Get ready for the rise of imposter employees. #26

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it. And welcome to the Security Guy and CIA Spy podcast. I am Robert Siciliano and this is Peter Warmka.

In case you don't know by now, I am the CIA Spy. Hi Robert, how are you doing?

Doing very well, Peter. Peter, remind, uh, those who might be new to the pod broadcast, uh, where in the world were you stationed? How many years were you in the CIA? I mean, just give it like a brief, you know, because you're kind of a rock star.

Rock star. Uh, well, over 20 years overseas, and I won't get specific locations, but predominantly Latin America, almost all Latin America. And lived in Europe. I traveled a lot, uh, to the Middle East and parts of Asia. So a big part of the world. I mean, that I, I traveled to over 56 countries, uh, during that period of time.

And your job was to, what, gather intelligence, to spy? I mean, what does that actually mean?

My job was to breach the security of organizations that had the intelligence that policymakers back in Washington, D.C. wanted to get. So I would get the requirements. I would have to find out where that information was being held, where, you know, what organization, specifically where in that organization, who would have access to it or who could facilitate access to it, target those insiders. You know, they were the insiders, the employees or contractors, and turn them into insider threats by manipulating them, breaching the security of their company, and gathering that intelligence.

And when you were in the States, where were you working out of?

Well, predominantly Washington, DC, and I wasn't in the States very long, only a year and a half.

Where in Washington, DC?

Well, I mean, their headquarters is in Langley, so Northern Virginia, the Reston area, Fairfax.

Yeah, Langley. Did you all hear that?

Langley.

That's the real deal right now.

Really exists. It does exist. Yeah.

So Peter, today, um, we're talking about some funky stuff. Um, lots going on in the world. Let me bring this right up here. So you were saying earlier in regards to— remind me, Peter— deepfakes, what were you just—

Oh, no, I just had mentioned to you that I just returned yesterday from HR Florida 2022 conference. It's the largest HR conference held in the state of Florida. Every year it's in Orlando. And I had the privilege of giving a presentation on deepfakes and what employees need to know. And I was just amazed. I mean, first of all, tremendous interest, but amazed that such a little of an understanding regarding deepfakes. So many people were not aware. I gave examples and people were like, you know, awestruck. And I explained in great detail, you know, some of the positive benefits, but a lot of the really detrimental when it's used for deception, how dangerous, really, really dangerous they can, they can become. But at the end of the day, it's not the technology that's evil, okay? Technology is neither good nor evil, it's the intent of the user. So, uh, this is just taking a lot of these scams and human hacking to a higher level.

Yeah, speaking of technology and the intent of the user, uh, first we're going to talk about, well, Dick pics.

Oh my gosh, where are we going with this?

Yeah, so Vice, uh, brings attention to creeps airdropping dick pics is the latest air travel nightmare. So I couldn't pass this one up, Peter, because, you know, it just is another example of just how technology is used and abused and just how weird people are. So a recent TikTok video featured an exasperated pilot threatening to ground a Southwest flight to Mexico unless a passenger stopped airdropping nudes. It was the second known cyber flashing flight incident this summer. So interestingly, I was on a flight to Atlanta, uh, maybe about at this point a year and a half, two years ago with a buddy of mine. And, uh, he, uh, you know, guy friend of mine just being a weirdo did something similar to me. Uh, and, uh, you know, I was a little shocked by it because like, what the heck is this? And it was my buddy, uh, you know, and, and I turn around because he wasn't— we weren't sitting in the same seat. I turn around, I look at him, he starts laughing. And so that's one of the reasons why I brought this up, because it happened to me, but it was like a friendly situation, um, and so— but this is a little different. And, um, I've actually seen this same scenario where, uh, the person, uh, airdropped a picture of a gun Oh, wow. Which caused much more alarm. It was more than just mischievous. It was an actual gun as an airdrop photo. So the Southwest Airlines pilot threatened to ground the flight that was about to take off if a passenger didn't stop airdropping nudes to the fellow flyers. We actually have that TikTok right here. Peter, you ready for this one?

Already the end.

