Robert Siciliano @ PROTECTNOW/Safr.Me SPECIAL EVENT Coaching Call

Hello and welcome to the Safer.me coaching call webinar. I am Robert Siciliano. It is Wednesday, December 16th, and this is a a service that I provide my clients where I educate and inform them biweekly on all issues revolving around information and personal security. This week, we're trying something new. We're doing a YouTube Live, which I have screwed up a couple of times already today. So hopefully this is broadcasting properly. And thanks to some friends of mine who witnessed me dropping some F-bombs, they let me know about that. So thanks for that. So this presentation is all about you and your information and personal security. And what you're looking at right here are the replay notes. And we're doing this live presentation just to show people, to showcase what it is these coaching calls are all about so that you can consider maybe getting involved sometime in 2021. So the replay notes are all about what we're gonna talk about today and all links to all the various articles that I'm about to report on. That being said, the replay notes are an email that you get that you can add and remove your own logos. You can curate the information, provide your own commentary, provide it to friends, family, and clients to add additional value, providing information to those in your life who you care most about. Now, all that being said, what we're going to talk about today, uh, the, the notes revolving around breaking news. So the A-team of Kremlin hackers is back, uh, and that's bad news for the rest of us. So we all know about Russian hackers. Well, they have have been kind of flying a little, a little bit below the radar over the past few years, but they've hacked the Treasury Department in recent weeks, and we're going to expose and discuss that. That is an article via The Daily Beast. Also, current events or current security events. Cybercrime is costing the world more than $1 trillion a year, which is a 50% increase from 2008, says McAfee. HelpNet Security is going to report on that. And then FireEye was hacked over the past few weeks. FireEye is one of the largest and best penetration testing companies out there. There's a security company, an industry leader, and they got hacked. Uh, Bruce Schneier is going to report on that, and we're going to report on Bruce. Also, we're going to do a deep dive. The IRS is expanding its identity theft protection option to more taxpayers. Uh, in the past, you used to have to form— fill out form number 14039, and there was a PIN involved. Uh, that PIN kind of went away, then it came back. There was a problem with it. Now the IRS is making it as easy as possible for people to protect their identities when it comes to bad guys, uh, preventing bad guys from filing taxes under your name. That's a big deal. We're going to talk about that. And then tech update, uh, what happens to your personal data after deleting an app? Most people think that it just disappears, but it generally does not, uh, and that is coming from Gizmodo. And, um, who else? Um, that will be from tech perspective, actually. And then the biz dev. Biz dev is a section of the coaching call webinars that, uh, so if you are, say, a financial advisor, you are an accountant, a lawyer, some type of a service professional and you want to bring attention to a certain issue to, you know, continue to evolve the relationship you have with your clients. Biz Dev is a way for you to say, hey, to your clients, this is what's going on. I think it's something you should know about. It's there to help you out. It's basically a life hack for your clients. And then Scam Alert, Scam Watch. Lucius on Security, another security researcher, security expert, talks about how there is a 100% chance that you are going to click on a phishing email. And no No matter where you are in your life, no matter what your profession is, including being a security expert, it's likely you're going to click that phishing email. Whether you follow through, that's another story. We're going to discuss that and some awareness tips around it. And then phishing with Zoom. So millions and millions of people are on Zoom, and while that's a good thing for communicating via a pandemic and thereafter, bad guys are using the Zoom platform as a way to phish people to get their credentials. And I'll explain what that means and why that's a problem for you. And then what the heck— what the heck is my favorite segment. And what the heck, this week is all about a third of Americans are binge drinking during COVID And while that's not necessarily a security issue, it's a wellness issue, and it's near and dear to my heart. Wellness is near and dear to my heart. So I wanted to talk about that today because we're coming into the holidays and some people are lonely. And when I go to Total Wine, the line is packed. And I just think it's something we should talk about. All that being said, thanks for sticking around. So the Daily