customer data across the globe. They called it unprecedented, involving FBI agents and law enforcement partners in 6 other countries including France, United Kingdom, Germany, Netherlands, Romania, and Latvia. The only ones that I'm surprised that I'm seeing in here is Romania and Latvia because those are countries where a lot of cybercrime emanates from. But that's great that we're getting that level of cooperation. They issued commands— the CAC bot malware issued commands to self-destruct, and ultimately they seized roughly $9 million worth of cryptocurrency behind the malware. So I wanted to point out something specific here. US officials have repeatedly warned that a large percentage of global cybercrime and ransomware activity comes from Russia. They accused the Kremlin of turning a blind eye to digital crooks as long as they focus their activity abroad, a claim Russia denies. China also accounts for significant hacking activity within the United States, but authorities say a majority of it is state-sponsored. Meaning the Chinese government also denies sanctioning hacking efforts.

I think that's very, very true. The first part about Russia allowing these organizations to operate as long as they're not targeting individuals or companies within Russia. I mean, we talked about this before. There's a lot of criminal organizations that do have former intelligence officers that work for them. And there's a lot of cooperation between the intelligence services in Russia and these criminal organizations. And I'm sure that even though the criminal organizations are out there predominantly for, you know, conduct their activities for financial gain, they're also passing information that could be of use to the Russian service. And regarding China, yes, I think it's a lot more of that is being conducted by the state. Absolutely.

That is, ladies and gentlemen, directly from the retired former CIA, uh, spy, uh, who would know more about this than, uh, probably the top 1% of the people on the planet. All right, so it goes on to say that— what's that, Peter?

I would like to— I mean, like to add that this— I mean, it's nice to see, it's nice to see some of these victories, right? Uh, it's significant. They should report them, and they really can't— they shouldn't report too much detail on how they undertake the operation, the takedown, because that provides information back to the criminals or fraudsters in being able to operate more intelligently to circumvent these practices by law enforcement. But it's still a small dent. This is one great victory, but it's very small in comparison to all of the global operations of these criminal groups and these hacks that are going on.

The level of detail that they did provide was over the course of the 18-month operation, US and international law enforcement law enforcement clandestinely gained access to the 52 servers controlling Kakbot. That gave them a unique behind-the-curtain look at how much damage the malware was causing. Cybercriminals infected 700,000 new victims with, with the malware over the past year alone, roughly 200,000 of which were in the US, according to law enforcement. They also used it to launch 40 different ransomware attacks, causing $58 million in damage. So interestingly, that they got access to all those servers, and ultimately, that allowed them to shut them down.

But does it say anything regarding the arrests of individuals?

It doesn't. As a matter of fact, they said specifically, there was some information here that, hold on. U.S. law enforcement did not announce any arrests. When asked who they believed to be responsible for the botnet, uh, they declined to say, citing the ongoing nature of the investigation. The fact that they had seized as much cryptocurrency as they did tells me that either that crypto was residing on one of those servers that they were able to capture, or they actually got somebody. They actually got inside somebody's account and/or got someone. So that remains to be seen. Yeah.

Well, hopefully it leads to some arrests because otherwise it's pretty easy for these groups just to set up shop again.

Well, that's it. Yeah. It is a game of whack-a-mole. And, uh, the fact that they were able to shut down 52 different servers is a, is a coup, but they've got to get the people that are responsible for doing it.

Yeah, yeah.

