Ep51 The Security Guy and CIA Spy PodBroadcast

Worm, uh, how are you doing, Security Guy?

Hey, CIA Spy, I'm doing good. Like every single other person in the world, I am hectic with the holiday season, but, uh, good. You know, the— my daughter's coming home from college, and, uh, you know, I couldn't be happier with that. We got 4 or 5 days with her, and then, um, you know, uh, I'm all done for the year with work, actually. I'm actually really excited about that, as much as I love what I do. Um, it's been a travel— the travel season this year was a little much.

Yeah, I'm the same way. I'm just wrapped up something a few days ago, and now it's, uh, gearing up for the holidays.

I'm—

at the end of the day, you know, we work, we do things that we love to do, we get paid for it, but at the end of the day, really what matters is, you know, it's so that we can enjoy time with our families, right? So that reminds us to this holiday season reminds us of how blessed we are. Yeah, with our family. But the work does continue. At least, uh, you know, we're doing this podcast right now, uh, because we do want to help people beyond our own respective families.

Oh man. And I've done a bunch of TV, uh, this month, you know, revolving around Black Friday and Cyber Monday and what's something called ghost tapping scams, um, where criminals are brushing up against you with— it's the, it's the form of like RFID skimming, the skimming, uh, there's a new twist to it. They're, you know, compromising your Apple Wallet. And, you know, I'm not sure how, how feasible scams like that actually are, but in the end, you know, as far as like Black Friday, Cyber Monday, just pay attention to your credit card statements and get set up push notifications and just make sure that every single charge is authorized by you. And do pay close attention to your credit card statements. And as long as you refute those unauthorized charges you'll be fine.

No, that's really key. And I think I'm guilty of not paying enough attention to my credit card statements. I mean, sometimes I find myself going back a month and a half later and saying, what is this charge? You know, but it's better if we keep it up on a day-to-day basis or week-to-week basis. Um, we can prevent bigger problems from erupting if we keep on top of it.

Oh, I'll be honest with you, man, I'm obsessed with my credit card charges. I, I, I get a push notification via email, text, or a pop-up on my mobile every single time there's a charge. So I know what's happening with my cards as it's happening. And I'll tell you, there's been a few times where I actually stopped fraud as a result, and I'm so glad that I did because, you know, if, if they do defraud your cards, then they're going to keep doing it. And if you're not paying attention to your statements, then you end up paying for the lifestyle of an identity thief.

Yeah, a lot of people, especially if the amounts are smaller amounts, people tend to think, oh, if it's under $100, well I'm not going to go through the trouble of trying to figure this out. It's a small amount. But unfortunately, most of the scams are— scammers are using these smaller amounts and flying under the radar to get through. So what about the recurring charges? You get alerts on those too?

So the recurring charges that you generally agree to, or you don't know that you're agreeing to, I guess. I'm paying— I pay close attention to all that stuff. I reconcile my credit card statements every single month, knowing all of my charges as they occur in real time with push notifications. The recurring charges, if you're paying attention to your statements, you can stop them before they become a problem. There's certain people in your life that you may need to kind of intervene. So for example, in my life, it's my mother-in-law, who's 94. And my wife and I pay attention to her credit card statements. And she's on the TV at 2 o'clock in the morning watching those infomercials, and she'll see some miracle pill that's going to make her bones feel better. And so she'll call it up at 2 AM, and next thing you know, she's being billed monthly for a $50 pill that's not doing anything for her. And we may not know about it for a couple of months.. And then once we do, we stop it. And in some cases, we'll actually get the money back, but not always. But it's important, like with certain people in your life, you want to pay attention to those recurring charges, their credit card statements in general, to make sure that everything's okay. Because again, some people in your life, generally, baby boomers, Greatest Generation, they're not as savvy to this stuff, and they're generally a bit more trusting as well.

Yeah, very good tip there.

