Guard yourself against Russian hackers and bad guys IRL. #29

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Mitter Wormka.

Robert, how are you?

I'm doing pretty good, Peter. Happy, uh, holidays post-Thanksgiving to you. Uh, how was your holiday season so far?

Uh, so far, well, so far pretty good. I think we got some family members that maybe came down with COVID though, but it's going around, it's going around. Uh, and I'm traveling a lot and not many people are wearing— nobody's wearing a mask anymore. And I'm just constantly hearing more and more stories of people getting COVID, like, when they're coming back on the airplane. It just seems to me the airplane and the airports are really, really kind of risky areas these days, especially coming back on these long flights from international trips. Yeah, a lot of—

yeah, uh, well, people are filthy animals, you know.

Well, this too, it's true. But, uh, I mean, fortunately it doesn't seem to be as serious as, you know, the earlier cases of COVID but it just seems to be like it's all over. I mean, the chances of getting it are, are really increased a lot, I think.

Yeah, yeah, I, I'm on my third booster, I guess.

Yeah, I just got mine, my fourth booster.

Yeah, yeah, and I'm cool with that, you know, politically not, whatever. I, I don't want to get sick. I don't want to pass it on to anybody. I got stuff to do and I got places to go. I got bills I got to pay and family I got to feed. So I don't want to be down for an hour, never mind a week or two. And I know people who, you know, only got their first or maybe even second booster and they were down for a bit, you know, down for up to 3 weeks, or at least they felt the effects of it and affected their quality of their life. So for me, you know, I'm all over it. Like, it, it, I think it's a smart thing to do.

Yeah. Other than that, things are good. Uh, we had great Thanksgiving. What about you?

Yeah, I, um, I, I got a, I got a problem with eating. I, I eat like, I eat till I can't move and I just can't stop. Like, I just don't stop. And I, and then I, I eat and I, I stuff my face, and then I don't sleep because I'm so full. My body's so digest— I'm just a mess. I gotta stop it.

I got a secret for you. I think there's a lot of people with that same problem, including myself.

Yeah, I gotta— I, you think like I'd learn, and I haven't learned yet. Like, I'm 54 years old. How, how can I— how come I still abuse myself like that? I don't get it, you know. But it's been good. It's, it's all good. Yeah. And so, um, welcome everybody. Hopefully you all had a a happy holiday, and we still have a lot to go. Uh, we already got our Christmas tree.

Awesome. A real one, or the real one, I presume?

It's a real one. Yeah, I've never got a Christmas tree in November, but, um, my kids, you know, they're getting a little bit older. I don't know how much longer we're gonna have them for. So my 14-year-old was kind of whining about it, like, we want the Christmas tree now. I was like, all right, I'm not gonna argue with that. So she, she participated in all the decorations and everything. If she's in the spirit, I'm in the spirit, so it's all good.

Well, there's definitely a spirit of shopping going on from what I'm hearing, uh, and that's of course, this is the season where a lot of people can be also taken advantage of, right, with so many scams.

Yeah, yeah, which leads us to, um, all kinds of stuff to discuss, uh, right here. Uh, Bleeping Computer, uh, discusses, uh, Russian cyber gang stole over 50 million passwords this year. So here we are in 2022. And this article came out right before the holiday. At least 34 distinct Russian-speaking cybercrime groups using info-stealing malware, malicious software like Raccoon and Redline, which is the name of the malware, have collectively stolen over 50,000 account passwords from over 896,000 individual infections. From January to July. That was like in the first 7 months. The stolen credentials were for cryptocurrency wallets, Steam, Roblox, Amazon, and PayPal accounts, as well as payment card records. So 111 countries were targeted, US being the biggest one, then Brazil, India, Germany. Rise of info-stealers. So let me see, 34 active cybercrime groups. Passwords stolen, 50,000 plus. Cookie files exfiltrated, 2 billion. Uh, crypto wallets breached, 113,000. Payment cards compromised, 103,000. So I wanted to go to where, uh, the— oh, right here. The workers, uh, are responsible— workers meaning the hackers— are responsible for driving traffic to the malware-dropping sites, which they do by using YouTube videos. So they're using YouTube as a platform to spread malware. Black SEO, SEO poisoning, laced torrent files, or malicious social media posts. Peter?