All right, so check this out. So Kroll employee SIM swapped for crypto investor data. So this is via Security Boulevard and, um, uh, journalist, uh, Brian Krebs. So security consulting giant Kroll, and we'll explain SIM swapping in a minute to y'all, disclosed today that a SIM swapping attack against one of its employees led to the theft of user information of multiple cryptocurrency platforms that are relying on Kroll services in their ongoing bankruptcy proceedings. And there are indications that fraudsters may already be exploiting the stolen data in phishing attacks. So cryptocurrency lender BlockFi and now the collapsed trading platform FTX each disclosed data breaches this week thanks to recent SIM swapping attacks targeting an employee, a single employee of Kroll, the company, uh, which is handling the bankruptcy restructuring. So, and a statement released, New York-based Kroll— I mean, this is a huge security company— said it was informed on August 19th someone targeted a T-Mobile phone number belonging to a Kroll employee in a highly sophisticated sophisticated SIM swapping attack. Specifically, they said T-Mobile, without any authority from or contact with the Kroll or its employees, transferred the employee's phone number to the threat actor's phone at their requests. The statement continues, as a result, it appears the threat actor gained access to certain files containing personal information of bankruptcy claims in the matter of BlockFi, FTX, and Genesis. So Peter, I'm actually like involved, uh, as an expert witness in a similar case. Uh, SIM swapping is when the criminal, in this case hacker let's say, or criminal, uh, calls up T-Mobile, AT&T, Verizon, posing as the actual, you know, account holder. So think like, let's just say you're an AT&T customer and you have, you know, obviously a phone, and, uh, that phone is used for, uh, two-factor authentication in many accounts. And let's just say for your bank account, or in this case cryptocurrency, okay? And so when you, uh, are going to log into your crypto account, you log in username, passcode, and then you get a text message, one-time passcode via your phone, and that allows you to log in to any account that requires two-factor authentication. Well, in this case, it's an employee of Kroll that, uh, is responsible for, uh, the security of various clients, and at some level, that employee was provided access to those client accounts. Now, what the bad guys had done was they went to T-Mobile and they said, hey, we are so-and-so employee of Kroll, and we need to, uh, you know, change out our phone because our phone was lost or stolen. So, uh, here is my username and passcode for my, in this case, T-Mobile account. And they went ahead and used basic information about that employee along with his credentials that they may have phished or got elsewhere, and ultimately were able to take over that T-Mobile account and get a SIM card for that T-Mobile account that had resided on the victim's phone and transferred it to another phone that the bad guys controlled. You all understand how that works?

You know, I mean, that's interesting, but I mean, it's always the possibility that it could have been, you know, an inside job regarding the telephone company, right, that would have provided this information. I mean, it's not that hard to recruit somebody on the inside of these organizations for the right, you know, motivations and the right money. I'm not saying that this is the case, but it, you know, it could be a very successful phishing scam. But another question would be is how did they know that this individual had this type of access Is that a— is that sort of a deficiency on the part of the company in allowing that type of information to leak out of them?

See, I don't know if they actually knew that that employee had that level of access. Um, I'm thinking that they would target a number of people within the company regardless knowing that these are individuals that have access to a lot of high net worth individuals and accounts. And any one of them in the company would be a significant target. I mean, think about anybody that works for the FBI, anybody that works for a massive bank, anybody that works for a massive crypto company. Like all of those individual employees have access that they could leverage any of those employees to get access to any amounts of sensitive, highly valuable information.

Mm-hmm. That's very interesting.

So for any of us that want to avoid this, okay, knowing that companies like T-Mobile and others can go in and provide a SIM card to anyone that poses as you, I think it's important that you have multiple layers of protection on your mobile phone accounts themselves. So right now, if you can log into your mobile phone account right now with just a username and a passcode, that's not enough.

Not enough at all.

And it's possible that this employee, to log into his own T-Mobile account, only had username and passcode access to get in and may not have enabled two-factor authentication.

That is entirely a possibility because with a lot of these companies, it's, it's still an op— it's still an option, right? They don't, they don't require you if you don't want to, to use two-factor authentication. Although, I mean, we're strong advocates for it, but maybe some people won't until they're forced to.

