How to prevent online shopping frauds and recognize spammy links? #12

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to The Security Guy and the CIA Spy Podcast.

I am Robert Siciliano, The Security Guy, and this is Peter Wormka, the Spy, from Orlando.

What kind of spying, give me an example of what kind of spying you have done as a, what, CIA spy?

Well, I mean, there's a lot of different types of bits of information that is considered to be intelligence, and we're trying to collect information on our adversaries, let's say foreign governments. And just one really easy example would be in advance of going into negotiations, you know, if you have the president or the Secretary of State or someone else, a high government official that's going to be meeting with their counterparts overseas, providing some information, gaining some insight into what that opposition's strategy in those negotiations might be, that is a golden nugget. And so that would be considered intelligence. So that's just one of a lot of different types of bits and pieces of information that I would collect on.

Did you ever shoot a tranquilizer dart into somebody's neck?

What movies are you watching? All of them. No, I mean, there are a few people I would have liked to do that to, but I, I have not yet. I, I received other training, but that wasn't part of my training.

All right, well, we have to get a tranquilizer gun so you can shoot in somebody's neck. All right, so Peter, we are coming upon, um, well, the holiday season, and, uh, that brings up Black Friday. So you should see on my screen TechRepublic did a— did some research along with Check Point Research Company. More than 5,300 malicious websites have popped up each week, the highest since the start of 2021. Basically, it talks about how— hold on, uh, let me see here— since the beginning of October, the number of malicious shopping sites has jumped to more than 5,300 ones each week, adding up to an increase of 178 percent compared with the average number of 2021. And since the start of November, the number of corporate networks impacted by these sites has risen to 1 out of every 38 compared with 1 in 352 earlier in the year. So for example, they say that, uh, one campaign seen by this company Check Point sent out phishing emails, uh, hawking cheap Michael Kors bags and other products. With subject lines such as Fashion MK, you know, um, Michael Kors handbags 85% off, shop online today, 85%, up to 80% off Michael Kors handbags on sale, low prices, and shop all Michael Kors handbags and so forth, up to 70%. You know, those great offers could be legit, but we know, you know, if it's good— too good to be true, it definitely absolutely positively is. Um, so you get an email like this, if it doesn't go in your spam folder, which it should, it ends up in your inbox, which neither one of them are good because lots of people check their spam box and they start clicking stuff. If it ends up in your inbox, it makes it seem more legit. And what makes it seem more legit when it ends up in your spam box, Peter?

When it, when it ends in your— well, it appears to be maybe legit if it, if it If it ends up in the spam box, I think it would not look legit. But if it gets through those filters, it could look very legitimate. But I tell you, Robert, I got a— I was— I fell victim to this. And it was not an email because I'm very— just like you, I'm very cautious when I get these types of emails. I'm very automatically suspicious because what I would do is I would go— if I see something that comes in, I would go to the website of whoever is sending it to me to see if I can verify. Whatever it is, the information, the offer. But this happened to me when I wanted to purchase a smoker, for meat smoker, several months ago. I just got on Google and I, and I started to Google search a particular model of smoker, and this one popped up that was like about 80%, 70% cheaper than other places where I can find it. And so I even looked at the reviews that they had posted. It seemed It seemed legitimate, but it was just like, wow, too good to be true, right? I, and I went online, I mean, I purchased it by clicking on the link, and I bought it. I paid for it, put it that way, and I received an email immediately saying it was going to be shipped to me. It never was received. And then when I went back a few weeks later, it was completely gone. Everything was gone. The website was gone. And fortunately Even though I was stupid, I mean, this is— we learn from our mistakes, right? That I was able to file a fraud claim through my, my credit card company and able to get the money back. But just the other day, again, I'm looking for some gifts for upcoming Christmas, and one was a particular grill, right? And I get online and I see once again there is this grill that's a lot, 80% cheaper than wherever else I can find it. I was so I was so ready to push that button that I said, wait a minute, right? And I look up, it was supposed to be Target, it had a Target emblem and everything on it, but then the website said Supre, Supre Target, not even Super Target, supretarget.com. And I said, that's weird. And I went on to Target's website and I found that same grill and it was not, it was not on sale like that. So these things are out there, and if you just do a simple Google search you'll come across them. You gotta be really careful.