Well, this is very interesting because they're using YouTube. You know, I love YouTube. I think a lot of the listeners do too. And when you start watching a particular video or two, all of a sudden YouTube is going to use its algorithms to push out more videos, uh, that will appeal to you. So if they're using YouTube, they're probably making a variety of types of YouTube videos that will be attractive to a wide audience. And I'm thinking that this is much more serious than just reading the— how many passwords in total? I mean, this is the tip of the iceberg because we talked about this before, Robert Siciliano, and most individuals, the majority of individuals do not have a unique password for every single account that they have. So many people will use the same password for multiple accounts. So if they're— if they get a particular password, it's not just one and count it as one, uh, in a statistic. You can probably multiply it by 5 or 10, I don't know, right?

So once the bad guy has your credentials, they have your username, which generally is an email address, they have your password for whatever account that they ended up, you know, compromising, uh, via info-stealing malware. Then they take that username, generally an email address, and that password for whatever site they compromise, and they use what's called credential stuffing software where they will then stuff that, uh, those credentials into hundreds of thousands of different websites simultaneously. So if you're using the same passcode across multiple sites, it makes it very easy for the bad guy to get into all of your various sites that you are a party to. So the best way to, to deal with this proactively, number one, is not to have the same passcode across two sites, never mind 20. So using a different passcode across all your sites, and that requires for most people a password manager software. So here I do a quick Google search for password manager, and there's articles that show up like 10— top10cybersecurity.com. Consumer Voice has 10 best password managers. I like to scroll down to this article via PC Magazine, the best password managers of 2022. Click on that, it opens up to, uh, the best password managers that PC Magazine investigated. They did the research on it for Dashlane, Keeper, Zoho, Bitwarden, uh, LastPass, 1Password, LogMeOnce, NordPass, RoboForm, etc. And from here Password managers facilitate you being able to create a different passcode across each account, uh, updating all of your existing accounts with a new passcode, and it automatically takes you to the various websites you want to go to via the password manager. This really is the most effective way to manage and store and create passwords with multiple accounts. And on top of that, you want to have multi-factor authentication for every and all critical sites.

Absolutely true.

Yeah, Peter, you use the password manager, I'm sure.

Yes, I do. Uh, I use one of the— I mean, one that's been around for a while, but it's one that also had been hacked a number of years ago. And so it's not— that's not foolproof either. We have to be— and a lot of these password managers, you know, they'll allow you to put in the password you want, but they'll also recommend stronger passwords and they'll also let you know, hey, it's about time to update. You know, they'll constantly remind you of how you can continue to improve your, your password hygiene, which is good. Um, I highly recommend using password manager these days.

Yeah, so, um, as far as password managers getting hacked, Peter, I am unaware of a password manager software program being hacked in such a way where all of the user credentials were exposed in plain text.

Correct.

Correct.

So yeah, you know, there are breaches of password managers, but none that I'm aware of where our data was exposed. Yeah. So the low-hanging fruit is not the password manager software, the company themselves, their servers being cracked or hacked. The vulnerabilities are the low-hanging fruit where the users are using the same passcode across multiple accounts. And their credentials are being stuffed into various sites. So if you're not using a password manager, people, then chances are you have the same or similar passcodes across multiple accounts.

Either that, or I find there are quite a few people that will write down the password, right? And they'll have it maybe inside their wallet or their purse, or maybe even on, on their phone. You know, they'll have a little— they'll have a document that pops up with their different passwords.

Yeah, and that is okay, you know, but I think the easiest way to go about it— for me, for $20 a year, a password manager works across probably the 15 or 20 different devices that I have. One license covers me everywhere across operating systems, across browsers, across devices. And, uh, look, if something happens to me, like if I die, my wife and kids have access to my password manager to settle my affairs, to get access to all of our accounts. And so forth. So it's a great, you know, tool for the afterlife as well, as morbid as that sounds.

Yeah, good point there.

So, uh, one thing I wanted to point out to peeps is if you go to protectnowllc.com, my company website, and scroll down from the top to the bottom, you will see, uh, check if your email has been breached and check our email checker. And what we have right here is access to over 13 13 billion, or about 13 billion stolen records that were essentially accessible on the dark web. So if I type in, say, Robert Siciliano at gmail.com and I click search— check this out, Peter. So right here, your email and possibly your password have been stolen in the following breaches. In February of 2018, a massive collection of 2,844 breaches included email addresses and passwords, including my email address and passwords associated with what accounts, I have no idea, right? Apollo in July of 2018, sales engagement site, had 126 million email addresses compromised. A Bitcoin forum and Bitly, both in 2014. Café Mom Cove in 2020. Discus, Dropbox, Epic, Forbes, PhotoLog, GateHub, Gravatar, Last.fm, LinkedIn, which many people were a party to in 2016, 164 million email addresses and passcodes. So for me, knowing this, with my username for various accounts was compromised, not because I did anything wrong, but because these sites were breached because they were hacked, um, you know, I just have to go into each one of them and change my passcodes to tighten them up and enable two-factor authentication. And I do that with the assistance of my password manager. My password manager creates a long and strong uppercase, lowercase, numbers, and characters password for each of these sites, and I just train the password manager to recognize each site. So when I want to visit, say, LinkedIn in the future, I simply just, you know, go to my password manager, go to LinkedIn, it automatically takes me right there and it automatically logs me in. And if I have two-factor authentication set up, I get a one-time passcode to my mobile phone, and I add that in, and I'm— bang, I'm on the site.

