From trading data on the dark web to deepfakes: The high-stakes world of cybersecurity. #34

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka down in Orlando, Florida.

How you doing, Robert?

Hey buddy, I'm doing pretty good. Um, next, uh, so, uh, for me at least, next week is Patriots Day in Massachusetts, and, uh, that means it is, uh, for most people it's, uh, a tax day. Uh, in Massachusetts it's also Marathon Monday, and I'm running the Boston Marathon next week.

That's excellent. I think it— to me the marathon sounds better than Patriots tax day. I guess we're patriots if we pay our taxes. I don't know. How many— so how many kilometers is— how many miles is that?

Well, I think it's— I think it's 40 kilometers.

I think—

I think that's the number. Um, but it's 26.2. Excellent.

How many have you been— how many have you participated in so far?

This is my 12th consecutive run. And I actually do— that's great. I've never run another marathon. I don't plan on running another marathon. I know people that do like the World 7. They go to Tokyo, you know, they go to— they go to London, they go all over the globe. And I'm not interested in that. I, I, I've just run in Boston. I run it for, uh, Dana-Farber Cancer Research. We raise about $10,000+ every single year. We're at up to about $120,000 in donations over the past 12 years. And, um, yeah, my wife has, uh, been pushing— or at the beginning she was pushing my 3- and 5-year-old in a stroller, and now, you know, they're obviously like, you know, teenagers now, so they walk. Uh, and, uh, my oldest daughter says that Patriots Day is her favorite holiday. Who even says that, right? And, uh, that, that she's going to be running, uh, hopefully Boston next year. She's she'll be turning 18. So yeah, that's great.

You know how they say in Hollywood is break a leg, but I don't think that would be very appropriate for me to say break a leg. I have a good one.

Yeah, thank you. Yeah, and on a, on a, on a, on a somber, uh, note, uh, which, you know, it's not always my intention, but it's actually the, the, the 10th, uh, year anniversary of the Boston bombing.

That's true, 10 years already. It's amazing.

Yeah, 10 years. And I, unfortunately, I was, I was there, meaning like I had just turned the corner, Hereford to Boylston, and the second bomb had just gone off.

Wow.

And so when I turned the corner, I just saw smoke. And I saw people running all across the street. And I And then immediately, like, the Boston Athletic Association officials and law enforcement just stopped all of us from going any further. And we're all like, what are you doing? You know, like, yeah, your headphones on, you're running. And all of a sudden, like, these, these people in uniform and stuff, they just stop you and like, you can't go any further. And we're all like looking at each other like, what is wrong with these people? Why are they stopping me? Like, You know, we're getting angry, you know, we're like upset that they're stopping our race. And they're like, hold on, hold on, they're listening to their earbuds and stuff. They're like, we don't— something's happening at the finish line. And we're like, nothing's happened at the finish line. And then somebody goes, we think a bomb might have gone off. And we're like, there's no bomb. Like, literally, like, we're all clueless, you know. And when the— when you run a marathon, it's like a 26-mile tailgate party, you know, because like the whole race is like people on the side of the road grilling, barbecuing burgers, dogs, drinking beers, like just partying, you know. And so you see the smoke, but then I smelt the smoke and it had that sulfuric, you know, egg smell to it. And then I was like, that smells like a bomb to me. That smells like fireworks to And, and then my whole, like, body just shifted from, I gotta finish this race, to I gotta find my wife and kids, right? It was nuts, man. It was nuts. And then, and then I tried to call my wife, you know, because I run with my phone, of course. And I couldn't get her on the phone because everybody now is calling everybody to find out what happened. It could— and all the lines just kind of went down. And then, um, And then I was like, screw this. And I broke through that human barrier, the cops, the BIA officials, and I just started running down Boylston Street to get to my wife and kids who were at the finish line. Oh yeah, it was messed up.

Yeah, you don't really know what that's like unless you've gone through that or something similar, right?