Yeah, when they end up in search, that's really scary, you know. So I try to stick with a few known retailers that I've done business with before. And occasionally, you know, I'll start— when I always search out a product to try to get the cheapest deal, the best deal. That said, I will generally only do business with companies that I generally know, like, and trust. Because— and I will only pay by credit card because you can generally get your money back when you pay by credit card opposed to, you know, sending a check. Um, you can easily get scammed sending a check. So this particular, um, Michael Kors fraud, you know, it looks like, uh, all the, you know, full color, it's got the bags. I mean, everything about this site speaks to legitimacy, but the reality of it is, is that, you know, it's easy to recreate or just copy and paste HTML code from any website and just slap it onto any website and you've got, you know, um, the exact same content But the shopping cart and the credit card processing and the money goes to benefit the bad guy in many cases. So it's really important to pay attention to that. Avoid too-good-to-be-true offers, especially if they show up via social media. Even ads, paid ads, can even be fraudulent. And be cognizant that even when you search it in Google, even if it does show up in the second or third— first or second or third page, there could be fraudulent activity there. Go, but But that being said, just pay close attention to the URL and just always pay by credit card. Some more tips that they provide here. Make sure you shop directly from a reliable website. Like I said, don't click on promotional links you receive via email or social media. Run a search for a shopping site before you visit to make sure you're getting the correct URL. Watch out for lookalike domains. You know, so Michael Coors with two S's, Michael Coors with a Z, Michael Kors with two Ks, right? It could be Michael-Kors and so forth. It could be michaelkors.net or org and so forth. So scan for typos and other errors in emails and on websites and be wary of unknown email senders or unusual email addresses that you see in promotions. Trust your instincts. That's really the most important thing, I think. A promotional, shop promotional that sounds too good to be true likely is a scam, like mom said. That means, uh, a new iPad will not go on sale for 80% off retail price, right? Of course. And then look for the lock icon, and the S in HTTPS means Secure Socket Layer encryption, uh, and if it doesn't have that, avoid it. And then finally, be password— be wary of password reset emails, especially during the holiday. If you get such an email, always go to the website directly instead of clicking on the link. 'If you need or want to change your password, make sure you do it at the actual site.' So I get password reset emails.

Oh, I do too, all the time.

And so what that is, is it's somebody who has my email address, which is publicly available basically, and they may know that I might have an account at a particular site. And because Maybe they, you know, found my credentials on a data breach for an old data breach, and they want my passcode to log into that site. And it could be email, it could be LinkedIn. And what they do is, is they'll actually email me what looks like a password reset that's coming from, say, LinkedIn, but it's actually coming from the bad guy. And if I click a link or respond with, with a new passcode of that particular site, I'm giving the bad guy an opportunity to log in. So it's really important to pay attention to that stuff. And often, if you get a password reset, simply just delete it, because if you didn't initiate it, then it's just somebody messing with you.

Yeah. Hey Robert, are you— question— do you use, um, WhatsApp?

I do use WhatsApp. Yep.

I mean, I don't— I just don't know if this has to do with the holiday season, but I am just getting the last few days a lot of WhatsApp messages. Coming in from people that just kind of like random, like, you know, you know, wanting me to engage with them because maybe I need to correct them, they got a wrong number or whatever. And usually it's a picture of a relatively attractive girl, you know, if you click on the, the telephone number. But there's been a whole bunch of them lately. I get them from everywhere. I'm just wondering if you've encountered that as well.

So I, I don't spend a lot of time on WhatsApp, um, but what that is, is it means that, uh, bots have gotten involved. They've infected a server somewhere, and, uh, likely that those bots are posing as, you know, females in order to get you to engage, uh, in some form of a romance scam. So once bots figure out that you're usually— what, it's your phone number that's tied to your WhatsApp, I believe? And once they, uh, detect your phone number, then, you know, really it doesn't take much for bad guys to get access to millions of hacked phone numbers or millions of phone numbers downloaded from other— some database. That were hacked, and they'll just create a bot that will send out these requests posing as WhatsApp. And, um, eventually, you know, you log in and you connect a friend, that person, um, you're going down their rabbit hole. So it's really important just to either block and/or ignore when you get stuff like that.

Thank you.

