Ransomware knocks a small town back to paper records… #22

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to the Security Guy and the CIA Spy Podcast. I am Robert Siciliano, and this is Peter Wormka.

Hi Robert, how are you doing?

Doing pretty good, Peter. Yeah, uh, school's getting out, kids are gonna be, uh, home, which is great. Uh, at this point it looks like I'll have about 10 weeks of them, which is awesome. Uh, that means, um, 10 weeks of, uh, boating and, uh, ice cream and alcoholic beverages for adults.

Well, yeah, hopefully you're not going to get to the halfway mark and they're gonna say, Dad, we really miss school. This is, this I don't want to be home any longer.

That I know is not going to happen. Uh, I know that because they're both like just done already. Like they have had enough. Um, usually this time of the year, uh, you know, just like they just want to be done. There's exams and all the follow-up stuff that goes along with that. So my, uh, 13-year-old, I was looking at high school, so we have to start doing that. Um, you know, dance, because it's, you know, private school for her, they call it secondary school. And my, um, a, a sophomore who's not going to be a junior is now looking at colleges. So it's like, you know, it's a very pivotal time and they could use, uh, they could use the time off. It's been a, it's been a crazy year.

Oh yeah, and with some of these school shootings too, it's just like you feel, you feel a little bit more secure having your kids at home versus going, going to school. Unfortunately, it's crazy.

But what you just said is so true and it is so flipping awful. You know, right? I mean, it's like you feel safer having them home than at school, and that's the truth, and it's awful. You know, like, I didn't even know if we're gonna get into that today, but it is just so upsetting. And I think that anybody who's paying any attention at all right now is just numb, you know, because you can't— you can't— you can't see what's happening right now and not be so overwhelmed by it, or, or just be numbed as a result of it. Like, it's just so overwhelming to even read all the stories of all the victims and, you know, who they were and what they were all about, and their families and, and their siblings and their parents and how they came to this country. And some of them, and it's just like, wow, you know. And it's like one moron snuffed them all out, and the whole response by law enforcement was just like like the whole thing, like good guy with a gun. It's like, well, they didn't use them in enough time.

Right. Like anything else, we talk a lot about training, right? Training, education. And I know a lot of law enforcement agencies are investing money, have invested money in this type of training for active shooters. But apparently there's a lot more that needs to be done in the realm of training.

Yeah, there's a lot more, a lot more that needs to be done. And, you know, there are so many various solutions on the table that will never ever solve the problem but will minimize the risk. And that's how everybody that's involved in solving the problem, which should be everybody, everybody, all those 2A champions, everybody should be looking at how do we minimize risk, how do we reduce death, really, because you're never going to fully stop it because we're never ever going to get rid of guns in the U.S. There's, there's more guns than there are people at this point, and, um, so we're never going to get rid of guns, but we can reduce risk by setting up some guidelines to minimize who gets access, how and why. And, you know, I mean, there's ways to do it, but the 2A champions who— I mean, I obviously, everybody, you know, at some level should appreciate the Second Amendment at some level, but you can't look at it as the Founding Fathers said, this is the way it's going to be in perpetuity. When the most common gun when they did this was a muzzleloader that took a minute to load and really wasn't that accurate. You know, they didn't have rapid-fire semi-automatic firearms back then. And I think that if the Founding Fathers saw what was going on right now, they'd be like, we need to kind of fix this.

Yeah, we do. Today we're going to talk about those digital threats though, because those are are just as, uh, I mean, not as lethal, but they're, they're around us and they're impacting people every day.

Yeah, like I said, Peter, don't get me started.

I found that out. All good.

It's not easy, not easy being me. All right, so ransomware attacks and to 19— I've been saying, this is The Register, I've been saying for the longest time, you know, It is just a matter of time until we have either a power outage or some type of an internet outage that is going to put us back to essentially what might be considered the Dark Ages. I mean, at some level, right here, Somerset County, New Jersey was hit by a ransomware attack that hobbled its ability to conduct business and also cut off access to essential data. They sent out a statement, services that depend on access to county databases are temporarily unavailable. Such as land records, vital statistics, and probate records. Title searches are possible only on paper records dated before 1997, the county said in a statement. Well, I mean, what do you expect when we've digitized everything?