Beast discussed the A-team of Kremlin hackers is back, and that's bad news for the rest of us. So I'm going to scroll down a little bit here where it says noisy Russian military hackers got all the headlines during the Trump years, but their quiet, careful colleagues are beginning to resurface. And they definitely are. So down here it discusses how while Russian hackers, uh, from the GRU have been shutting down electrical systems in the Ukraine, bricking Ukrainian networks with the NotPetya NotPetya ransomware attack, which NotPetya has attacked multiple hospitals across the world and across the US, and those hospitals have spent millions getting their data back or unencrypted from the ransomware. They also trolled Hillary Clinton with stolen emails from the Democratic National Convention and her campaign. APT29 operators were so hard to notice that some even speculated they might have ramped down operations after the public learned that Dutch intelligence had managed to infiltrate their networks in 2015, but that is not the case. Because up here the Fed say that Treasury and Commerce Department have been breached by hackers from leveraging backdoors planted in a popular network monitoring app. This might go beyond and above the heads of all of you, or many of you that are not engaged as a CIO or a CISO, but it's important you understand why it is that these big organizations get cracked and hacked, because they're such big targets and they have vast Networks that have all kinds of software in one software program that has one vulnerability that's not properly patched. That's how the bad guy's in. They put a backdoor monitoring software on it, spyware, and that's how they see and get all of your information. There is no such thing as 100% security. And of course, hackers and Russian hackers know this, or bad guy hackers and good guy hackers know this as well. So the US is pointing to Moscow as a likely culprit behind the break-in, but they're not pointing the loud, aggressive, and troll-happy military hackers we've come to know in the years since they've meddled with the 2016 election. So the point, point of all of that is just simply to pay attention to this because it matters. It matters to you, your information, and personal security as well. And this is why all these major organizations get hacked, because of all that vast software and those basic vulnerabilities. It's like if you're not patching your software or your operating system because you're lazy or you don't know why or how, uh, it's those patches are designed to protect you from those various vulnerabilities. And in this case, the hospitals or the Treasury Department or whoever didn't properly patch their network, and that's why they get hacked. So cybercrime cost the world more than $1 trillion, a 50% increase from 2018. Cybercrime— this is from HelpNet Security— cybercrime cost the world economy more than $1 trillion, or just more than the 1% of the GDP which is up more than 50% from 2018, a study that put global losses at close to $600 billion, McAfee reveals. McAfee was a former client of mine. So the severity and frequency of cyberattacks on businesses continues to rise as techniques evolve. New technologies broaden the threat surface. New technologies broaden the threat surface, which means that with new technologies, there's more to hack. And the nature of work expands into the home. So all of you, many of you working from home, attack surface has exponentially increased. We've seen like 27 billion records compromised in the first 6 months of 2020 due to the fact that many of you are working from home and the attack surface has exponentially increased, says Steve Grobman, who's the SVP and Chief Technology Officer of McAfee, who I have actually met. Nice guy. So Schneier, Bruce Schneier on security says FireEye was hacked. Well, many have said FireEye was hacked. FireEye is a, is a a security company. You know, they provide various hardware and software and tools and penetration testing essentially to secure your company's network. Big companies use like UPS and others. So they had sent out a press release basically saying that during our investigation to date, we have found that the attacker in this case, probably Russians, I would imagine, or Chinese for that matter, targeted and accessed certain red team assessment tools that we use to test our security. Red team being their penetration testers. Right, hackers, good guy hackers looking for vulnerabilities in a network, and FireEye has tools, right, to find out those vulnerabilities. These tools mimic the behavior of many cyber threat actors and enable FireEye to provide essential diagnostic security services to our customers, okay? So none of the tools contain zero-day exploits, and a zero-day exploit is basically a virus that nobody knows about, and there's no patch, there's no way to protect from it. Right? I mean, people might know about it, but there's no patch. And so what was hacked wasn't zero-day