Yeah, yeah. So, lots to talk about. So, check this out, right? Arizona woman jailed for helping North Korea in $17 million IT job scam. So, we've been seeing a lot about IT job scams over the past couple of years. Basically, it's people who apply for jobs, um, here in the U.S., uh, and overseas, that they get a job at a corporation somewhere, you know, like a Google or a Microsoft or, you know, any corporation really. And when they get that job, they generally are working remotely. Okay. Now, there's a bunch of criteria that these companies require when you do get this job. One of those criteria is, you know, in many cases that you are actually a U.S.-based citizen., and other criteria is that you don't have another job, right? And there's a lot of checks and balances, and the scams happen when somebody here in the U.S. assists the scammers, basically by setting up laptop farms, right? So that's what this is, and this is pretty amazing. So an Arizona woman jailed for helping North Korea, uh, in $17 million IT job scam. So it goes on to say that she was jailed for 8.5 years, that she was sentenced, you know, for— let me see, her name is Christina Marie Chapman. The case represents one of the largest North Korean IT worker fraud schemes ever. Her charges include conspiracy to commit wire fraud. The scheme involved operating a laptop farm at her home. Where she received and hosted company computers. This deceptive setup made companies believe the work was being performed within the US. She specifically shipped 49 laptops and other devices supplied by companies to locations overseas, including multiple shipments to a city in China bordering North Korea. Okay. So according to the documents, she shipped company laptops overseas. She forged payroll checks using 68 stolen American identities. These illicit earnings, falsely reporting to U.S. tax and Social Security agencies, were then transferred to individuals abroad. The defrauded businesses, including 5 top major television networks, a Silicon Valley technology company, an aerospace manufacturer, an American carmaker, a luxury retail store, and a U.S. media and entertainment company. Some of these companies were actively targeted by the IT workers who kept lists of desired employers.

Wow.

According to the release, FBI and IRS criminal investigations seized over 90 laptops from her residence.

Gosh.

These investigations highlight North Korea's strategy of deploying skilled IT workers globally to obtain remote employment under false pretenses. And part of the employment is mainly to actually get access internally to those company servers.

Exactly, exactly. You know that we spent— you know, much of my career I spent trying to identify individual in the intelligence world, trying to identify individuals who had access inside the company and then turn them, right? To be sort by sources. But here, this is even, this is even at a higher level when you think about this, the, the type of access. You're actually having one of your individuals gain employment with the target entity. I mean, so I mean, I guess the, I don't know how they measure the, the amount of damage here or the amount of money. Is that with the information that was stolen from these different operations? Is it because these individuals had means of actually sending money outside, out of the, out of the entities? Is it that they gain access to these firms' clients? Because you're talking about entertainment industry, you're talking about automotive, where you get— think about all the data you have on individuals who are applying for car loans from these major manufacturers, right? I mean, it's a tremendous amount of data that can be used in a lot of different ways, and You know, how long could they have this access? I would imagine that they could have this access for a few months until there's sort of a job review, right? If they're given like 3 months without really being monitored or people looking at what are they doing, they got probably a pretty good amount of time that they can do a lot of mischief.

Yeah, I would say a few years versus a few months. It's so long. Because once you're on the inside, you know, employees on the inside of an organization are generally— I, I forget what the stat is, but like, as much as like I've seen stats, as much as 70% are part of the reason why there are data breaches, because employees go around security protocols, employees make mistakes, they respond to phishing emails. So insider, uh, vulnerabilities are a huge problem for IT managers. Those on the inside disgruntled who actually are responsible for fraud and breaches because they're upset with their employer is a smaller number, but it's still a problem. Hiring an employee who maliciously is hired and then purposefully with the intent of fraud, that's an even smaller number. But as you can see, the numbers are big when it comes to the actual dollars amount dollars that are defrauded and stolen from the company.

I wonder how they recruited her. It'd be interesting. Maybe the court documents would indicate that, right? Because this article doesn't really mention that. Maybe initially started out as a romance scam. You know, they targeted her in a romance scam and then they got her. Probably. I bet you that's how it happened.

That's entirely possible. And you know what? That makes a lot of sense. She could have been on a dating site because it doesn't mention anything about her spouse. As being, uh, you know, part of— as being indicted as part of the problem. So it's likely this is a single woman, um, who in this case, you know, was probably targeted in a romance scam. That's an observation, Peter. And then from there, um, easy money, right? And, and it looks like to the perpetrator, uh, like a victimless crime. That's what it looks like, you know. Like she, she thinks that she's just, you know, setting up laptops. She doesn't realize that there are actual companies here with actual employees, with actual bottom lines, with actual stock, uh, options and stockholders, and actual people getting paychecks, and people that are, you know, IT administrators and so forth that can actually get in trouble, and so on and so forth. And I mean, it's— there are no victimless crimes here, you know.

One thing, explain to me, Robert, uh, I mean, I can understand how the IT works in this type of case, right? How you can pull this over, how you can, you know, you can manipulate the people that are hiring you in a company. Uh, but what about— isn't there an interview where, whether it's a video or audio interview, where— I don't think— I mean, I know a lot of South Koreans, English is not as strong. A lot of them don't have very good English skills at all. And I imagine North Koreans, you would think it'd be even less so. And you would think that they would You know, how could they pose as being somebody from the United States and be able to interview without that tripping them up?