Yeah, and this is very low-hanging fruit. So, you know, these things, these attacks, especially the ransomware attacks against municipalities and counties are so rampant and they're happening on an increasingly basis, even if we don't hear about them. But they're so rampant because the municipalities and county and even the state governments don't tend to have a very robust cybersecurity program. And they're much more vulnerable just because they haven't invested enough in this. And so they're very easy targets, so soft.

Yeah, I speak to municipalities all the time, uh, and, uh, you know, provide them, you know, full-day training. And they're the nicest people. I mean, they're just, you know, locals, and, you know, they're commuting 5-10 minutes to work, and their jobs are relatively, you know, uh, low stress— relatively low stress, you know, because it's like local, you know. Um, they often have too much on their plate. They often take on more responsibility than They probably should, and they are often provided tasks revolving around, you know, accessing sensitive information that they may not be properly trained in regards to what to do when the phone rings, an email comes in, you know, you get a text message or whatever with revolving around some type of a social engineering attack.

The impact for these is not quite as critical if we're talking about, you know, that, you know, the records being a delay and being able to get records. But if this includes or can include, of course, hitting various utilities, like even the water supply, right? A lot of these water companies, I mean, these treatment facilities are run by the cities or run by the the county. And this is where the consequences for these type of attacks can be— I mean, it can lead to a lot of serious health repercussions as well as loss of life in some cases.

Yeah, that is definitely correct. So let me mess around with something here really quick. So I just want to make sure that everybody can see what they're supposed to see. My apologies for this mess that I just created. Okay, so the attack happened, took down email services for county government departments, as well as leaving the county clerk's office unable to provide the most services which are relying on internet access, which is like almost everything. Um, Somerset County residents were asked to contact government offices via Gmail addresses set up for various departments or via phone. Yeah, so, you know, in order to stop a crime like this, obviously an organization needs to have robust security in place. And what that generally means is Ahead of time, proactively, you bring in, you know, I mean, your IT people locally, you know, do their job and they're skilled to a certain degree. Those IT people could be CIOs, CISOs, you know, Chief Information Security Officers, CTOs, Chief Technology Officers, and so on. And generally, it's those professionals that would hire, say, a managed security service provider, an MSSP. So the MSSP comes in and they actually manage the security of the network. So they do vulnerability scanning, they do penetration testing, they run scans looking for vulnerabilities that might affect, you know, that net— that network should they become a victim of ransomware. And if an MSSP is too expensive for that municipality, then they would bring a company in like mine that provides virtual Chief Information Security Officer services, basically the same type of services that a managed security service provider would provide, vulnerability scanning and patching and so forth, but on a smaller scale. Generally, it's a smaller team of like 3 to 5 people that, you know, have been in the business for 10, 20, 30 years at a minimum. And, you know, they are a fraction of the cost, and it's also called fractional CIO. Are fractional CISO. They're, they're a fraction of the cost of a, you know, $30,000 to $40,000 managed security service provider. And if you engage in those services ahead of time proactively, you significantly reduce the risk of something like this happening. Yeah. All right, so Peter, check this out. It's CNET. Credit card fraud, which everybody is concerned about, and I tell people right off the bat, don't worry about credit card fraud. You really can't protect yourself from it, but you can do something about it. And so credit card fraud here at CNET says credit card fraud is the problem that won't go away, it just changes. And they go on to say that despite advances in technology, credit card fraud continues to be a problem. Credit card fraud costs Americans and companies billions of dollars each year while consumers are never on the hook for fraudulent charges. That is, of course, unless you aren't paying attention to your statements and you refute unauthorized charges. That statement isn't necessarily true. You are on the hook for fraudulent charges if you don't refute them, which I've seen studies that show that 9 out of 10 people don't actually pay attention to their statements.

