How attackers hack humans using artificial intelligence #10

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to The Security Guy and the CIA Spies Podcast. I am Robert Siciliano, and this is Peter Wormka joining you from Washington, DC.

I'm on the road, Robert, been really busy.

You're working today.

Oh yeah, my wife would say like every day I need to slow down, but there's just so much to do, unfortunately. And you know, fortunately or unfortunately, I mean, in our realm of security, uh, there's a lot of things that need to be done. And we're— and that's why there's a lot of things that we can do, a lot of demand, a lot of things that, that I think will continue to grow. I mean, I've been traveling a lot, and, uh, I just had a reflection today is when COVID first came A lot of these in-person presentations were just like impossible, right? We went virtual, and I'll be honest with you, I hated virtual. I hated it. But long story short, now as we're coming out of it, I'm doing a lot of in-person events, but I'm combining these with virtual that would have been impossible before. Just to give you an example, last week I spoke before a group, ISC Squared. It was a virtual presentation, and I had 1,600 people in the session. It was just phenomenal, this— how this is really, really growing. So that's a great satisfaction knowing that we're able to reach a larger audience through this virtual world, just like this podcast.

Yeah, no question. The, the, um, uh, uh, meetings in person are slowly coming back, and people definitely want in-person meetings, but then there's a segment of the population still wants online. And, and you're right, it does open up the, um, amount of people that can consume our content, uh, much greater bandwidth, which is really a good thing.

Yes. Yeah. How are you doing?

Business is, is nuts. Uh, the business is good. And, you know, like you said, like, look at— if, if all security issues would go away, I would find something else to do, you know. Uh, but, uh, as long as this— bad, bad guys are essentially good for business, as they say, right?

There are, and there's a lot of things that have been happening in the news lately, uh, that we've been looking at, right?

Yeah, and we'll be talking about, uh, those things right now. So, uh, first, Peter, I was doing some searches in my feeds and, uh, I found this article via Dark Reading. Uh, can you see my screen right now, Peter?

I can, and I do recognize—

yeah, the article is titled How Attackers Hack Humans. Uh, inside their motivations, how they go about it, and what businesses can do about it, according to Counterintelligence Institute founder Peter Wormka. So I was pleasantly surprised when I came across this article, and, um, it talks about how one of your employees is sitting quietly in the porch of a summer rental over Memorial Day weekend when the annoyingly familiar bloop of a text message interrupts the quiet. Text message goes on to say that, sorry to disrupt your well-deserved weekend, but we just became aware of an issue that could significantly delay processing your pay, right? And that's an immediate concern to the recipient of that text. Read the text message from the head of the HR department. To address this, log into your new HR portal using the following link utilizing your credentials. Well, I think we know where this one's going to go, Peter.

Yeah, what happens is that so many people think that they're going to get, you know, if they do get approached by a human hacker, it's going to come in the form of an email, right? You know, we hear about typical phishing being that malicious link to be clicked on or that malicious attachment should be opened, and that's sort of old school. I mean, it still happens a lot, of course, but now so many of these things are coming in other shapes and forms. There's other ways that threat actors and human hackers can communicate, reach out to us, and it's not only email. As we spoke on previous occasions, it can be through social media platforms. In this particular case, it's through our phone. It's a text message. A text message can also carry that link or an attachment, and it could become even more damaging in a sense that more people will likely fall for it People will notice it. They typically have their phone set to notifications more so than when they receive an email. They will receive a notification when the text message comes in and tell to take a look at it right away and decide whether or not to give it importance. In this particular case, it is payroll. Now, who's not going to be concerned about payroll? I mean, for some people, getting paid is everything when it comes to showing up for their, their jobs. So that gets their attention. And they're going to immediately trust that it's coming from who they say it is, because it's signed by the head of HR. So, you know, I mean, they fall for it easily.