exploits, which is a good thing. The NSA, National Security Agency, has had plenty of zero-day exploits hacked, which is really sad, and they have been used by Russians and Chinese and others, and that's a problem. And then it goes on to say that, um, consistent with our goal to protect the community, we are proactively releasing methods and means to detect and use use of our stolen red team tools. So basically what they're saying is they want to help the community, the security community, to patch or protect themselves from their own hack. So they went on to say that we are not sure if the attacker intends to use our red team tools to— or to be publicly just disclose them. Nevertheless, out of an abundance of caution, which they should have, we have developed more than 300 countermeasures for our customers and the community at large to use in order to minimize the potential impact of the theft of these tools. Well, Well, yeah, they should. You know, that's a bad one. All right, so here Gizmodo talks about how the IRS is providing a tool to protect yourself from fraud, and you should take advantage of this. It goes on to say that tax fraud has been a persistent security issue for years, and it's not letting up, no question about it. In 2020, the IRS identified $2.3 billion in fraudulent schemes, and the agency's prioritization of processing returns quickly can make it difficult to catch the bad actors in the process. Yeah, I mean, the IRS is somewhat based on the honor system. This week, the IRS announced that the rollout of a two-factor authentication, sort of a two-factor authentication for your taxes, will be available to everyone. So the Sydney Herald, which I think is in Montana, uh, has a bit more of a deep dive on this. As part of the security effort, the Internal Revenue Service announced today that starting in January— I think it's mid to late January— the Identity Protection PIN opt-in program, uh, will be expanding to all taxpayers. That's a good thing, whether or not you are a victim of identity theft or not, who can properly verify their identities. Properly verify their identities. We're going to talk about that now because that's the caveat here. The summit partners, including state tax agencies and nations— the nation's tax industry and the IRS— marked the third day of the National Tax Security Awareness Week by urging taxpayers who want to throughout the Proactive Protection Against Identity Theft to opt into the Identity Theft Protection PIN program in 2021. So it's coming up in a few weeks. The IP PIN is a 6-digit number assigned to eligible taxpayers to help prevent the misuse of their Social Security number. That's you. If you have a pulse, you have a social. And then on fraudulent federal tax income returns, an IP PIN helps the IRS verify a taxpayer's identity that's a good thing, to proof you and accept their electronic or paper tax return. The online Get an IPIN tool is at irs.gov/ippin. Immediately displays the taxpayer's IPIN. So we're going to open that up really quick, and I'm going to show you, take you right to the website. So to get an identity protection PIN, it says right here at the top, planned outage until mid-January 2021. The service will be available— unavailable until mid-January. January. So you know about it, set your calendar, uh, to remind yourself first, second, third week of January to click this link to sign up. It goes on to say that when you have the— this special code, the PIN, like a PIN for your debit card or passcode, it prevents someone else from filing a tax return with your SSN. Uh, the fastest way to get an IP PIN is to use our online tool, but remember, you must pass a rigorous authentication process. Which is a good thing, but it can be cumbersome for some of you. It's not to say that we must know that the person asking for the PIN is a legitimate taxpayer. That's huge. It's really important that only you can verify you. Further, the online tool uses secure access authentication, which uses several different ways of to verify a person's identity before using the Get an IPIN tool. The IRS encourages taxpayers to review the requirements. So basically, like, there'll be a form, there'll be a bunch of like, you have to know, you know, some knowledge authentication questions is what I'm guessing. And then there's probably, uh, you have to provide some documentation. And we're going to go to the page right now, basically, that to have this information ready: email address, SSN or an ITIN, tax filing status, mailing address, credit card last 8 digits. So, so there's a bunch of stuff here, so I want you to read through this to prepare for it. But it's, it's good to know that you have this option, and I say embrace this as quickly as it comes out. All right, moving along. Tech Perspective. And by the way, in the future coaching call clients, if you have any questions, comments, feedback, by all means, in the chat, in the Q&A, hit me up live in real time and I'll respond right to you. For