So a few things. Number one, the laptops themselves, based in the US, the laptop farms have real IP addresses, right? And real US-based IP addresses, which I think is actually how this woman was actually caught, because a lot of the IP addresses went back to the same place, for one. So they were able to track and trace that. And they're using AI for the voice and for the face. So it says that there was stolen identities of 18 or 68 different people. Looks like 300, 309 American companies were defrauded. And so utilizing AI, and there was probably English-speaking actual Americans, you know, based here in the US that were probably part of the scheme beyond this woman., that were, that were, that were actually doing the jobs, uh, and, um, they may have, uh, used, uh, in some cases AI voiceovers and AI, uh, uh, generated, uh, images as well. So a combination of a few different technologies meant to socially engineer, uh, those on the other end, the companies themselves. And, and then once they got the job Uh, they just kind of went at it, you know, as long as they were shown to be doing their jobs and, uh, completing the tasks that they were hired to do. Uh, and then in addition to the fraud they were, they were committing, um, they would determine how long they were kept on. But my guess is there was, once the various frauds were being discovered is when ultimately those employees were terminated. And then the digging began. And probably IP address after IP address was shown to point towards this woman's home, the laptop farm. And she had no idea that anybody was really looking at her because she's just thinking, I'm setting up laptops. Probably had very little understanding of how the technology worked. And was probably, um, her boyfriend was probably holding her hand through the entire process to, to get her to set everything up, right?

Undoubtedly, this is not the only case. I'm sure there's— there are— they have several other ones of these that are operating right now.

I would imagine that there's hundreds, if not thousands, of these laptop farms set up throughout the country. The fact that 309 companies 68 stolen identities and $17 million, and one woman responsible for that.

Well, this is one of the challenges that we face in the world of remote working, right? I mean, you need additional security considerations.

I mean, as awful as this is, it's awesome what they did. It's awesome.

I'm really blown away. I think from an intelligence point of view, I think this is Spectacular.

It's awful.

No, but I'm saying, I mean, from an operational standpoint, oh, he's like, look at these things, you know, how you put together these operations to penetrate your enemy. They're, you know, they consider us their enemies.

So, wow, wow. Okay, yeah. All right, so, so all you businesses out there, like, this is what's going on. Pay attention. All right, so couple loses $180 grand From retirement savings after account hacked. This is a pretty interesting one. So this is in Chicago. This is, uh, just a week or two ago. Uh, Chicago couple logged into their retirement account only to find out it had been hacked. A large chunk of their retirement savings was gone, and the response from the online brokerage firm is only adding insult to injury. Uh, so the victim says, look at these trades at 3:32, uh, That's after the market closed. I usually don't place trades after the market closed. Um, the couple, uh, kept their retirement, uh, online trading accounts at a company called TastyTrade, which I'm not familiar with, a firm known for being user-friendly and having good technical analysis. But while on vacation, the couple started getting emails about activity on their accounts. Uh, the, the husband said he logged in, he was mortified. Their account had been breached. The couple saw dozens of trades that hadn't been approved, a lot of trades, very frequent buy and sell at huge losses. Uh, in short amount of time, the hacker accrued huge losses between two accounts, $180,000 gone. Uh, it makes us think twice if we're ever able to retire at all. The couple reported to the local police. In an email exchange, TastyTrade confirmed that the intrusion took place, but it wasn't the company's fault because the couple failed to sign up for an optional two-factor authentication protection. The company said, "We rolled out this additional security feature to mitigate the risk of this occurring to our customers," the email from the fraud manager read. The victim said, "I know this was an option, but it was never made mandatory." Cybersecurity experts say two-factor or multi-factor authentication is a good protective step, allowing users to fully verify who they are, who they say they are, But even text or email codes are proving to be less secure than biometric factors, uh, like your fingerprint. So what is interesting to me is that I know banks generally, if you are considered a financial institution, I believe, uh, two-factor authentication is a requirement.

Well, required by legislators, or the bank typically will require that of their clients regardless.

Well, I believe by legislators. I believe it's required by law since 2004 or '05 that you as a bank, as a financial institution, are required to have some form of two-factor authentication in place. Now, I don't know if Tasty Trades is considered to be a financial institution.

Hmm.

I think that they are able to— I believe that they are in some way were able to work around that and not be as regulated because they're not considered a financial institution. I'm sure if you go into the details of that, that that's probably how it plays out.

Uh, interesting. So what is the— what do you believe is the motivation of the hacker in this case? Is it just to have fun and try, you know, try to gamble? Uh, did they take any money out for themselves? It doesn't seem so. Pretty much they ran up all kinds of losses on the account.

They ran up all kinds of losses. They kind of went nuts, I think, probably because they could. Yeah, no, my guess is in some way, somehow, they were— they, they, they, they got access to the account, likely due to the fact that the victims in this case weren't using two-factor authentication on an account that is tied to their finances in some way, obviously. For, for, for trading. The fact that they weren't using two-factor authentication, knew it was an option and didn't, tells me that this same couple is probably using the same passcode across multiple accounts.