And device, the personal devices, you know, your, your PDA, right? Your mobile phone, your smartphone is as personal as it gets. And so when someone is posing as somebody from corporate, it's likely that they have your phone number, you know, like, it's not random. It's on purpose. It's, it's that they have you in their database, uh, and that, um, uh, you're more likely to respond to it. The reality of it is, is that that scammer, in this case, they either A, they did in fact get access to the corporate database and got all the, you know, employees' information, or they just did a search on the company website and saw you right there as one of the company officers and were able to just do some quick, you know, intelligence, uh, searches and found you and found your phone number and contacted you. And by doing some basic due diligence, uh, basic research, they have everything that they need in order to scam you.

Yeah, it's very, very easy. I mean, uh, it's kind of— it's kind of funny that our phone numbers have become our identifier, almost like our Social Security numbers, right? We typically have the same phone number forever. So the fact that we have— I mean, be honest with you, I think I've had my phone— yeah, I know, I know, I don't want to see how long I've had my phone. A long, long, long time. But given the fact that we have our phone numbers for so long period of time, it's likely that doing some basic searches, that telephone number somewhere is going to show up. It's not that, that hard to find.

I've written articles titled 'Your mobile phone number is the new Social Security number.' So yeah, so look at the moral of this is that every single time the phone rings, an email comes in, or you get a text message Don't just automatically reply or do what they say. It's important that you recognize risk on a minute-by-minute basis, especially when it comes to inbound incoming communications. And don't just automatically trust.

This is a cultural change. This is hard because we, we have not been brought up, you know, typically within our society in America, we talk about other cultures are a little bit different, but in the United States, we are not brought up to question. I mean, we believe things that people tell us, right? So we have to change that culture in that regard because otherwise we— I mean, people are falling by the thousands and thousands because these scams are so easy to put together. And people every day— and we're going to see, yeah, right, this article you're bringing up right now is another level but it's the same kind of concept.

Yeah, bank robbers in the Middle East reportedly cloned someone's voice to assist with a $35 million heist, says Gizmodo. So it goes on to say that criminals appear to have stolen some $35 million from, uh, a UAE bank with the help of artificial intelligence enhanced voice simulation. Uh, the deepfaked vocals were used to fool a bank employee into thinking he was handing over the cash on behalf of a legitimate business transaction associated with the bank. The story, which is sourced from a recently uncovered court document, took place in January— it looks like 2021— when the undisclosed bank branch manager received a seemingly normal phone call. The person on the line claimed to be the director of a large company with whom the manager had previously spoken and they sounded just like them, the court documents claims. This paired with what appeared to be emails from the company and its lawyer convinced the branch manager that the firm was in the midst of a large business deal worth $35 million. He subsequently followed the caller's orders and began initiating a number of large money transfers from the company to new accounts. Unfortunately, it all turned out to be a sophisticated scam. So Let's dissect this really quick. You know, if my wife calls me, it's my wife. You know, like, if I receive a phone call from my wife, I know my wife's voice. If you call me, Peter, your voice is pretty distinct. I know it's you.

Okay.

Um, you know, if I hear from my daughters, if I hear from my dad, it's all very distinct. And so now, through technology, through artificial intelligence, The ability to deepfake a voice is readily available, and what that all revolves around is with the right amount of audio that is downloaded into an artificial intelligence software program, the tone of voice, the modulation, like everything about that voice can all be dissected and put together, and that audio can then be regurgitated in such a way where um, the actual voice, the footprint, the biometric of that voice can be put together in such a way where it sounds exactly like that, or it essentially is that person, right?

Right. And what makes this even more dangerous, we've spoken, uh, previously about call spoofing, where you're able to spoof the caller ID number, where if you pick up that phone, um, the hacker could actually place the call and utilize the telephone number of your boss, right? So you see the caller ID, your boss's cell phone, let's say, and then with this technology you actually hear his or her voice, which even makes it more, you know, convincing to you that that definitely is the boss. One way, one way around that today would be, for example, we were on the Zoom, right? And you could spoof the I mean, you could modify the voice of the audio, but you could not yet modify the video live. Those videos that we see, like of Tom Cruise, those are all ones that are processed and they're not live, pre-recorded, recorded and manipulated. But the voice, the audio can be done live, and that is truly very dangerous. And we're going to hear more about that, uh, going forward, for sure, especially with the $35 million heist.