Oh, I agree with you 100%. And I think I really have a problem with this thing of the credit card company saying, well, you know, you're not going to be on the hook, as you mentioned, because at the end of the day, we are all on the hook. The amount of money that these credit card companies are paying because of these things They got it, they recovered from somewhere else, right? And so you look at, at sometimes the, the interest charges that they are, they are charging individuals and the different ways of trying to get people to get, take out more and more credit. And then of course, yeah, if you pay it off at the end of the month, great, you don't have to pay the interest. But a lot of people don't pay it off and they end up paying an extraordinary amount of money to maintain these, these credit cards. And it sort of, it creates also a sense of complacency. We've We've talked about this, Robert Siciliano, a number of times where people think, well, it never is going to happen to me, but if it does, I'm not going to be held— I'm not going to have to worry about paying for this because the credit card company is going to pay for it. Just like companies that take out insurance for cybersecurity, right? That, well, it's not going to happen to me, but if it happens, I got this insurance. So people just tend to be so, as you mentioned, reactive instead of proactive in regard to how they handle their own, um, security and finances regarding their, their, uh, I mean, the security regarding their finances.

Sorry, no question. Uh, and the thing with credit card fraud too is while the credit card companies have anomaly detection software that detects anomalies in your spending habits, which would in response alert you to potentially fraudulent charges or stop charges as a result. Those are not— that anomaly detection software is not foolproof. It's not 100%. In other words, you may or may not be notified of a particular charge that you were or were not responsible for. So for example, you know, uh, I was recently notified of a charge that was out of Australia where they had got my card number and they were billing it to Amazon Web Services out of Australia, which is a significant anomaly because I'm not in Australia, and that's obvious. And so the anomaly detection software picked that up. Now, um, there were some charges at a, um, a HomeGoods, which is a retail store in the, in the US, not too far from me, and I was not notified of that. But I get what's called push notifications on my credit cards, which means that I get a text message and/or an email with every single charge.

That's great.

Yeah, and everybody should do that. And so when I got those text messages from HomeGoods, I looked at the charge, I'm like, this is interesting. I mean, I know my wife shops at HomeGoods, but I didn't think that she was at HomeGoods because she was at an event at the kids' school. So I called her and I'm like, hey, any chance you went to HomeGoods recently? She's like, no, why? I go, because we just got 2 charges at HomeGoods. She's like, really? I'm like, yeah, uh, like for $18 and $19. Was that you? She's like, no, I haven't been to HomeGoods in months. I'm like, all right. So I contacted American Express. I'm like, there's these 2 charges on here from HomeGoods that we didn't do. And they're like, all right. And so they took it off the card, but they didn't tell me that those charges had occurred fraudulently. I had to, you know, call them and say, hey, this wasn't me.

Yeah, and if you don't have that push notification and you don't, uh, review your statements, I mean, I, I'm sure that almost everybody— not everybody, but a large portion of the population do from time to time have these fraudulent charges. And maybe they're a small amount, you know, you might say, well, I don't quite remember, maybe this, you know, and you think, well, is it really worth bringing up? But when you, when you're being charged $19.95, $19.95. I mean, think about the amount of money that these scammers are bringing in from these, you know, frequent transactions that they're charging, you know, so many people. It's amazing.

And it is also to the credit card company's best interest that if there is in fact a charge that you were not responsible for that them not telling you, at some level, like, they profit from that. They benefit from that fraudulent charge because there are fees being paid, right? Fees being paid by you, fees be— fees being paid by the merchant, you know, the retailer. So if they have to then eat that charge, or in some cases pass it on to the retailer as a chargeback, um, it's, it's, it's, it's not cost effective for them.

Oh yeah, absolutely, absolutely.

So, you know, it really is ultimately up to us, you and I consumers, to pay close attention to our credit card statements. So if, if, if you've never set up push notifications, it's easy to do. So I have all my cards, and I only have 3 of them, and that's all really you need, uh, you know, like a Visa, American Express, and one for business, right? Or at least for me. And all you do is you call up your card company and they'll tell you exactly where to go on their website in order to, to access the menu and what boxes you need to check in order to get those push notifications. If you don't want to call them, you can just simply log in to the dashboard and just tool around there, and sure enough, you'll find it under either alerts or notifications or security or whatever it might be. But it's, it's always there with all card companies, banks, and so forth. So set up push notifications for both text message and email. I generally have it set, you know, for any dollar amount, but sometimes they won't let you do anything less than a dollar. And then I always do card present, which means I swipe the card. Card not present, which means I charge it over the phone or online. International charges, of course. So any and all charge, I check every single box. I want to know everything. As soon as there's a charge to my card, I want to know right there and now.