So I get like halfway down Boylston Street and I'm coming upon right at the second bomb, and I'm starting to see like people on the ground You know, and it was just like, what the heck is going on? You know? And then a cop grabs me, like just grabs me, just physically just grabbed my entire being and just grabs me. And like, he got me, you know? And he starts yelling at me. He's like, because I guess they called ahead and said there's a runner coming down to get him. And he's like, I will cuff you to this telephone pole if you don't get off the course now.. And so I jumped over the fence and I ran down the back alleys behind the first and second bomb where people were spilling out into the back alleys. And I ran around the other side of the finish line and then I got on the phone again and I got my dad on the phone and they were already like, you know, heading out. I can't even— yeah, it was just— and I got to them like 20 minutes later. My wife is all haggard. She's carrying my 4-year-old at the time. It was like, you know, 30, 40 pounds, you know, 40, 50 pounds, whatever she was. And, um, and I was like, we just went like another 2 miles to my car. And, uh, you know, we piled 9 people, like people on laps, on the floor. And, uh, yeah, and then watched it on TV for like the next week. We just glued. It was just nuts.

But good for you that you've been able to, you know, even though those memories come back, I'm sure every anniversary, that you're able to push forward and and, and do it again, you know.

Yeah, dude, you know, like, I haven't told that story in a while, and it's like emotional just telling.

I can tell it.

Yeah, yeah, it's messed up. Anyways, I'm sorry, like, I didn't even like need to do that, but, you know, it's just, I guess, you know, it's the first time I'm really talking about it in a while. So anyways, um, welcome to the, uh, pod broadcast. We have a lot to talk about today. Uh, let's get right into it, Peter. Uh, you know, we went over a bunch of story ideas before, stuff that matters to everybody in regards to all things cyber, social identity, and personal protection. Here, uh, DW.com talks about international sting brings down major dark web marketplace. Law enforcement agencies say Genesis Market dealt in stolen identities and account details, dubbed Operation Cookie Monster, involving 17 nations, resulting in 120 arrests. Okay, so the dark web, of course, you know, is the part of the web that is not indexed by Google, but you can find anything and everything on it by using the Tor browser. The Tor browser is also known as the Onion Router. The acronym is Tor, T-O-R, and you can download it. It's actually a government-sponsored browser for privacy purposes. But it scans and searches portions of the internet that Google doesn't. And so you want to get a hitman? Download Tor. You want to buy stolen identities or guns? Download Tor. You want to get a prostitute? Download Tor. Like, it is the dark web. Okay. And of course, I'm not condoning any of that. I'm just saying,. And so this is where open marketplaces of illegal whatever are readily available. And so the article goes on to say that Britain's NCA estimates that Genesis has stolen more than 80 million credentials and digital fingerprints from over 2 million individuals. The site, which has been active since 2018, right? So that's what, 5 years? Specialized in the sale of digital products that have been stolen with the help of so-called malware. Such as— such digital products can allow criminals to bypass security measures such as multi-factor authentication or device fingerprinting. It's not as easy said than done, but certainly some malware can do that. Authorities say users had known of the site in order— had to know about the site in order to purchase stolen identities, which are sold for anywhere from fractions of pennies to hundreds of dollars depending on their importance and availability. Law enforcement teams from Australia, Canada, Denmark, Estonia, Finland, France, Germany, Iceland, Italy, New Zealand, Poland, Romania, Spain, Sweden, Switzerland were among those participating in the sting. I don't see, uh, China or Russia in there, for obvious reasons, you know. So Peter, like, you know, I've actually had criminals email me, email me my Social Security number, you know, basically just flexing their muscles, showing me how cool they are and that I am, you know, compromised. And I'm like, yeah, whatever, you know, you got my social, big deal. I got a credit freeze, you know, I have identity theft protection. I've got, you know, I'm monitoring my sensitive information. So I have essentially made my Social, for most new account fraud, useless to a thief by, you know, getting that credit freeze.

No, it's very important because it's really— today it's really hard to safeguard our Social Security number. I mean, we can do all we can as individuals, but so often we have to use that Social Security number when we're registering for something, even if you go to the doctor, right? They're asking for it even though they don't necessarily need it. But that Social Security number is out in so many different places, and there's been so many breaches where that number has come into the possession of these criminals. I'm just, I'm really, this is a really good example. I'm glad you are highlighting it because we don't see enough of this, both the fact that this group has been taken down and the fact that there's been an effort across 14 different countries that have coordinated and cooperated in these arrests. So that's, I mean, that's one of the few good stories, you know, we see from time to time.