You're going to see this every day now. It's just a matter of time. And then coupled with the fact that the banker received an email claiming to be the client and the client's lawyer, so the banker had multiple forms of what would be considered authentication or verification that this was a legit— legitimate transaction, and then just went ahead and proceeded as instructed. And you really can't blame the banker for doing what they did, because it sounds to me like they did what was essentially protocol. Now, they verified and authenticated through email, through the phone, but what they didn't do, as you said, was through video. And, you know, there's got to be, uh, additional layers of authentication and verification that are going to be required in the future. And utilizing platforms like Zoom and others I think probably will be one of those requirements.

Right, but there's also, especially when it comes to these money transfers, we might have to set up— I would think some financial institutions should really be seriously thinking about authentication procedures that might include having authentication codes between them and their respective clients. And we've done this in the intelligence world for a long time, where we use authentication codes to verify that this individual is truly or that the message is authentic versus someone else that's trying to penetrate the communications and change something. So it's not a new tech, it's not a new procedure, but I think the business world is gonna have to adopt this type of authentication going forward. If not, it's gonna be very difficult.

And this is one of those stories that I think that you and I will be telling over and over again until the next time that it happens, we'll be telling the next story. Because businesses really do need to, uh, realize that this is going to happen to them in the very near future. Okay, so, uh, now here, um, dark reading, uh, talks in regards to U.S. water and wastewater facilities. Water is incoming, wastewater is outgoing, right? Uh, targeted in cyber attacks. Feds warn. So CISA, FBI, and NSA issue advisories and defense practices to help these utilities thwart ongoing threats targeting IT and OT networks. So CISA and FBI teamed up, uh, to discuss these campaigns, uh, hacking campaigns. Both known and unknown cyber threat groups have been going after both IT and OT network systems and equipment at these facilities, the agencies warned. This activity, they say, which includes attempts to compromise system integrity via Unauthorized access threatens the ability of water and wastewater systems facilities to provide clean portable water, potable water, to effectively manage the wastewater of their communities, the alert said. The report includes more detailed mitigations and defenses and details on the modes of attack, and the agencies recommended water facilities immediately adopt practices of not opening suspicious links, secure and monitor remote desktop protocol, and employ strong passwords. And multi-factor authentication, and it speaks to ransomware. So we've discussed this in the past. We know that these critical infrastructures are under attack. We know that the motivation ultimately is for the bad guy to get paid, and that generally is via, you know, ransomware. Okay, they, they, the, the employees click a link, they log in, they provide credentials, they do something that, that infects their system, which ultimately means that that system is under the control of the criminal. And then ransomware ultimately is the request, and often it is paid, and that could be several millions of dollars in many cases, right? Where— but if it's a municipality, a local municipality, it's likely not to be that much. It's likely to be somewhere in the, you know, 5 or 6 figures, because municipalities don't have millions like, say, um, you know, a, a gasoline pipeline energy company might, right? A local municipality just doesn't have that kind of money, and the bad guys know this. All that being said, um, what's alarming about this, the most alarming aspect about this to me, is that the FBI and CISA and NSA are recommending, uh, not opening up suspicious links, securing and monitoring remote desktop protocol, employing strong passwords and multi-factor authentication. That's what they're recommending. While the recommendations themselves are solid, it's just amazing to me and unfortunate that that's what they're recommending, because that's what the municipalities aren't doing. What are your thoughts on that, Peter?