So here's the deal, this continues while we're on the ground, I'm gonna have to pull back to the gate. Everybody's gonna have to get off, we're gonna have to get security involved, and it's vacation that's going to be ruined. So you folks, whatever that aircraft that hit us, quit sending naked pictures, let's get yourself to Cabo.

People just dumb.

I mean, can you identify— could somebody identify the phone from which this is coming? I mean, at the geographic location you know, but at least the phone name or phone number. Is that possible? Do you know?

So on my phone, my phone is listed as Robert Siciliano's iPhone.

Yeah.

So it's possible that if the person who did it, uh, had their name associated with their phone's ID, their AirDrop ID, their phone's, you know, ID, then yeah, um, that wouldn't be too difficult to figure out. And I've seen in the past different scenarios where people had done that and it's just a matter of the, um, flight attendant looking at the flight log and right away determining who that person is and what seat they're in. And then bang, that's it. Um, there's a couple of problems there. Number one, uh, of course, you know, anybody can change their phone's ID to anything really, including somebody else's name, right? Right. Uh, they could change it to the name of the pilot if they wanted to. They could name it— they could call it, in this case, Southwest Airlines. They could call it Peter Wormka, right? They could call it anything they want. They can name their phone anything they want, which could cause confusion. And not only that, it could, you know, falsely accuse somebody of engaging in an illegal act. So the important thing here is that you know how to prevent this from happening to you, or at least from receiving photos like this should you not want them. And so right here, uh, we Googled, you know, support.apple.com how to use AirDrop on your phone, iPhone, iPad, or iPod Touch. And it talks about how it works, how to use it, and essentially how to prevent it from happening, or how to access it, how to adjust the settings. So really, you should set up your phone so that you only receive AirDrops from people in your contacts menu.

Yes, that's a good point. Can you share again where that— where you found this?

Yeah, so really all you have to Google, uh, I mean, right here it's, you know, if you, if you actually just search how to use AirDrop on your iPhone, iPad, or iPod touch, and, uh, you go to, uh, Ctrl+C and then just Google it, and then bang, on the very first page of search you see support.apple.com how to use AirDrop on your iPhone. Right, and there it is.

Some people know, I mean, there's a few people that know this really well, but there's other people that, you know, when you talk about airdrop, they say, well, how do you exactly do that? So I think there's a lot of people that could really benefit by reading this article.

Important, no question. And also, this of course will be in the show notes. Yeah, right. So the original article in Vice, and they're right here. So I suggest everybody set up your mobile device so that, um, you know, of course if you have an iPhone— I'm not really sure how things work on Android because I don't do Android. Uh, other than that, you know, you should set it up so that you only get AirDrops from people who matter, or at least, you know, are, uh, close to you, generally in your contacts.

And I can assure you that you will not receive these types of pics from either myself or Robert Siciliano.

Definitely not from me.

Disclaimer.

And I'm not even going to do it as a joke because you just never know. I mean, things can go south, things go wrong, you end up hitting a button where everybody gets it, and, you know, that's not even a good— especially on a plane. Or in a public area, you know, because, because this is the— this— if, if it's, if it's a gun, right, that could be— that could feel like, like a, like a terrorist threat.

Exactly. Yeah, exactly.

So Peter, uh, Protocol talks about, uh, you just hired a deepfake. Get ready for the rise of the imposter employee. We talked earlier or in previous podcasts about how the FBI had sent out a warning in this regard. New technology plus the pandemic remote work trend is helping fraudsters use someone else's identity to get a job. So here, before COVID uh, job interviews took place in person and new hires worked in the office for the most part. But with remote work came increased, uh, remote hiring, from the job application to onboarding and everything in between. So the FBI is concerned, and you should be too. Uh, lies, spies, and deepfake video. Companies have been increasingly complaining to the FBI about prospective employees using real-time and deepfake videos and deepfake audio for remote interviews, along with personally identifiable information, PII, like names, addresses, Social Security numbers, email addresses, mobile phones, to land jobs at American companies. One place they're likely getting the PII is through posting fake job openings, which enables them to harvest job candidate information, resumes, and more, according to the FBI. Think about that, right? That's pretty smart and simple. Deepfake video sound advances— sounds advanced But shady job candidates don't need exotic or expensive hardware or software to impersonate someone on a live video call. Only a photo of the person, uh, consumer products like Expression Camera enables fraudsters to upload someone's picture and use their face during a live video interview. So Protocol is giving you like an idea of how to do it, you know.