Yeah, you know, I love the fact that you brought that up. How often, as a CIA operative, how often did you work with other countries?

Oh, you know, it's a case-by-case basis because it depends on— I mean, you have your friends, friends, uh, you have your enemies, and you have people kind of in the middle. You have— at the end of the day, every country cares about itself, right? So they'll cooperate, collaborate with you if they feel that there is a common, uh, threat, you know, whether it's a common threat to Russia, a common threat is terrorism. You have countries that will cooperate on these different things, but then on everything else, you know, uh, they don't want you as the United States, the representative United States, conducting any espionage on their soil, right? So it all depends. You get, you get agencies that will cooperate, uh, to a certain degree, and there's some that won't cooperate at all.

In this particular scenario, it's likely that China and Russia are benefiting from the cybercrime. North Korea, definitely, of course. So therefore, like, there's going to be no cooperation at all from them.

Well, they didn't say here, but it'd be interesting to see. They had these arrests. Are those individuals arrested then in their— in the country where they've conducted these operations? And they're going to be prosecuted to the— according to the law in those countries, you know, and not necessarily extradited to other, other countries.

I mean, correct.

Yeah, somebody just did a tap on, you know, a slap on the wrist. Other ones might get some jail time. Who knows?

And Peter, like, in the course of, you know, you being out there and speaking and training and meeting all kinds of people, I'm sure, you know, as you expose criminal hackers and what they do and how they do it, you know, that sometimes people might say to you, you know, if these hackers, if like, if they, if they, you know, use their skills for good, like, how much money, how much money would they make? You know, like, you know, don't people like say things to you all the time, like, why don't they use their skills for good?

Right? Oh yeah, but there's— I think there's always, unfortunately, unfortunately, there's always more money in being a criminal than there is in trying to, trying to prevent criminals.

I mean, look at it. Tech News World: top salary for cyber criminals can exceed $1 million. This is April 5th. This is just right around recently. If crime doesn't pay, some cyber criminals wouldn't know it. A top team member in a cybercrime outfit like Conti can make an estimated $1.1 million a year. Since cybercrime groups don't file reports with the SEC, the salary earned by top moneymaker in a large criminal enterprise like Conti represents the best guess by Trend Micro based on leaked information about the group and its estimated revenue of $150 to $180 million in the course of a year.

Yeah, that's salary, but you're not— you need to, you need to increase that because they're not, they're not paying taxes like we do. If we were to make a million— wish I were to make a million— but if we were to do that, look at how much taxes would come out of that. And these guys, they don't even pay taxes on that. A lot more than that.

All right, let's go to Elon Musk's Twitter and via Fast Company, Twitter two-factor authentication changes, how to avoid maybe getting locked out of your account. So let's talk about this real quick. So many Twitter users risk losing access to the Twitter accounts after this weekend. The issue at hand is Twitter's previously announced move to revoke text-based two-factor authentication from all Twitter users who do not subscribe to Twitter Blue. So two-factor authentication, of course, is a critical measure that most good web services offer. It requires that you enter a code anytime you log in in addition to your regular username and password. The code is delivered via a text message or authenticator app when they attempt to log in, but— and it helps to ensure that bad actors who have obtained your username and passcode can't access your account because they don't have your phone in their possession. What Twitter is doing is mandating that those who want to receive two-factor codes via text message subscribe to Twitter Blue to keep doing so. So basically what this is about, for those of you who don't know, um, and if you don't have a Twitter account or don't care about a Twitter account, that's fine. The story is still for you because it's really about the ethics and the security around two-factor authentication. So let me explain real quick. So basically what Elon Musk is saying is if you don't subscribe to Twitter Blue, which is like $8 a month, which isn't, you know, a tremendous amount of money, but it's still $8 a month. If you don't subscribe to Twitter Blue, then you can't have two-factor authentication. Now, of course, there's a cost revolving around two-factor authentication. You get that. But to charge for two-factor authentication. This is the first of its kind that I've ever seen.

Okay.