No, I completely agree. What, what I think is really of concern to me is that we see what— from time to time you hear about these, um, breaches, right? Especially if it's of critical infrastructure. That's the kind of stuff that does meet, you know, does reach the press eventually. It's got to be reported. But there's not that many of them. And there's— I mean, there are, but what really is the danger here, and I truly believe that there's a lot of these that already have been penetrated They have already placed malware. It's sort of like waiting for a time in the future, because there's two levels of this. One is pure criminal, to ransomware, some other financial extortion. The other is cyber warfare that's of the interest of foreign nations. Sometimes they work hand in hand. So think about this scenario. You have a lot of criminal groups out there that are in the process, that have targeted, hacked into critical infrastructure. Some of them have been allowed and went and go and conduct ransomware. Other ones are just leaving the stuff on the shelf for a later date, later date for their use, or later date for the state, the state actor that's maybe aware of what they're doing, because sometimes they work hand in hand. So the fact that we haven't heard more about this doesn't mean that there are a number of these on the shelf ready to happen when the time is right. So I think more organizations need to really look carefully and do scans about what malware might be on their systems right now, right now, that has been there for a while, that's in place. Because these things, there's a lot more out there than what we're hearing about as far as the danger and the risk that's, that's out there.

It is going to get worse before it gets better. Um, and you know, for the consumer, right, uh, knowing that the, uh, your critical infrastructures are under attack, water in this case, whether it's incoming or outgoing, right, means that there is a likelihood that in the near future you may not have clean running water. Now, it might not be, you know, it could only be for a day, it could be for a week, it could be for a month, right? So then the question becomes, how much water do you have available to you right now stored? How much clean water do you have uh, stored, say, in your apartment, in your single family, in your basement, in your garage? You know, do you have a gallon? Do you have 6 gallons? You have any at all? Um, I always have at least 60 to 75 gallons going at a time that I make an effort to rotate. Uh, you can get a 55-gallon drum for under $100 that, um, uh, is, is food grade. Uh, and then you can get a pump for it. You can get, um, various— I think it's iodine pills that to keep the water clean or to clean water. Um, I could be wrong about that, but I think I'm right. Uh, you have a number of different options. There's what's called the LifeStraw for under $20 that you can drink dirty water with. The LifeStraw, it filters it out as you're drinking it. Um, I think that just people need to think in regards to being a bit more self-sufficient than they have been in the past, because if the grid goes down for any period of time, that means you're not going to have any, you know, food available at the grocery store because it's all going to spoil. Um, the grocery— if the grocery store doesn't have electricity, they're essentially shutting down, uh, if they don't have refrigeration or cooling, right? And if the municipality doesn't have the ability to clean water, you may not have clean or even running water for that matter because the pumps won't run. So, you know, besides all of the security that's required through the municipality to make sure that this doesn't happen, you as a consumer, we as consumers need to have our own contingency plans in place so that we're prepared should the lights go out or the water, you know, stop flowing.

I've lived in a number of third world countries and traveled to others as well where it's, it's, it's very common to have to plan around a, a lack of water, a lack of electricity, and dealing with power outages. And I dealt in one particular country power outages for over a 3-year period. You learn to adapt. But here in the United States, I mean, we've been very fortunate that we, we haven't had to worry about these type of things generally unless there's a storm that goes through, and then typically we get our power restored within a a few hours and maybe a couple of days. But if we end up being subject to potentially an attack on our critical infrastructure, that could be for days or weeks or even months. And your comments, your recommendations about we need to be thinking about that, we need to store up some of the commodities that we rely upon and not think that we can readily get them. It's really, really important advice.