So I enabled an additional passcode on my AT&T account probably 15 years ago. 15 years ago, I said to AT&T, I'm like, hey, listen, like, at any given point in time, you know, like, anybody can log into my account if they have my passcode, right? And they were like, yeah. I go, can I add like an additional passcode onto my account? They actually had to set that up for me specifically. Because they didn't even have two-factor authentication back in the day. I believe right now, in order to authenticate me, all they need to know is like my mother's maiden name or the last 4 digits of my Social Security number. Like, that's it. I go, can I change things up so it's like a different code altogether so that like nobody can access my account unless they know a specific code? Because all of these like easy to guess, easy to hack, easy to crack credentials aren't enough. And that's what I did.

Okay, they probably thought that you were totally exaggerated at that time, you know. But exactly, you were— you're way ahead of the curve regarding these things.

For all of you, I would find out right now what it takes to get access to your mobile phone account right now. Like, call them up and like pose as somebody else, you know. I, I'm sorry, I'm sorry, pose as you. Pose as yourself and try to get in. Like, say, hey, I lost my phone, or I can't find it, or I need to like get a new SIM card. Like, how do I go about that? What do I got to do? And find out what type of information based on that phone call they need in order for you or anyone else to get access to your account. And if you determine that it's relatively easy for somebody to again get in based on relatively known information, they'd be— they could be gleaned off of Facebook or found on the web, You know you got a problem right there, and you need to beef up access to your account.

Very good advice, Robert Siciliano.

All right, okay, uh, clock is ticking. So, uh, this is also via Security Boulevard, and this is fighting back against synthetic identity fraud. Peter, most people don't know what synthetic identity fraud is. We're gonna— we're gonna define that for everyone and give you an idea of what it is that you should do to protect yourself. This particular article is really for, you know, larger Fortune 1000s, you know, financial institutions, on what they're supposed to do to prevent their clients, people like you and I, from being victimized from this particular crime. But we'll break it down in such a way where we define it for you and what it is that you can do to protect yourself, even if you can. So as COVID-19 raged, Adam Arena, this guy, was getting rich. However, he wasn't running a prosperous business., that was thriving despite pandemic uncertainty. Instead, Arena and a dozen co-conspirators were stealing more than $1 million from financial institutions using a fraud scheme called synthetic identity fraud. This fraud approach is the fastest growing in a long line of fraud techniques, uh, is especially prevalent in financial services arena among threat actors leveraging stolen credentials to make money— our information. So the Federal Reserve defines synthetic identity fraud as the use of a combination of personally identifiable information, PII, name, address, phone number, Social Security number, to fabricate a person or entity in order to commit a dishonest act for financial or personal gain. Unlike identity theft, which a fraudster uses a specific individual's stolen yet real information, fraudsters create synthetic identities by combining elements of real and fictitious PII. This identity is then used to obtain a loan or extensive credit line, but it's never paid back. So basically what this is, is your name, your address, your phone number, your Social Security number. Now you are really a legitimate person. Now your neighbor, or somebody in another state for that matter, has similar information. Now, what they might use is your name and your address and somebody else's Social Security number entirely. Okay? It might have a similar name or feel to your name, like Robert Siciliano could be Bob Siciliano, but it's another Bob Siciliano from another state with a different Social Security number and so on, but your physical address. And the two may not match up on the credit Bureau's information, and new lines of credit could be established with a combination of both records, right? My, my Bob Siciliano, another Robert Siciliano, different Social Security number, different address, combine them. And in some cases, a different address altogether, a different name altogether. And by combining all of this real data in different ways, they're basically creating new lines of credit new credit reports based on a combination of names, personal identifying information, and numeric identifiers, Social Security numbers.

I would think, I mean, you mentioned that most of this is— the concern would be, you know, is to wait upon the financial institutions, and maybe the consumers think, well, what can I do about it? But I can see one thing right now is the risk is if there's a synthetic identity that's linked to your Social Security number That is where all of a sudden a credit line could be taken out under your, your Social Security number, right? I mean, under your name. Uh, but this is important. If you lock down your credit, you don't even have to worry about this, correct?