So I guess, yeah, the FBI came out with the PSA and I was in June and they were saying that, uh, it's not only criminal groups, fraudsters, but even some state actors. I think they specifically highlighted the North Korean government because where they were really targeting, at least the North Koreans, were individuals that were interviewing, I mean, posting for looking for people with IT backgrounds. So you can imagine being able to get a position and not ever having to physically present yourself for an interview, but interviewing online, right, and being able to fake that, and working remote, so you're not even coming into the office. And the company can end up hiring somebody that has not only access to the IT network but probably privileged access. And, and that person could become the greatest insider threat that that company faces. It's, it's just amazing, you know. And people at the conference yesterday were just like appalled by this too, because some of them do have you know, hiring functions. And so they were like, you know, I had never heard of this before. So it's, it's, uh, there's some things, you know, I think this article even maybe highlights some of the things they might want to consider doing. First of all, I would say don't hire someone that you haven't really met in person, especially for these positions that are like IT and other positions where an individual might have privileged access to information. You might really want to bring that person in for the interview versus hiring them on, you know, interviewing them online.

Yeah, this article does mention the North Korea issue that you spoke to, and it does provide, it looks like, at least 8 or 10 different tips in regards to preventing this from happening to your organization. Hiring somebody as an IT director, some type of an admin that has administrative controls to certain parts of the network that could allow or facilitate them to go deeper to get sensitive information for espionage, um, whether it's a, you know, corporation or a government agency. Uh, so include real identity verification before hiring. Make sure identity matches background screening. Don't assume your background provider is verifying identity either. Asking for a driver's license or a passport can lead to a discrimination lawsuit if the candidate isn't hired They can claim discrimination based on age, health, or country of birth. Requesting this information only after you're certain you'll hire. That's something to keep into consideration. You definitely— HR and legal counsel needs to be involved in this process because it's murky, right? Know the law in your state if you're into find out what's allowed in terms of biometric data collection and so on. So for all of you small, medium, large businesses out there, for your HR people and your legal, this is definitely something you want to dig deeper into because it's obvious that this problem is only going to get worse, and it's going to definitely affect organizations that have, you know, sensitive information on file.

Mm-hmm. Yeah, it's kind of interesting. Criminals don't have to abide or follow the law. To the contrary, they're criminals because they don't abide by the law. But everything that's being done or utilized to make us in a safer environment to prevent these types of— mitigate these types of risks, we have to be very careful in following the the letter of the law, because especially in the case of hiring, as you just mentioned, Robert, there's a lot of considerations, legalities.

Okay, so Security Boulevard talks about how to protect your small business from personalized attacks. I'm gonna need my glasses for this one. So SMBs are increasingly targeted, targets of cyber attacks, and often financially devastated by a single successful attack. Even with a significant network of security tools in place, SMBs can be caught off guard. So Uh, this provides this article, which is a really good one. Um, you know, it's, it's all the stuff that we talk about on a regular basis. Talks about the business email compromise scam, which essentially, uh, in 2021, the FBI says that, uh, that there were about, uh, $2.4 billion in email scams, including the BEC attacks. So how can small businesses protect their employees from these, uh, in both short and long term? Well, for one thing, you can hire Peter or I, Peter or me. This is what we do. This is what we speak to. We educate, uh, your people, your small business, large business, government employees on what to look out for, what to click, what not to click, and really the importance of security in general, making security a part of the way in which you function, not necessarily something that you are annoyed by that you have to do. It's something we teach you that's something that you want to do and why, how it's a benefit to you both professionally and really personally. And once you understand how to protect yourself personally, and that's one of the things we both teach, uh, you are in a much better position to do your job effectively because you begin to care more about security because you understand more and its benefits to you both personally and professionally, right?

Peter, can you go into a little bit about— because I'm sure there's some people in the audience that don't really know what a BEC scam is all about or what it means.