You know, there's an added— there's an added component to this. Some people, maybe— I'm sure some people are in a situation where they give their credit card to a child, right? You know, maybe a teenager, and say, well, you know, use this, especially if there's an urgent need or emergency. And you might say, well, let me know when you've used it. But so often it happens you don't find out that they use it until you see the end of the month credit card statement. But if you have these push notifications, you know exactly what other members of your family are, are charging at, right, you know, real time.

In real time, yes.

From a financial, you know, uh, management standpoint, it's a great tool.

Yeah, so my wife and I share cards, and, um, you know, every so often, like, I send her off a text. I'm like, hey, was that you at Sally Beauty? And she's like, uh, yeah, leave me alone, I'm busy, but that was me. Yeah. And so, you know, all right, you can charge whatever you want, you know, I have no problem with that. I just want to know it was you because it was $200, you know.

It's like, yeah.

Keeping tabs in that regard is pretty good. And you know what's interesting is one year I remember I was traveling on business and I was at a, um, I think I was at like a, um, I forget what hotel it was, like a Marriott. And, um, and, and, and I, I, and I gave the, the, the clerk my card as I was checking in. And then moments later, it says, I'm in a Marriott. And moments later, I get a notification on my phone a text message that there was a $250 charge at a Holiday Inn, right? And I'm looking around going, I see Marriott, I'm at a Marriott, right? And I'm like, you know, okay, so why is there a $250 charge that just occurred on my credit card for a Holiday Inn? So I'm thinking to myself, you know, like, who would use my card? And I'm like, who would go to a hotel? Like, Is my wife at a Holiday Inn? You know, like, what is my wife doing at a Holiday Inn? And I'm thinking to myself, is my wife cheating on me? Like, all this happened like in a matter of like 30 seconds, right? And which, which, like, we're happy, you know? Like, I, I wouldn't— I would never expect that, you know? Because— but I'm, I'm like 5 hours away, you know? And I'm like, is my wife at a Holiday Inn? And then I say to the clerk, I'm like, has this ever— is this establishment a Holiday Inn or a Marriott? He goes, oh, we used to be a Holiday Inn, like we just changed names. I'm like, oh, there you go. So their merchant name never changed or hadn't changed yet. Yeah, I was like, dude, you almost got me divorced. That happened. Yeah, yeah. All right, so moving on, uh, feds— fake Army general scammed multiple women out of a million dollars.

Oh, man, these stories are just like too, too incredible to be true. But they're true. So sad. Yeah.

So this happened at Providence, Rhode Island. A Texas man has been arrested for what authorities say was his role in an online romance scam. We've talked about this before. But it always deserves repeating because there are just so many romance scams out there, in which women were cheated out of nearly $1 million by someone pretending to be an Army general a federal prosecutor said in Rhode Island. So the guy's name was Fola Alibi, also known as Folié. Emmy Alibi, 51, arrested at his Richmond, Texas home, charged with wire fraud, fraud, and money laundering, according to the statement from the U.S. Attorney's Office, says the AP. So the women were asked to send money to the fake general to help ship his belongings back to the U.S., according to court documents. They were asked to send the money to companies in Texas controlled by Alibi. Or someone associated with him at his home address. Many of the women were in their 70s and 80s, either widowed or divorced, which is usually the case. They're lonely, you know.

There's so many problems with this. First of all, the U.S. government would pay for the shipment of this individual, if he existed, this individual's household effects back to the United States, you know, back to his home. Right. There's ways to verify too, someone who's a general, I mean, I'm sure there's a way to verify whether or not there's a general by this name. Through open source checks. I mean, they were just probably going by whatever this person, the way he looked and or what he said on a whatever social media channel. They didn't go into much detail here, but there'd be so many other ways somebody of this profile, this level, to verify whether that this person really existed. Yeah.