Well, see, the problem here is that if you lock, if you lock down your credit, which everybody should do right now, your name, your, your credit is associated with your Social Security number. So you need to get a credit freeze. Everybody needs to get a credit freeze yesterday. Okay, now that protects you and your credit from being affected by this. But what happens is they are able to open up new lines of credit under a brand new identity that's used in combination of yours and others. And the credit bureaus actually establish a whole new identity based on a combination of information that isn't actually you and doesn't actually show up on your credit report.

Understood.

Okay, so what—

I mean, any advice about how, uh, we as consumers can try to counteract this, you know, defeat this? It's kind of— it's pretty difficult, right? Uh, it is information that's already out there.

The good news is, is that generally it doesn't ultimately affect you specifically in your line of credit in your actual identity in such a way where it affects your ability going forward to, uh, get credit because it's a whole brand new identity. However, uh, if your credit is not frozen and they can eventually tap into your actual identity as well, so with your credit being frozen You can, you can prevent synthetic identity theft from affecting your actual identity. And in the end, it's the lenders, it's the creditors that lose the most because they have granted credit essentially to what would be considered a ghost, even though that data is in some way associated with your identity. It's further enough away that it's a synthetic identity that isn't actually you.

But as we know, when there are companies such as financial institutions included that lose money on some of these things, they have to make it up. And so ultimately, it becomes— we all pay the price ultimately for what we pay in products and services.

So what they're saying is data breaches have continued unabated for several years. In 2022, more than 1,800 data compromise events impacted 422 million people, exposing PII and other critical information that threat actors leveraged to commit synthetic identity theft, fraud, and other crimes. So basically, cyberattacks, the dark web, various forms of identity theft, various fraud scams, account takeover— all of that is— all that data from all those various sources is used for various forms of Synthetic identity theft. So everybody get a credit freeze right now and protect you. There could be at any given point in time a half a dozen people or more, dozens, using your actual Social Security number, using your actual name, maybe not combined with your social, to actually have various accounts under your name that won't affect you. But fundamentally, as long as you get a credit freeze, that pretty much protects, protects you.

Yeah.

So Peter, what are you up to these days?

Oh boy, this is like the time of the year when things really start getting, getting extremely busy. As you know, it's been very difficult for us to even communicate because of everything that we're involved in. A lot of, uh, travel, um, for conferences, groups, associations, private companies. And you know, Cybersecurity Month is coming up. And Cybersecurity Awareness Month is coming up in October. So a lot of things happening. But that being said, if any of you listening are working for companies that maybe haven't prepared or thought about Cyber Awareness Month and are looking for resources, please reach out to Robert or myself. We might be able to assist in some way, giving a presentation, even if it's virtual, to your organization.

Yeah, and you could see Peter at counterintelligence-institute.com. And check out his book on Amazon. This is a new one, Peter. It is Why Are You Messing with Me? Senior Survival Guide on Fraud, Privacy, and Security. How's it doing, Peter?

Thank you. Very well, actually. When people, you know, I— when I— they see that the book's cover, they say, this is exactly what my parents need, or my grandparents. And they start relating to me. They had this issue coming up, you know, or I, I found them, you know, doing— getting involved in this. And I said, wait a minute, You know, this is a scam. So everybody seems to have a story.

Yeah, everybody's gonna—

everybody has a story.

Yeah, they just keep coming in too, like it's just—

yeah.

All right, so for, uh, me, uh, you guys just contact me at protectnowllc.com. Uh, we are doing lots within the real estate industry, uh, mortgage, uh, financial services. Uh, September, October for both Peter and I are very busy. Uh, but, uh, we know most people are booking for 2024 at this point. Feel free to touch base anytime. Peter, any last words?

Well, just stay safe out there, and hopefully you're not gonna have to worry about these hurricanes that passed through Florida. But, uh, there's, there's a lot of things going on, uh, and just be careful, take care of each other, and we'll see you next time.

And be nice to each other. Thank you, Peter. Thank you.