We're just too dang comfortable is what it boils down to. Yeah, yeah. All right, so, um, uh, right here you should see, um, the Register talks about US government claims ransomware earned $590 million in the first half of 2021 alone, mostly in Bitcoin, uh, says the Financial Trend Analysis Report by the agency, and reflects, uh, transactions identified Financial Institutions SAR, uh, FinCEN's analysis of visible blockchain activity yielded $5.2 billion figure. So, uh, there were, I guess, 630 suspicious— 635 suspicious activity reports, of which 458 described transactions reported between January 1st and June of 2021. So yeah, that just kind of backs up everything that you've already— we've both said, Peter. Like, it's— there's a lot on the shelf. There's a lot of, uh, breaches that have already occurred where the, um, entity may not even know it yet, and it's just a matter of time until the, um, attack is, is recognized and realized, or at least executed, and that's when the ransomware will be requested. And so That— all that being said, you know, all of these municipalities, government agencies, corporations really need to do some vulnerability scans on their networks to determine what their current vulnerabilities might be, what, um, uh, intrusions may have already occurred, uh, internally, you know, where there might be, uh, existing malicious software that they may need to eradicate before it matures. So Yeah, this problem is going to keep getting worse before it gets better.

I really think it's much worse than this, Timmy. I think this is— this number is, uh, not— I mean, it's much lower than I think of the reality. Yeah, of course there's going to be— when, when the government gets hit, whether it's a state or federal or municipality, they're going to, uh, report that for the most part. Private sector, you know, there are certain rules in place. We talked about this before when they have to report it. There's many times there's a significant lag time when investigations take place. Could be years before they actually report something. And then there's a lot of small to medium-sized companies that are not reporting that they've been victimized by ransomware. They've ended up paying it because they just don't trust that the government— the government's going to really be able to do anything, even if the government says don't pay, well, they're, you know, they got their hands tied. What are they going to do? So they end up paying it for the most part and not reporting it. So I think that this $590 million is, is low, unfortunately, very low compared to reality.

Yeah. All right. And so, um, the last, uh, story we have today, Peter, um, this one is just messed up. Uh, riders held up phones as woman was raped on SEPTA train in Philly, police say. No calls were made to 911, said the police chief. People need to watch out for other riders. Now, I've been following the story, and, um, you know, the initial, uh, story came out, and then, uh, there was some information that came out shortly afterwards that it— and it was refuted that people weren't actually, um, taking videos, uh, via this particular assault. And then it came out again that, well, in fact, that they were taking videos of the assault. And so the entire story in and of itself is just awful. Uh, what's awful about it is that, um, we are, we, we are such a voyeuristic society, you know. That's, that, that's one part of it. The other, the other side of it is that, you know, the fact that the possibility that no one stepped in is, is the worst part of it all, right? Um, even the possibility that, that this, this crime was occurring and that nobody stood up and started yelling and screaming for a conductor, for local security, even if it was consensual for that matter, um, somebody should have stepped in and said something. You know, the Department of Homeland Security says If you see something, say something, right? And I, I agree with that. I am one of those people that when I'm in my vehicle and I'm going down the highway and I see somebody pulled over on the side of the road disabled, or I see debris in the road, I see something that is a potential hazard, I am immediately picking up the phone, calling 911, getting local state police or local police on the phone, and reporting whatever it is that I see. And if I am the 10th person that calling in regards to whatever that might be, I'm fine with that because I know that I might be the only person making that phone call. I always make that phone call because if, if, if let's just say there's something in the road and like a motorcyclist is coming down the road and may not see it, or a car hits it, it goes up in the air and it takes that motorcyclist's head off, like I would feel responsible if I didn't make a phone call, you know? And I think that we have become a society that doesn't take responsibility for much of anything. Too many people don't take responsibility for much of anything. And you and I discussed this earlier, and we really need to be looking out for each other in so many more ways than we currently are.

Yeah, I mean, I look at this and I'm thinking, you know, if that was your mother, if that was your wife, sister, or daughter— sister, yeah, your daughter— would you want somebody to go in there and try to protect them if you weren't able to? You want somebody to step in? Of course you would, you know. So that, you know, any of these, these, that per— that person that's raped could be a member of your family. You know, we just can't assume that, well, I'm not going to get involved, uh, somebody else will take care of it, somebody else will intervene. No, I mean, we, we have to, we have to be much more engaged. And I think sometimes with our— this era of social media and everything else, we sort of like distance ourselves from humanity. I mean, things become a little bit more— I don't know, we're more standoffish, I think. Yeah, very unfortunate. Yeah, as you mentioned, the sign of times.