those of you who are live online, just email me and I will be happy to respond and react to questions, you know, going forward. All right, so Tech Perspective talks about how what happens to your personal data after deleting an app. Just because you delete the app doesn't mean that the data has vanished, A, from your device, and B, from the server to which it was stored, the company that, you know, has the app. So over the last decade, of course, uh, apps have become a familiar and comfortable aspect of everyday lives. But know that for businesses, that data has become a valuable resource. You should know that, you know, when the product is free, you are the product. Further, while the accumulation of personal data has started to become a popular topic of discussion— started— most of us don't know the extent to which our information is being collected, stored, or distributed. You should know that, you know, it's privacy, security, right? Indeed, though we might delete an app, that doesn't necessarily mean to say that the company will cease to use our information. Generally, when you delete the app, you might delete the app from the device, that doesn't necessarily mean that, A, the company that you do business with doesn't already have it on their servers. And more than likely, if you had a relationship with the app, you had a username and a passcode, more than likely there's a website you can log into, the company servers, where you can still probably get some of those services through that company. It's kind of like you got a Facebook app, um, a username and passcode, you You delete the app, you still have a Facebook account online, and so forth. That being said, even though you delete the app doesn't mean that you've deleted the information with the company. You can try to ask them. Deleting the app is easy enough, but that doesn't necessarily mean that the information that was on that app is completely deleted from your phone either. So when it comes to deleting all information from your phone, your app, you want to reinstall the operating system, reset it back to factory. That generally will remove everything or or do a quick search on Darik's Boot and Nuke. Darik is D-A-R-I-K, Boot and Nuke, which is a program, a software program that you can completely erase and delete anything from an Android, an iPhone, a Mac, or a PC. Further, always keep in mind the permissions, developer scrutiny. Like, just read this article, go do a little bit more of a deep dive, because ultimately your data is valuable to you, to digital businesses, and to hackers. So know what you're getting into before you just willy-nilly provide all your credentials to anybody. All right, moving on. Avast has a blog here that talks about 3 ways in which your browsing speed can stay safe and secure. So this is a really important topic because when you're out and about and you're browsing and you're downloading cookies onto your machine, because every website you visit is always telling you, do you accept cookies and this and that, those cookies are essentially spying on you. And occasionally, you know, they grab grabbing information that you don't like or don't want. So, uh, right now, if you notice, I am using the Brave browser. Brave is a browser that's kind of built in and around the way Chrome is built. That said, it does not, uh, allow cookies to the degree that Chrome does. It does not spy or allow spying the way that Chrome does. That's why I've graduated essentially to the Brave browser, and I like it a lot more. That being said, there is some functionality with the Brave browser that is not always there that you would have with the Chrome browser. So occasionally I gotta bounce back to Chrome if things aren't working the way I want, or I have to open up a private tab within the Brave browser because the Brave browser may not— again, you know, if it's blocking cookies, uh, it may not provide the functionality that I need, which means I got to go back to Chrome. All that said, recently on my Brave browser, I've had a lot of functionality issues because I had not been cleaning up my cache. Or caché. That said, there's ways to go about doing that. Now, tools like CCleaner or CrapCleaner are designed to clean out all of your cache or clean out, you know, temporary files and this and that. Avast provides those tools as well, and you can do it manually by just going into your settings within your browser. Now, whether it's Chrome or Brave, if you just search the term clean cache or caché, C-A-H-É, C-H-E, uh, Chrome or Brave or Edge or Safari and so forth. Clean the name of the browser, you'll find a tutorial quick how you go about doing that. Otherwise, you use a tool that Avast offers. Avast is antivirus, anti-spyware, anti-phishing, and a firewall. And it also offers, um, Avast Secure Browser, which is a, an additional download that you get along with the full suite of Avast products. So clean up the mess with privacy cleaners, it talks about cookies and what