So business email compromise scam. So essentially it's when you as an employee— you could be a frontline employee, you could be a manager, you could be a supervisor, or often a company executive, an officer, right— uh, receive an email that is designed to get you to perform an action to divulge sensitive information. Generally to provide usernames and passcodes. Or, uh, the BEC will pose as a company executive communicating with employees. And as a company executive, say the CEO, the email is, is posing as the CEO, and then it sends it off to all the employees, getting them to do something, to click a link, to provide access, to provide information, to provide or get passwords and so forth. So as the executive in the company— CEO, COO, CTO, CIO, and so on— um, if your identity is compromised or your email is being used to send out mass emails to all of your employees or co-workers, those co-workers or employees are likely to engage in whatever it is that you're saying because you're the boss.

Yeah, I'd like to add to that that sometimes it's targeted, uh, specifically, you know, impersonating the boss, sending instructions to a specific individual who can actually issue, uh, or undertake a wire transfer. And so there's a lot of times when money is sent out of an account and maybe the, the individual who receives that email, yeah, recognizes that name as being a, a client or a vendor, which we, yeah, we do make those payments, but the, the account number has been changed so that the money is actually going to a fraudulent account. And I want to bring up another variation of this which is starting to take hold because we talk about deepfakes. In a typical BEC scam, we're talking about email, yeah, using email as a mode of channel of communication. With deepfakes right now, what we're seeing and using phishing, uh, targeting using phishing, meaning using the telephone, okay? So you get someone that's impersonating the boss who calls the employee, and they can use a caller ID, spoof the caller ID to show that it's the boss's phone number, and then deepfake the voice. You can, you can deepfake the voice practically instantaneous, voice cloning. And so when that person picks up that phone, sees the telephone number of the boss, they will also hear the boss's voice that is being utilized by the fraudster. And there's been a few of these cases already. I don't know if you heard this one back in 2020. It was a bank manager in Hong Kong who had a lot of really important clients. One of them was from the UAE. When he answered, when the phone came, the phone rang, he saw the telephone number of this UAE client. And then when he picked it up, it was the voice of the client who requested 30 or $35 million transfers to cover various acquisitions. And even to further substantiate that, there were some emails, uh, created to show that between the client and the client's attorney, they were talking about these acquisitions. So the, the recipient of this call, the bank manager, yeah, he sent that $35 million out. And you can imagine what the client thought later on when they saw this missing money. It resulted in a big international investigation by the UAE authorities. Over 17 people were identified in the scam. And like most cases, the money is, you know, you don't find the money, the money's gone. But they did uncover $400,000 deposit in the Centennial Bank in the United States. But this is a growing, growing problem.

So they used a number of social engineering scams, cons, to convince the victim in this case to wire the money. So they used phishing emails, right? So they, they in some way, shape, or form, they broke into a network, they got access to email, compromised usernames and passcodes, sent off communications posing as, right, getting the employee to act, to engage. And then from there, they utilized caller ID spoofing.

Yes.

Where they made the phone call seem like it was coming from, you know, the actual person, right? And then they use deepfake audio, in this case impersonating the voice of the actual—

yeah, yeah, it's so easy to do. I mean, maybe in the future, uh, episode I can even show you a video of how, how this works. It's, it's just, uh, it's amazing.

Yeah, it's amazing.

That, that really is amazing. I mean, with, with, with that level of coordination, that level of sophistication revolving around that scam for a $35 million transfer of funds, whatever it might be, you can see how it's well worth the time and effort. And the tools that they're using to engage in this level of fraud are pretty easy.

Yeah, some of them, they don't even invest any money. It's just like almost free.

Yeah.

Yeah.

All right, Peter, so we are almost wrapping up here. Let me show you something that is just crazy to me. And you might be like, oh, well, that's kind of different. That's not necessarily personal security or identity theft protection or even digital literacy. But it's safety, it's life safety, and it happened right outside my backyard, right outside my window. Father and son cling to cooler to survive after boat sinks near Boston Harbor. So it happened, uh, right out at what's called Graves Light. And, and like, I can see Graves Light out my back porch, like it's right there. I go out there all the time in my own boat. So Peter, let's just, just, just check this out. So what happened basically was that These are lobstermen. The father, I think, was in his 70s. The son was in his late 20s. And, um, their, their boat got caught up in their lines because lobstermen, you know, they're pulling traps and they have lines like half-inch, you know, uh, line. And, uh, probably their, their impeller, uh, propeller got stuck. They have like an inboard-outboard. And, uh, and eventually, you know, their motor probably kicked out and they ended up some rocks on rocks. And I know that area, there's rocks everywhere. Which punctured their hull, which meant they took on water and they had to get out of the boat for various reasons, obviously. So Peter, let's just check this out because it's just nuts. Watch this. Oh wow. Here, let your leg go.