That's wonderful. Can you repeat again where, where the, uh, listeners can find it on your website?

Yeah, so if you go to protectnowllc.com, protectnowllc.com, and then scroll to the bottom— so if you go to the home page, scroll to the bottom, it's like just right down here. Email checker and password checker. You can actually check to see if your passcode has been compromised too. And we don't like access this data. We don't even have access to anything. We don't store anything. It just— it's allowing you to scan files. One of the most used passwords, if I type in right here 1, 2, 3, 4, 5, 6— 1, 1 through 6 is used 37 million times as a passcode, right? And the word P-A-S-S-W-O-R-D, password, is used, uh, 90— let me see if I did that right. Uh, let me hold on one second. P-A-S-S-W-O-R-D, password, is used, yeah, 99,636,000 times. And password1 is used 3,262,000 times. Like, bad guys know this. Bad guys know easy to guess, easy to hack, easy to crack words out of the dictionary, sequential numbers on the keyboard. Like, bad guys know this. They're not stupid. I mean, this, this is what they do for a living. It's really up to us to, you know, do our own due diligence, digital literacy, password managers, different passcode across multiple accounts. Use a password manager and multi-factor authentication. If at the end of this show today you don't have a password manager, I, I don't know what to tell you.

Exactly. We've been talking about this so long, so many people highly recommend it. And if you want to be a low-hanging fruit, well, that's, that's what you will become because, uh, you make it just so much easier for, for the bad guys to get to you, right?

All right, Peter, check this out, right? So, uh, the, um, Club Q Oh yeah, I heard about this one. Oh man, so another, um, active shooter, uh, you know, deranged individual that, uh, goes into a nightclub and, uh, you know, mows down, uh, 5 people, uh, a bunch of others injured. And this guy, um, Richard Fierro, uh, who was, uh, you know, on site with his daughter, daughter's boyfriend, his spouse, uh, this guy is an Army veteran. I think he served, uh, 4 tours in Afghanistan. And, uh, he, you know, um, uh, his, his training kicked in. Uh, CNN interviewed him. I'm gonna play a couple of minutes of what he had to say. If, if y'all have not seen this video of Richard Fierro talking about what he did and how he did it, I mean, this is the definition of a hero. I mean, this guy selflessly went after this guy, you know, guys armed with two different firearms. And he beat the guy with his own gun. So I'm gonna play a little bit of that video right now. PD, you ready?

Yes.

Fell against a, uh, it's like a bench seating, and I, uh, and I, uh, at that point I saw the shooter. I had no idea what was going on, but apparently I saw him go— going to the patio area because I saw a lot of people in the window. It may not even been a window, but I saw a lot of people and this guy was there, and I saw the ACU pattern, uh, black vests. And for me, that was like, there's a handle, I'm getting it. So I ran across the room, grabbed the handle, pulled him down, and then started to, uh, well, actually, I think I went for his gun with him. His rifle flew in front of him, um, and the young man that tried to jump in there with me, um, he, he— we both either pulled him down or whatever, but he ended up at his head, uh, and right next to the AR. And then with the AR He— we— I told him, push the AR, get the AR away from him. The kid pushed the AR. I don't know what his name was. And then I proceeded to take his other weapon, the pistol, and then just start hitting him where I could with the armors in the way. And I just started— I found a crease between his armor and his head, and I just started wailing away with his gun. And then I told the kid in front of me, kick him, keep kicking him. And we were— I was, I was guiding, I was telling people, call 911, call 911. I brought him down. I, I, I was in mode. I was, I was doing what I did— I do downrange, you know. I train, I train for this. I don't want to ever do this. I, I didn't even retire because I was just— I was done doing this stuff. It was too much. And, uh, I, I, you know, it came in handy and I got to protect my, my kid. I lost my kid's boyfriend. I tried, I tried to have everybody in there. I still feel bad that there's 5 people, there's 5 people that didn't go home. And this, this guy, I told him while I was hitting him, I said, I'm gonna kill you, man, because you tried to kill my friends. My family was in there.