that's all about. And then erase website data with one tap, that's generally all your cache, and delete sensitive data with a browser reset. And it talks about how to do that manually on Android and on iOS and so forth. And you can also do it again on all of your various browsers that you use. So really important tool, one that you should, uh, consider All right, so Lucius on Security discusses how there is a 100% chance that you will click on a phishing email. Yeah, you know, you may click on it, you may not click within it to do what it says and provide that sensitive information, but you know, everybody is capable of being suckered. P.T. Barnum once said that there's a sucker born every minute. I'm going to take it a step further. I think there is a sucker in every single one of us. And if you don't think that you can ever be suckered, yeah, you can. If you've ever been cheated on by a significant other, you've been suckered. I mean, it's just the way it is. So we are all capable and vulnerable. It's just a matter of what are our trigger points. So I like what this guy has to say. It's astounding, isn't it? He says, I am sure that you will question the audacity of that stat 100%, right? I can tell you with confidence that even a security expert like him or me, is not immune to falling prey to phishing emails, and that is why even the most mature security companies are hacked, like FireEye. Any human will click an email whose content appeals to a human emotion that is strongly felt— love or sex or money, right? There is a phishing bullet with everyone's name on it. So well said. To illustrate the point, let us study two examples. So We're in the middle of a pandemic, and his examples revolve around COVID right here. So this is a first related to the COVID pandemic. You receive a phone call, a phone call from an unknown caller. The caller requests for your personal details and telephone number to register you for the immunization program. Who doesn't want to get immunized, right? There is a fee to be paid, for which a link will be sent via SMS. Now ask yourself, would you give your personal data to the caller? Would you? You might. Most probably not. I don't think I would, and certainly not before you ask several clarifying questions to verify the program and the identity of the caller or institution. First and foremost, anytime the phone rings at this day and age, especially if they're asking for personal information, it's a scam. But would you do the same if the information was requested via email? Now, most people these days trust email more than they trust the phone. Most people who are eager to receive a vaccine would fill out the information and await further instruction. This would be step 2 if the scamster intended to scam you for money. In some cases, the scammer would be satisfied with just your personal data, like your Social Security number. So a few things he wants to point out, and you should read the rest of the article here, and you can get this all in the replay notes. Notes. Those of you on YouTube, if you're watching this, just email me, Robert@safar.me. Robert@safar.me. I'll email you the replay notes. Just to say Merry Christmas. So this is 4 tips to this common scam. If an unsolicited email is promising a free lottery, job, or anything in return, it's probably fake. It is a fake. There's nothing free in life. I mean, that's basic 101. But good to remind you. If the unsolicited email is promising something extraordinary, like a high rate of return or a payoff, then avoid it. It's a scam. Further, if the unsolicited email is asking you for personal information, it's a scam. May not be one that causes you to lose money, but more often, it fills your inbox with more spam. And if the alias of the email is someone you know, right, because we see those all the time, but the email ID is different, it's not their email address, it's a scam. That is usually as a result of the Yahoo breach, where 3 billion email addresses are compromised, including everybody in everyone's address book. And so bad guys are using all of that data and emailing people that we know using their actual email address and their name, but with a, with a, with a different URL, like a China, Chinese, or Russian domain. So that being said, every time the phone rings, every time an email comes in, be suspect. All right, now, uh, Security Boulevard is talking about phishing with Zoom. Millions of us are using Zoom, so what's this all about? So since the shift to remote work, attackers are capitalizing on the surge in new tools to aid remote workers. Of course, there's plenty of them. Now, right here is an example of a spoofed website, a phishing website created to look like Zoom. So check it out right here, zoomuserin.000webhostapp.com. So basically this is a fake website, a spoofed website created to look like Zoom. So you get an email, right? Says to log into Zoom to update your passcode or whatever. And right here you see where it says sign in and it