Yeah, so, uh, here, uh, Tripwire talks about the state of security, what makes us click cyber scams in the brain. With Martina Dove. So in this episode, this is a podcast they have, Tripwire, a bunch of smart people, um, talk about— talk with researcher Martina Dove, who uses her psychology research to explain to us how the brain operates when presented with a cyber scam. Now there is way too much information here for you and I to simply, um, cover it all because it's deep and, and, and wide And awesome. But one thing I wanted to highlight here, Peter, was, um, the interviewer asked, uh, do you see a difference in how people respond to fraud depending on their own self-evaluation of fraud susceptibility? For example, they ask, people who work as information security practitioners like you and I would tend to think that they are less likely to get fooled by a phishing email. So I'm in that category. Do they have a different response than someone who who doesn't have that experience and would feel like they're more likely to be victimized? And her answer was— what's that, Peter?

Yeah, it's a good question. I really— I mean, I know in my particular case, my particular case, I don't think so because I'm naturally very suspicious. I mean, I'm into this every single day. But, uh, I know there are people who are heads of security and who are generally, you know, feel that they are not going to be think that they're not susceptible to this. So there could be some, some truth to it, I think. I don't think everybody necessarily who's, who's like head of security is going to be complacent, but I think there is a certain level of complacency by people who think they, they already know better and they wouldn't fall for it.

Complacency is one aspect of it. And they go on to say that, um, there is a known factor that can protect you or enhance vulnerability, and that's Background knowledge. So basically, you would presume that somebody within cybersecurity would have good background knowledge about how phishing emails are delivered and how they persuade and some of the signs to watch for. Uh, they say that's definitely protective, but there's a flip side of this background knowledge. The more knowledge a person has, there is the risk of slipping into complacency. Like you said, uh, that this may result in less careful scrutiny, which can also create an unintended vulnerability. So yeah, all around, like you mentioned. Now, I, um, am very aware of everything that comes into my inbox, every text message that I get, and I scrutinize everything that requires me at some level to engage it.

Right. That's good, huh?

So when there is a requirement for me to act upon it, that's when I really dig in and I kind of go into the background and I look at all the ins and outs and what the consequence would be for me to actually engage and ultimately get scammed. And so I look at all of those factors and then I look into the actual communication itself, of course, and dig a little bit deeper and right-click and open stuff in different windows and search URLs and look up the name of the company and, you know, look for a number of, you know, issues to the point where I either exhaust it or I've quickly determined that, you know, this is no issue. So Peter, what is your response when you receive an email that looks legit but you're not quite sure?

Well, it always depends if it requires me or asks me to undertake an action, I will always go back and try to verify that. I'm not going to take an action by clicking on any link in that email, never ever, because that is the way that you can be phished. And it's so easy these days. These things are getting more and more complex, more and more, you know, professional, that these— it's no longer these basic phishing emails that are just so obvious. Now it's become becoming very professional. So I think we just have to have that sort of, uh, um, you know, that, that sixth awareness, you know, where we're going to be looking to always verify that link no matter where it's coming from. Even if it's coming from, uh, someone that we might, you know, organization that we really trust or an individual that really trusts, that can easily be— their email can easily be hijacked and they can send us a link.

Yeah, my general rule revolving around responding to email in general is I will not click a link in the body of an email unless it's a, it's an action in which I have done previously with this reg— with this specific communication. I, I'm expecting it, um, I know that it's coming. That said, I don't generally click links in emails that— to go access a statement, you know, for a bank statement, a credit card statement, because it's just too easy. It's just too easy to, to get scammed in that regard. It's just— and it's much easier for me to log into my password manager to get where I need you need to go. Um, so clicking links in the body of the email, downloading attachments, uh, all of those activities are what can ultimately get you in trouble. So if you're cautious and cognizant of the vulnerabilities that you face regarding the actions that you take— and we've talked about, you know, what those actions might be and how to protect yourself a thousand times— generally most people should be in pretty good shape. If you just are just cautious in general and have an awareness of what to look for. And that's just, you know, listening to podcasts like this and doing your own reading and research. Generally, most people should be in pretty good shape.

That includes do not click on that unsubscribe link where you might think, well, I'm gonna get rid of this, I'm gonna get rid of this email, I don't want any more emails from this person or company. But that can also carry a malicious—

That is correct.

Yep.