My little girl was in there with her We are so sorry for the loss that you and your family have gone through, uh, for the loss of your daughter's boyfriend. And we are so sorry for your two friends that are still recovering in there. And I can't imagine going through what you and your family did, even with your training. Your training was for war zones. You trained to do that in combat, you know, not out for a night on the town.

Yeah, but it lives in you if you actually do this stuff. It's in you. I, I, I was proud to be a soldier. I don't, I don't like these guys running around here doing GI Joe stuff, and, and they're not— I'm not a GI Joe. I'm just a normal guy, man. I, I'm protecting my family, and I reached up and I, and I, and I, and I did what I had to do.

He, he did what he had to do, Peter.

Yeah, and I think that what one of the big points here is the training and conditioning he had that he received while in the military, where he just kicked in automatically. And we talk about this a number of times, is the whole, uh, for us, um, where situational awareness comes into play and is so important. And I, I don't think I ever talked about this, Robert, but when I first started out in the CIA I actually went to a 2-week really intensive course that became instrumental for me in developing situational awareness. Whether you were in a car driving and be constantly, consistently aware of who was in front of you, who was in back of you, who was on each side. When you get up to a traffic light, always leave enough space between your car and the next car that if something happened, you could get out of there and you weren't penned in. Always looking for what's going to be my escape if something were to happen, always looking at who's on, who's on foot. When someone's coming up, like, like we're going to pass, look into their eyes and look into their hands to see if they're carrying or if they're looking at me. Um, and, and most people, you don't automatically have that unless you grew up on the streets, you know, in an area where you, you had to really be aware of what was going on because you could be robbed. Most of us, most of your listeners We don't automatically have that situational awareness, but it's so important. And if there's any way for us to get it, whether it's through some auxiliary sort of training or just try to practice little by little every day of being aware of what is going on around us. And I think when this happened, there were some people, I mean, not only this, but these other types of attacks when there's like shots going off, some people might think they're shots, other people just think it's part of the music and have no idea. What's going on. So it's really important to be aware of your surroundings.

Yeah, 100%.

Thank you, Peter.

That was really good. I, you know, teach self-defense, right? I teach, you know, personal protection. And I have daughters, and every time they leave the house, it's like, you know, look both ways, to the right, to the left, knowing what's going on behind you, 50 to 100 feet at all times. My daughter, when she heads outside, when she's on the way to the train, she only wears one earbud So she has her other ear paying attention to everything. She's always looking both ways, you know, whether it's from predators or stupid people that are driving that aren't paying any attention. You know, so it's always a matter of having your head on a swivel. Every situation you're in, being fully aware of your environment, looking for red flags. And in this case, you know, active shooter, you have options. You know, you don't necessarily have to sit back and be victimized. You may not be the right person to go after the bad guy. But at a minimum, you should know what your options are.

Mm-hmm. You know? Absolutely right.

Thank you, Peter.

Yeah.

Yeah. And he is the real deal, that guy.

He is the real deal.

All right. So, this is just totally messed up. Daily Mail does an exclusive. It's frightening for society. Thousands of convicted pedophiles in California are being released from prison in less than a year for horrific acts, including rape, sodomy, and sexual abuse of kids. Under the age of 14. An analysis of California's sex offenders database shows thousands of child molesters being let out in just a few months. They revealed that more than 7,000 offenders were convicted of lewd and lascivious acts of children under the age of 14. Of those, 7,000 pedophiles were released the same year they were convicted. Man. I think—

That's a crime. That's even a greater crime, perhaps, leave these people out like that. I mean, it's, it's insane.