Peter, keep in mind, I mean, you're savvy, right? Technically savvy. Like, you are a government former government, you know, employee. Like, you, you are— you, you get it all, right? Keeping in mind the victims here, '70s and '80s women. Like, this is the definition of the grandmother test, right? So look at, like, my mom in her '70s, my stepmom in her '70s— perfect marks, perfect targets, perfect, you know, none the wiser.

Yeah, but the big, the big Red flag is when they start asking for money. I mean, that, that is the red flag for me to start. That's the start.

That's what it should be. So in the Boston area, a good friend of mine, a financial advisor, smart kid, smart, smart kid, lost his dad. You know, his dad died young in his late 60s, and, um, you know, young enough, right? And so his mom, you know, they were happily married forever, you know, 40-something years. His mom, lonely right, after so many months of her husband being gone, goes to Facebook, you know, because she just wants to connect with people, you know, connect with like people from high school, friends, family. So for the first time in her life, in her late 60s, she goes to Facebook. So on Facebook, you know, she's chatting with people and this and that, and, or, and, and eventually, you know, she goes on to Match.com and other various uh, websites, like after about a year, right? My friend goes to her— his mom's house, like on a Sunday, you know, brings the grandkids over, and, uh, sees his mom's laptop on the kitchen table. And he sees she's on Facebook, she's on Match.com. He sees these tabs open. He's like, Mom, what are you doing? She's like, what do you mean, what am I doing? He's like, what are you doing on Facebook and Match.com? And she kind of took a little bit of offense. She's like, I'm a grown woman, I could do whatever I want. And he's like, Mom, Mom, I, I, I know that. I'm just, you know, I'm just concerned because do you know what you're doing in regards to scams? That was his thing, you know. Like, he understands that his mom has to move on at some level, you know. And she's, well, I, I, I, I do understand the scams to a certain degree. I'm just lonely and I'm just looking for some companionship. And he's like, okay, okay, okay. And that was the end of it. Like, he didn't even want to like go there anymore. He called me about 2 and a half months later. He's like, dude, I got a problem. My mom, apparently she met a colonel in the U.S. Army stationed in Afghanistan who found a trunk of money in one of the houses that he was raiding, and he needed my mom's help to get it back to the U.S. Oh boy. Yeah, Peter. His mom fell for this guy, wired money. How much do you think she wired?

Uh, $20K?

More.

$50K?

More.

$100K? More. I don't— I'm not gonna even go there. This is sad.

$235,000. Imagine, I guess he had to pay tax on the money, right?

Or something like that, something crazy.

I, I really didn't get into the nitty-gritty of like what the ruse was, you know. It just happened so fast. And $235,000 over the course of 2 and a half months.

Well, it's kind of interesting, you know, this is sort of a variation of the Nigerian scam, but you're— when you're talking about impersonate— well, it's not really directly impersonating because these people don't exist, but using sort of the facade of being an official in the U.S. military, you know, ability, credibility, authoritative figure, you know, someone that you would be able to respect, admire. Women would probably look up to someone that, you know, is dressed in a uniform.

I mean, check all the boxes.

Yes, fits very well.

Yeah, it's awful. So, uh, yeah, pay attention to your moms and your grandmoms and your aunts and your neighbors and let them know, like, be on them. If you at some level have a connection to someone that is lonely, please like monitor their finances at some level. Like those in their— in '70s, you would think like that person is young enough and smart enough and so forth, but it's not about being naive or dumb. It's not about that. It's about being vulnerable. It's about being lonely. It's about being human. Every and anyone is susceptible to this. Including men. I've seen it over and over and over again. People in their 40s, 50s, 60s, 70s, 80s, and of course 90s. Okay, it happens to any age group really. So just pay attention to all those around you, watch yourself. And for those of you who have, you know, elderly people in your life that have access to significant amounts of money it might be time to step in and be a co-signer if they're ever to write any big checks and move money out of accounts.

That's a very good suggestion, it really is.