I've never seen a company charge for two-factor authentication. They generally roll it into their, um, whatever they're, they're, you know, they're whatever they're offering, they roll it into whatever the fees are. But when you are the product, like on Facebook, you are the product, uh, they charge it basically, uh, or write it off in advertising dollars.

Okay. Right.

Now here is Twitter throwing it in the face of every Twitter user and saying, okay, you want two-factor authentication? Fine, you're gonna pay for it, and you get Twitter Blue on top of it, and it's $8 a month. Look, nobody got locked out of their account because that deadline is passed. What did happen though is that if you did not have— if you had two-factor authentication enabled and you went to use Twitter— well, you went to log into Twitter, uh, Twitter prompted you to say, okay, either subscribe to Twitter Blue right now or turn off two-factor authentication, one or the other. So you have a choice, one or the other. Nobody get locked out, you just couldn't use Twitter the way you normally would unless you either subscribed or you turned off two-factor authentication. So that's ultimately what happened.

Yeah, I agree with you.

It's—

it— I don't like this. It sort of sets up— I mean, it's a free economy, right? But it kind of sets a precedent. Uh, think about it. It's like you either pay us or you're not going to have security any longer. You know, whatever happens to you happens to you, but if you want to have this level of security, you're going to have to pay us every month.

It's like— it's like Elon Musk charging for seat belts in his cars. I mean, you roll the seat belt cost into the cost of the car. You know, seatbelts are mandated by the federal government since 1968. Anyways, I think that government should mandate two-factor authentication too, because not having two-factor authentication makes you extremely vulnerable. Two-factor authentication is not bulletproof, we know that. However, it is one of the, if not the best course of action against your accounts being compromised, especially like the article mentions, if the bad guy has your username, which in the case of Twitter is your handle. In the case of many other accounts, it's an account number and/or it's an email address. And if they have your passcode, because you might use the same passcode across multiple accounts, and that passcode might have been breached either in a phishing email or in some type of another data breach, and bad guys stuff your credentials into Twitter and eBay and PayPal and Amazon and everything else, well, they're in. Well, if you have two-factor authentication set up on Twitter and PayPal and eBay and Amazon and so forth, they can have your username, they can have your passcode, they can try to get in. But if two-factor authentication is enabled, they would need your mobile phone in order to get access. So not having two-factor authentication and making users pay for it, I think it's just, it's dumb. It's a dumb business move. It's, um, I think ethically it's wrong, you know.

It'd be interesting to see actually at the end of the day how many people, give me new subscribers to Blue versus how many people just stopped using two-factor authentication and continue to use Twitter without it.

I think all of your major corporations are definitely going to pay the $8. Because nobody wants to be that company that did not pay the $8 for two-factor authentication.

The companies, yes. But individuals, I don't see a lot of people doing it. Yeah, me either. Yeah, that's unfortunate.

Yeah, it's unfortunate. And it just sets a bad, a bad example and a bad precedent.

Okay.

Check this out, Peter. So Here's an article from Daily Mail. Can you spot deepfake from a real person? World's first certified deepfakes warn viewers not to trust everything they see online. Peter, I know because you're one of the world's foremost experts on this, and I know you speak about it, just define for the peeps deepfakes and what they're all about.

Well, deepfakes, basically the term comes back to like 2016, 2017, when synthetic media, such as starting with photographs, but it can be videos, and it can even be the voice, where it can be manipulated so that the— what you're seeing in a picture, you can substitute, you know, different things in the background, or even a person. Uh, uh, you might use the body of one individual with the face of another. Same thing with the video. You might be able to see someone like— and there's been videos of Tom Cruise or Barack Obama, former President Barack Obama, where it looks like them actually speaking, but it's not them, it's somebody else that's using their voice and their mannerisms. It's to create this actually fake media. There's been recently, I think most people would have seen this, photographs, deepfake photographs of former President Donald Trump getting arrested on the streets. I mean, they look real, right? There was even one recently of the of Pope Francis wearing this really chic white winter jacket that was just— I mean, they look real. They look really real. And the concern is now that people— it's getting to the point where people are not going to be able to differentiate between real videos, real photographs, or even the real voice compared to something that could be altered and made a deepfake. And so this is the danger. How do we protect individuals from falling for deepfakes? Deepfakes can be great for entertainment purposes, but they can also be used, they are used, and they will be increasingly being used by criminals to basically defraud individuals. And so how do we differentiate? And I think this is an example where they want to show how they can be labeled as deepfakes to protect individuals. Okay.