You know, California, uh, I think it was a law back in 2016 that, um, if they were non— considered like a non-violent type of a crime, uh, that they were convicted of, that they could be let out after a certain period of time. And for whatever reason, the classification of certain level of sex offenders for whatever reason, was considered non-violent. And it seems that obviously that has to change, especially, you know, in California and elsewhere, whoever might have adopted similar laws. Look at what this boils down to is we as a society got to do more to protect our children. And look at, Peter, I've been, you know, speaking and training people on personal protection for the majority of my life, and I've learned over the years, and I have some studies to back this up, that probably 96 to 97% of all people are good and they are trustworthy. 96 to 97% of all people. But what that also means is that probably 3 to 4% of all people are not good and they're not trustworthy, that they are essentially predators by their nature, whether they are hardcore narcissists, hardcore sociopaths or psychopaths, that they look upon you and I as their natural prey. And that 3 to 4%, if you look at prison statistics, at any given point in time, it's between 1.5 and upwards of 3%. Okay? And if you look at, um, those with antisocial personality disorders, uh, it's anywhere from 2 to 3% at any given time. And this is going to be a bit disheartening to people, Uh, and if you look at that 7,000-person figure in California, uh, you know, there's obviously heterosexual and homosexual. Well, if you look at like psychologytoday.com and other resources, doctors, psychologists, they look at, um, pedophiles as being a form of sexual preference. So that being the case, not all pedophiles act on their urges, but I wouldn't trust my kid around them.

No, not at all. And that's why I think it's so important that parents have these discussions with their kids to say, these are the types of things that happen, these are some of the warning signs, and you're much better. And you hear about it. I mean, you hear from time when all of a sudden kids were approached by somebody, you know, driving up to them, and, and they did not get into the car and they do the right thing, right? But I think it's— if the parents don't teach the children regard to this, who's going to? Some of the schools might have programs, but I think we got to really start at home when our kids are very young, you know, because these cases of pedophiles, I mean, it can start when the kid is 2 years old or 3 years old. It's not when they're teenagers per se.

Yeah, it's all about, you know, good and bad touches. Recognizing risk at a young age, knowing that it's not like just strangers, that it's often people that are known to the victim. In many cases, that might be family members. It could be neighbors. So it's really important that parents are engaged in this uncomfortable dialogue, uncomfortable conversation with their family members at a young age because they This is the world that we live in. Um, this might sound odd to people, but, um, pedophilia— this is going to sound odd— pedophilia is normal. And what that means is it doesn't mean it's okay, it doesn't mean it's acceptable, it means that it's always been like that, it is, and it always will be like that. And these people are, in a sense, you know, just like us I mean, not necessarily in our preferences, but like, they're all around us. It's, it's not okay, but it's normal in the fact that it's always going to be like this.

Yeah, I agree with you. It's been around since the beginning, beginning of time. And you're right, there's people that have used— if you see them, you interact with them, you think they're like anybody else, but you know, they have that, that side to them.

Yeah.

So, uh, Peter, uh, tell everybody what you are up to, where you're at, where you're going to be.

Well, I just came, I just came back. I usually shouldn't say where I'm going, right? You say after you come back, it's safer to say where you've been. I just came back from Saudi Arabia, actually. Was a great, uh, event, a conference there. I, I gave two presentations, um, and it was very interesting. I hadn't been there in 15 years, so I saw, saw a lot of, uh, of interesting progress, and, and I, I just enjoyed it. I also came back from DC last night. I'm working on a project with Wondrium to come out with a program that's going to be later in the year available called How to Spot a Liar and Get to the Truth.

Yeah.

And I'm going to be traveling, um, in the very, very near future— I won't say exactly when— in the very near future to, to Mexico. And I'm speaking at one of the largest banking conferences in Latin America. So I'm looking forward to that.

That's exciting. And provide everybody with your website.

Yes, counterintelligence-institute.com. And actually, I feel kind of generous right now, Robert. Within 10 minutes of this broadcast finishing, I'm going to provide— I'm going to be— I'm going to offer my feature course, Confessions of a CIA Spy: The Art of Human Hacking, with a 50% discount. Just use the code SPY50. SPY50. Okay, 5-0. And, and, uh, that'll be up there within 10 minutes for the first 50 people that get in there will get it. But give me about 10 minutes to update the site. I could— I say this is like an entire career of experience and insight put into 3-hour course. So it's— I consider it pretty, uh, pretty interesting, pretty invaluable if you're interested in this type of thing.

And that's at counter-intelligence.com, right?

Counterintelligence-institute.com. .com.

Ah, thank you. Sorry, that's right.

Thank you.

One more time, one more time.

Counterintelligence-institute.com.

Perfect.

And you can see me and my team online at protectnowllc.com. And Peter, final words.

Robert, take care. And everybody listening, take care. Look out for each other. Be aware of what's going on. And when you can help somebody who's in, uh, distress, like that gentleman we saw, go in there, you know. And, and help, help our fellow human beings out, because a lot of people do need help, uh, in different kinds of situations. So let's be on alert.

Thank you, Peter.

Thank you.