Yeah, I would, I would bet on that as well, guaranteed.

And they probably, uh, their email was probably vulnerable too. So through credential stuffing, a credential stuffing attack is how they probably got into their TastyTrade account, because the credentials— usernames, email addresses as usernames, passcodes— all on the dark web. They took that data through credential stuffing, logged in. Didn't hack, they logged in. And once they logged in, they just went nuts because they could, because it was fun.

That's why really the, the email account though, in the hands, uh, being able to get in someone's email account is golden, because if you're resetting your password, almost always is going to your email account to reset your password, right?

Yeah, exactly. Yeah, uh, they could have done that. They could have reset the passcode for the account through email. Yeah, but the fact that they didn't have two-factor authentication tells me that it doesn't even matter, because if they didn't have two-factor authentication on a finance account, meaning they probably didn't have two-factor authentication on email either.

Now, uh, yeah, right, in most cases, at least here in the United States, the the org— the financial institution only accepts liability if in fact that they've had a major— like, they're the— they've had a system failure. Let's say there was a hack of the overall, uh, financial institution which included their— all their clients. That would be separate from where they considered negligence on the part of a client that maybe did not use two-factor authentication or, or just really, you know, very, very sloppy hygiene when it comes to cybersecurity, which is probably this case. Although it's kind of interesting because they agreed to maybe pay half of the damages, right?

So I agree with what you said, although there are no hard and fast in that regard. What is true, and I'm no legal scholar, but where there is foreseeability, there is liability. Okay. And so TastyTrade could have, should have foreseen something like this was possible due to the fact that, uh, credential stuffing is a big problem. Uh, you know, 94% of computer users are using the same passcode across multiple accounts. And, um, uh, TastyTrade should have, could have foreseen the possibility of this happening, therefore should have made— or it could be argued that they should have made at a minimum two-factor authentication as a requirement. Beyond that, not just making two-factor authentication a requirement, companies like say Coinbase, for example, if you change— Coinbase requires two-factor authentication by default. You can't have a Coinbase account without two-factor authentication. They're not screwing around. Beyond that, Coinbase has a relationship with the telcos in such a way that let's just say, you're using your phone for two-factor authentication. And let's just say, um, your phone, your, your, your mobile account is in your phone is SIM swapped, okay? Meaning that somebody swaps out your SIM card so they can get a hold of your two-factor, they can get a hold of your, your account information so they can, they can get access to your Coinbase account, right? Okay, Coinbase knows If you swap out your SIM, they're aware of that. In other words, let's just say you go from AT&T to Verizon. I'm pretty sure Coinbase knows that, because they have relationships in such a way where they're able to see the inner workings in a way that— and I don't pretend to understand exactly, but they know enough to know that your SIM, is no longer with the previous company you were working with, and that they want you to re-register and, and your, your account information to prove that it is in fact you that is accessing your account due to the fact that the, um, the— maybe it's the IMEI, um, of your SIM, not really sure, that it's different now. And because they don't want, uh, your Coinbase account being liquidated.

Right, right, right, right.

Because it has happened and Coinbase knows it, therefore they foresee it and they, they know that they have been liable for it as a result. And going forward, they don't want it to happen again. TastyTrade didn't do anything.

Well, is it possible that they had two different systems in place as far as, uh, authenticating the user, the client? In this case, if you're just logging into the platform to make trades, it's one thing, but if you're logging into the platform to transfer money out. Maybe that's— maybe they— maybe that's how they process it.

They could be in the layer. Yeah, yeah, yeah. Peter, uh, crazy enough, I, I, I actually have to cut this thing short, but listen, where can people find you?

Well, they can find me— if you're, if you're searching on the internet, you can find me at counterintelligence-institute.com. But even easier, if you're on LinkedIn, look me up. And my LinkedIn page, and I have links to everything there.

Peter Warmka. There he is.

There I am.

And you're on, um, LinkedIn as well. This is your LinkedIn profile. Hook up with Peter on LinkedIn. He is an SJA Influencer of 2025. Uh, he is the CIA spy, right? And I— former, former former, and I am at protectnowllc.com. Y'all can find me. I still have holes in my 2026 calendar. Uh, I look forward to, uh, the new year and working. Uh, Peter, uh, famous last words.

Well, as we enter this holiday season, you spend, you know, look at it at a time to really, you know, appreciate the blessings that we have with our family and to look out for them and engage with them and find out what, you know, what they're doing, especially if we have seniors in our you know, our aging parents, you know, how are they doing? Because a lot of times we can— we might be able to identify some red flags when they're being potentially approached by scammers. So, you know, it's really important. Look out, look out for each other.

Let's look out for each other and be nice and be kind.

Yes.

All right, brother, I appreciate you. I'm thankful for you.

Take care.