Revel AI claims to have released the world's first certified deepfake. Let's see what this is about.

That's showing this individual is actually— it's not, it's not her. She's, uh, she's actually a prominent individual who speaks about deepfakes, and, uh, that's her image, but it's not her speaking. And is that this video was made with deepfakes, and the point is that they want to be able to show how important it is to be able to certify a deepfake, for individuals to see that and know that it's a deepfake that's being used. But my concern is the following: it's like, do we, you know, if we were to have a, um, a currency out there, or you know, I'm going to say any sort of video, I mean, there's going to be people that can say, okay, we're going to certify that this is a deepfake, and everyone's going to know. But the bad people are not going to certify that what they're producing is a deepfake. And so it's almost— for that to work, I think you almost are going to have to certify authentic media as being authentic, because trying to certify something as being fake, if the criminals don't also certify it as fake, it's not— you're not going to meet the goal, meet the spirit of this.

Yeah.

I think that over with the advancement of AI like ChatGPT, you know, and other forms of AI, I think it's just a matter of time until we're going to see a significant world event as a result of the creation of deepfake video that allows people's perceptions to be manipulated in such a way that causes chaos and havoc. I think it's just a matter of time, and I think that we're all going to get duped eventually. I think that this is a form of, uh, social manipulation that is definitely going to, in the end, win out in some way that we're just not prepared for. And until we are affected in that way, whatever that outcome might be, we're not going to know what to do. I think that, you know, recently I was— I just, I did something just this week on TV about a letter that was signed by, you know, Elon Musk and a number of others in regards to basically stopping the development of ChatGPT and other AI for like a 6-month period to kind of sit back and build some ethics rules around AI because it's it's exponentially improving and growing and expanding. But I don't think that anything is going to stop anytime soon. I think that they're just going to, you know, roll steam ahead. But I do believe that we're in for something significant in the near future. And I think it's really important that everybody— like my mom growing up used to say, you know, believe, you know, nothing of what you hear and half of what you see, right? Nothing of what you hear and half of what you see. And today, you know, um, it's nothing of what you hear, and I, I don't know if I believe what I see either at this point, you know.

We are more, based on our backgrounds, we are more, I think, cautious or more guarded, um, than, than a lot of people. There's a lot of people that just tend to, you know, believe or trust anything, and especially if you're able to visualize it, right? It's not just reading about it somewhere, but you actually visualize somebody saying something. You trust that person, but, you know, typically as being a person of high integrity and trustworthiness. And then all of a sudden, that person is saying something that's been, you know, that's been a— that's a deepfake.

You know, people are—

a lot of people are just going to follow and believe it. That individual said or did this activity without even questioning it. This is the real danger.

Definitely freaked out. All right, Peter, so tell everybody, uh, where you're at, website address, what you got going on, what you want.

Oh, well, I'm in Orlando, but I'm also globally and virtually, and you can read and see about my activities on my website, counterintelligence-institute.com. I'm in the process of preparing a lot of material going forward for different presentations that I'm going to be, uh, giving keynotes at. Also in the process of writing another book that's going to be released very soon. I'll I'll say that for another day. Uh, but yeah, a lot of activities, a lot of hard work. As you know, Robert, that as things continuously evolve, uh, it's just, it's a lot of work just keeping up with it, but let alone trying to educate people on these different trends. And we, it's, there's no time to rest. It really is not.

And so, uh, get Peter's book on Amazon, uh, Confessions of a CIA Spy: The Art of Human Hacking. All right, thank you. And y'all can see me and my team at protectnowllc.com. Security, cybersecurity awareness training and certification for small business, municipal, and professional users. And you can contact us via our Contact Us page. You guys are great. Peter, last words.

Well, once again, Robert, good luck in the marathon and be safe and be safe for everybody. Be safe out there. And take care, look out for each other.

Be nice to each other. Thank you, buddy.

Thank you.