It's a sign of times, and it is unfortunate. And I think that, you know, anyone who is watching or listening to this podcast, you know, you are— our audience are people who are proactive. You know, we put systems in place, we recognize risk. You know what, our people see the value in proactive security awareness training, right? And if, if, if, if, if we see something, we are compelled to say and do something, you know. Um, like I always tell my audience at the end of a presentation, like after I've, you know, spent, you know, so many hours or whatever explaining to them all the risks that they face and what they need to do in the future and, you know, behaviors that might need to be changed and systems that need to be put in place. And when it's all said and done, like, you know, I always say, listen, don't worry about any of this stuff, but you definitely need to do something about it. And so for me, it's all ultimately about a certain level of awareness, but ultimately it's about taking action. It's about doing something about it. And I know that's what our people do, and I know that that's what you teach as well. And so I, I would just hope that, uh, you know, as, as, as scenarios like this continually— because this isn't the only one, it'll happen again and again and again— 1 in 4 women are sexually assaulted at some point in their life, at least here in the U.S., and studies say that as many as every 56 seconds of girl or a woman is assaulted worldwide. Um, I just think that it's important that people, when they sense something is wrong, that they ultimately will do something about it for the sake of not just that victim but for humanity in general.

Yeah, I mean, uh, it's always easier to second-guess it from behind the scenes, but I think my initial gut reaction to something like that would be to immediately get out of my seat and stop it versus not even thinking about reporting it, just going ahead and intervening in the action immediately because knowing that this person is suffering, right? Is being victimized. I think at the very minimum, people should find a way, even if they don't want to get physically involved, to at least be able to report it at the very minimum. I think we have to take— as you mentioned earlier, we have to take responsibility for each other. We would want somebody to step in to help us if we were in that, that same situation.

Yeah, we are an interdependent species. We require each other, you know, and it does in fact take a village. We, we are not alone out there by design. Like, we require each other. Uh, all right, so lots to discuss today, Peter. Uh, where are you these days? Who, who, where, who are you speaking to? Uh, how's your book doing?

Uh, Right now I'm in Washington, D.C. I've been here for a week. I'll be here for 3 more weeks working on a training program for a government client, U.S. government client, and doing a few virtual presentations from my hotel room as well. Looking forward to getting back to Orlando because we had a new 4th grandchild born recently, and that took place during when I was giving a TED Talk in North Carolina, all of a sudden I get this phone call that my daughter had went into early labor. And I said, oh my gosh. The world does not stop. It does not stop. But you mentioned the book. I want to put in a plug again for my book. If you haven't got it, please do consider it on Amazon. If you read it and you like it, please put up a review because I'm thinking about coming out with my second book next year. But if I don't get a little bit of a nudge, a little bit of a push, by people that give me some feedback on this one. I don't know. So please, I, I would appreciate your feedback regarding the book.

Yeah, check them out on Amazon. And, um, uh, we, uh, finally, um, launched our new e-learning program for CSI Protection. So CSI Protection, Cyber Social Identity and Personal Protection, is a designation and certification for small to medium businesses, for service professionals such as attorneys, real estate professionals, um, even, you know, uh, financial advisors, bankers, anyone who's handling personal or sensitive information. Uh, the CyberSocial, um, identity and personal protection aspect is designed to provide a well-rounded understanding of security, its features, and ultimately its benefits to both you and your clients. So, uh, anyone can check that out at ProtectNowLLC.com. All right. And Peter, you get the last word.

Well, Robert, it's been a pleasure as always. Uh, wish you the best of luck in your, your work, and we'll, we'll get back together again in a couple weeks and share some more stories. And I remember, I think that for me what resonates the most out of everything we talked today is really look out for each other, right? Really, really be stewards of our brothers and sisters who are out there. Everybody's our brothers and sisters. We need to help each other.

Sage advice. Thank you, Peter. Nice to see you.

Likewise.