Let your leg go. 1, 3, 1, 2, 3.

That's the father, 76 years old. 76. You can see the lighthouse off to the right when he stands up.

Looks like this— fortunately, this is ending well. Fortunately.

Wow, look at your life jacket on. You had a safety ring and a cooler.

Very fortunate.

Yes, you too. Look, see the lighthouse off to the right? Yeah, it's Graves. That's awesome.

Yeah, it is.

Oh man.

So yeah, that happened right outside, right out, right in my backyard basically. And we go out there all the time. And, uh, you know, I sent that off to my family. They're like, wow. I mean, so I am a mariner. I am also a U.S. Coast Guard Auxiliary. And, um, my girls are, you know, we've been on the boat at this point 23 times this season. It's been a great summer. And, uh, my girls are 13 and 16. They wear life jackets, you know. Um, they are not required to wear life jackets, but they wear life jackets on my boat and they don't think anything of it. Like, they wouldn't even not wear a life jacket. I mean, occasionally, like, Daddy, do you have to put a life jacket on? Yeah. Okay, no, no hassle, no problem, no issue. My wife and I, we have life jackets readily at the disposal right there. We have always enough life jackets on board for everybody. As soon as somebody gets on my boat, I point out where the life jackets are. Um, and you know, uh, it's life safety. Like, things happen. I mean, Mother Nature, the, the ocean is a wild animal. And it's not just the ocean swallowing you up, it's, it's, it's other boaters out there that do dumb things.

Also, yeah, it's rocks.

I mean, you, you, rocks are everywhere. And, you know, between your charts and your GPS, you know, your chart plotter, you should know where the rocks are. But even as long as I've been boating, which is all my life, like, I've been in situations where I've lost a propeller, you know, because I wasn't paying attention or I didn't know the area. So things happen. It's, you know, it's dangerous. And so I know we're coming to the tail end of the season, but, uh, for all of you mariners out there, for those of you who get on a boat, know where your life jackets are. Like, it's really important.

Good point.

Yeah, yeah, nuts. Uh, I just thought that was inspiring. So, uh, Peter, um, let's, uh, discuss really quick, uh, what you're up to, where you, where are you going to be, and, uh, you know, what we can do to support you.

Well, actually, things are really picking up. It's getting crazy over this last couple of weeks, the number of events that I'm going to be participating in, some major conferences as well as training events. For clients. And I just want to plug it and throw it out there, it's getting to be hard for the rest of this year, but if people are interested in actually contacting me for presentations or training regarding to, you know, the dangers of human hacking and how to protect yourself and your organization from these attempts at breaching your security by external threat actors, I can do whether it's a 1-hour webinar or even an 8-hour in-person workshop. I, the full gamut. And I'm talking more and more these days about deepfakes. So if that's a topic that could be of interest, be very happy because no one else really out there, very few people are talking about deepfakes. And so I'm a bit on the cutting edge of, of talking about, about this and how, more importantly, how to mitigate the risk of falling victim to deepfakes.

And check Peter out at counterintelligence-institute.com and check out his book, Peter Womack, Confessions of a CIA Spy: The Art of Human Hacking. Uh, you can see me and my team online at protectnowllc.com, and also, uh, check out our e-learning, our CSI protection certification program. We provide phishing simulation training. We also have a virtual CISO on staff, a team actually, that can remotely assess your network's vulnerabilities and patch them up as well. And check out our, uh, email checker and our password checker to determine whether or not your email and/or your passwords are at risk.

So Peter, last words: stay safe out there, especially if you're boating, and always watch out for those fraudsters.

All right, yeah, and be nice to each other. Thank you so much, Peter.

Thank you.