That's a real thing, so, you know, pay attention. All right, so Peter, uh, in Boston, CBS, man targets young women by tampering with their cars. Oh boy, bastard. So Women are being warned of a man who police say is tampering with women's cars and then offering to drive them home. I mean, it's just so obvious, but still. So the police described the man, in this case an Asian man in his late 30s driving a blue Chevy with Massachusetts plates, and he's been targeting young women by flattening their tires and filling their tanks with water and then offering them to, to drive home.

So obviously he's stalking them at some other, some location, could be a bar, could be anywhere, and he associates that girl getting out of, you know, the woman getting out of the car, going in somewhere, and takes advantage of that time to do something to the vehicle and then follows them, uh, you know, out. And then to me, one of the biggest things here, I mean, that can happen, right? But I, I think it gives a good reason to take advantage of. Almost everybody today has emergency roadside service protection, whether it's through their insurance company or the actual vehicle that they bought. Maybe the, the company that provided provides this. So that's what they really should rely upon as the first way to, to deal with an issue if you have an emergency with a vehicle, I think.

So I agree, but I suggest that be the second thing they do, because I think the first thing they do is they should be able to change their own tire at some level.

No. Yeah, but you still have that— if they get out of the car and they're trying to change their tire, they could be in some remote area and this guy then comes out and approaches them, right? I mean, I agree with you, but I mean, there's— sometimes it might be better to stay in a vehicle and just not— and, and use the vehicle as protection against that person. That is true, right?

Yeah. And have that tire iron ready to smash them in the face with it.

I mean, they can also do a cursory check of the vehicle, do a walk around, you know, before they get into the car and take off. If it's, if it's the— if it's a tire issue, right?

The police said in this particular scenario that if you do have a flat tire, don't start your car, because if you try to start your car, you're going to be running water, you know, through the gas lines which could essentially ruin the engine, um, or at least it's going to cost a significant amount of money to fix that. So that is a significant level of vandalism, uh, in order to, um, you know, stalk a woman in order to get full control over her. I mean, they— I know that they did catch this guy, um, obviously, you know, he's a nut job. And, uh, the problem is, is that, you know, there's lots of nut jobs out there, so Talk to your daughters, talk to your wives, talk to those in your life. Make them aware of this scam that could lead to misery for the victim, uh, should, uh, you know, she be, uh, you know, uh, kidnapped, captured, uh, by this bozo. Um, you know, there's, there's no shortage of predators out there. You know, there, uh, there, there are as many as 859,000 registered sex offenders in the U.S. 859,000 registered sex offenders on average, more or less. That is just those who are registered. Yeah, okay, yeah, they got caught. And there are plenty more, and those are levels 1, 2, and 3— levels 2 and 3 being worse. And there are plenty more that simply haven't been caught yet, right, that are out there. Who knows what that number is? So look, there always has been, there is, and there always will be this criminal element out there in You know, your job, my job is to educate all those on that fact. And then, you know, those who, who hear us out is to become a tougher target, right? It's to do things to make sure that, you know, in the event that you do end up meeting up with the bad guy, uh, clicking the link in the body of an email, receiving a phone call, whatever the case might be, that you know what your options are. Yeah. Simple as that. So Peter, what do you got to plug?

Well, I'm doing a lot of, uh, traveling and even through some virtual events yet as well, but I'm doing a lot of, uh, training and presentations. And I just want to throw out there, if one of the listeners, uh, has an organization or an employer that they think might benefit, uh, be happy to quote a, a virtual presentation, which is actually very, very inexpensive a means of being able to get me to speak, uh, for an hour, hour and a half on topics of, of human hacking, which is relevant, uh, to all organizations today.

And Peter, um, your web address again?

Yes, uh, counterintelligence-institute.com.

Well, you, Robert, I am at protectnowllc.com. And, uh, you could see me and my peeps and me and Peter, uh, you know, biweekly in this particular podcast. Uh, business, uh, is good, Peter?

Yeah, business is really good. I want to encourage people that are listening to us though, if they have any comments or suggestions or topics that might be of interest to them, uh, please forward them, right? And someday we're looking forward to even maybe inviting guests on the show. As well as people that might be calling in. So we're looking for more engagement from, from the audience and feedback.

Definitely. Peter, nice speaking with you. Be cool.

Likewise, stay safe.

Talk to you.