Agreed. So Peter, um, uh, we're gonna close up with, uh, Schneier on security. So Bruce Schneier is a, a cryptographer, he's a really smart guy, full speaking calendar like rock star security guru, and he talks about why I hate password rules. So he said that the other day I was creating a new account on the web, which many of us do. It was financial in nature, which means it gets one of my most secure passwords., and he uses a tool called Password Safe to generate a 16-character alphanumeric passcode. In this case, you know, the passcode that it generated looks something like colon S, whatever that up arrow is, uppercase T, lowercase WD, dot uppercase J, and then whatever that is, 3HZG equals Q dash. That's a pretty secure password. Which was rejected by the site because it didn't meet its password security rules. And in this case, the rules were that you had to have two— or you had to have two numbers, uh, in that particular password, and he only had one number in that particular password, the number 3. So that said, like, the rules for this particular site he didn't know ahead of time his password generator created a passcode that didn't reflect the rules of that particular site. And now maybe if he had generated another passcode, it would have had two different numbers, but it just didn't for that reason, for whatever reason. Now what, what it goes on to say is that what he doesn't like about the password rules is that many sites have their own set of rules, their own criteria. Like you have to have uppercase and lowercase, you also have to have a character. Some of them say you can't use a character and so forth. This particular one says they want at least 2 numbers and so on. So if all the password management companies, companies that create password managers and password generators, would work with, you know, the National Institute of Standards and work with web developers and sites themselves to, to determine what that criteria in regards to password rules ultimately should be, then that would eliminate the inconvenience of having to create a password and then from there that password being rejected and you as the consumer user having to figure out why it was rejected. Like, that's just a lot of running in circles for really no reason. If there was a base sense of standards as to what passwords should require and contain. Peter?

No, I completely agree. And I think whether it's for these particular sites or even within companies where the passwords become so complex that people will just end up writing them down, you know, writing them down and having it next to their terminal. I mean, I think we got to find something that's reasonable. We need to have strong passwords, but we can't make these passwords so complex that people will just circumvent, you know, keeping them safe. And maybe more, more types of dual authentication, I think, is what we're going to have to really go toward. Yeah, ensuring that we have, uh, safe, you know, secure means of connecting.

See, I, I'm not so concerned about the complexity of a password. As a matter of fact, I think that a password could be as complex as it needs to be, or as you want it to be, as long as it's accepted by the site itself, meaning that you should be able to create whatever password you want based on standards that are provided. You work within those guidelines, as complex as necessary, and, and that, that should include uppercase, lowercase, numbers, and characters. And that essentially becomes a highly complex passcode if that's what you're requirement is— numbers, letters, uppercase, lowercase, right, um, characters, right— all of that in combination, at least say 8 to 10 or 12 or 14 or 16 or 18, you know. But then if the password manager, the password generator, would create in effect that passcode, it doesn't really matter what the password even is because it's not like you even need to remember it. The password manager enters it for you in the future. It's not even something that you have to commit to memory. So the complexity of it really is a non-issue. It boils down to, you know, the standardization of what those passwords should be, and then everybody who accepts passwords or generates passwords come to that agreement and provide that infrastructure. You know what I mean?

Yes, absolutely.

Yeah, so, uh, I use a password manager and it works great for me. Uh, that said, I'll often generate passcodes and plug them into different websites and they're rejected because I'm missing something. Or I have too much of something, and that's a pain in the butt. Yeah. So Peter, uh, what are you up to these days?

Well, getting ready for the, uh, I mean, how— trying to wind down some business before the holidays start because then everything kind of closes, slows down. I got so many things yet that I gotta finish, and I just wanted to bring, um, to the audience attention, come visit my site counterintelligence-institute.com. Starting on Black Friday and through the end of the year, I'm going to have some promotions regarding the book, autographed copies of the book, as well as being able to procure the book for organizations, procuring the book to include at least 1 hour of one-on-one with a former spy myself.

I love it.

That's great.

And Peter, these days I am providing lots of e-learning, both live online and also pre-recorded, for our CSI Protection Certification designation. CSI, of course, stands for Cyber Social Identity and Personal Protection. And also, if you wanted to subscribe to the protectnowllc.com newsletter, in which we often feature Peter and I, and links to our podcast You can do that at protectnowllc.com and scroll to the bottom. You will also get a copy of our free ebook, which includes, um, the, the content of my bestseller, Identity Theft Privacy, Security Protection and Fraud Prevention. So that being said, or contents of that book, that being said, um, y'all be safe out there. Peter, final words?

Take care, and wishing everybody a Happy holiday, upcoming holiday season, and don't stress out. Take care of each other and don't let the bad guys win, right?

Yes, and just be good to each other. Thank you, Peter. Nice to see you.

Thank you, Robert Siciliano.

Take care.