says email address and passcode. Code. Now, in and of itself, that might not seem such a big deal to you, but your username, in many cases email address, is the same username that you might have for PayPal, AOL— no, we're not AOL— but PayPal, um, Amazon, eBay, Visa, MasterCard, American Express, right, Discover, uh, Facebook, Twitter, LinkedIn. So that email address is a username. As it is with Zoom, and then they're asking for password, right? The problem there is that that password that you use for Zoom could be the same passcode that you use for Amazon, eBay, Best Buy, Facebook, Twitter, LinkedIn, Visa, MasterCard, American Express, because many of you use the same passcode across multiple accounts. Same username, same passcode. Bad guys get a hold of your login credentials for Zoom, they could have the login credentials for 100 different websites that you might you might subscribe to. That being said, be aware every time the email comes in, and number one. And number two, do not use the same passcode twice. You need a pass— a password manager. And that means that you have to have a different passcode across every account. And the only way to go about that is utilizing a password manager, which is a software program that you download that manages your passcodes. I'm not worried about the password manager being compromised. I'm worried that you're using the same passcode across multiple Capisce? All right, next, uh, this is What the Heck, my favorite segment. A third of Americans binge drink during COVID pandemic, but lockdowns make the problem worse. Well, I've spent a lot of time at Total Wine this pandemic, and, uh, you know, my wife and I, uh, on a Friday and/or a Saturday night, we might start off with one bottle with dinner, which is usually 2 drinks per person. And depending on the evening and depending on the meal, depending on how good that wine was, we could evolve to a second bottle of wine, which could become 4 drinks, and that's usually about it. To some, that might seem a little too much. So, an alarming new study reveals that binge drinkers are taking down 4 to 7 drinks in a single sitting. Well, on a Wednesday, I'm probably not gonna have 4. I'll probably just have 2. On a Friday, I could evolve to 4. 7? Yeah, when I was like 25 and I'd end up puking, but that's just not something that I'm doing as an adult. That being said, 4 for somebody who might be 125 pounds could be a lot. I'm 190-something and I've run 9 marathons and I, you know, eat like a Viking when I eat and I work out and take care of myself. So 4 is not a lot for my body weight and the fact that I eat with, with, um, a drink and eat at the same time. So it goes on to say that— let me see— the researchers at University of Texas Health Science examined almost 2,000 people over 18 between March and April. And this is when the first statewide stay-at-home began. And let me see, it said that— it was something in here that I wanted to see. The results found that binge drinkers consume an extra 19% every week in lockdown. The odds of drinkers having more alcohol is more than twice as high among harmful drinkers compared to those who don't drink excess. So what they're basically saying is, is that those who have a propensity to drink more in general, uh, that might have, uh, the disease of alcoholism are drinking way more, like more than they more should, like they're binge-binging. Uh, that said, our— us casual drinkers, they're saying that are definitely drinking more during the pandemic, which is true. Um, because my credit card will tell you that. But as long as you keep it in perspective, space it out, and eat with your alcohol, and of course do not drive, you should be fine. All that being said, just be aware of this. Just take care of yourselves out there. You know, just communicate this information to those you love that might have additional problems. Check in with them because this is a real thing. So, uh, in closing, a couple things to point out. If you want to get in touch with me, this is my personal website for my basic security awareness training that I do my live presentations. It's safer.me. Uh, but the company in which I am partners with, uh, is something you really should check out at ProtectNow LLC. We offer certification courses, the CSI protection certification. We offer live, uh, programs, also the Threat Ready phishing simulation training, the coupled with microlearning that is really cool. You should definitely check that out. Various products we have is the Ripple Safety Button. It's a personal security device about the size of a dime. ID Protection, we're one of many, but much more cost-effective. ThreatReady, again, the phishing simulation training and cybersecurity insurance, along with our virtual CISO, CreditParent.com, and our home title lock. So that is my plug for the day. Thank you so much. For those of you who are our new coaching call clients, thanks for being here. Those of you who are checking us out on YouTube Live, Thank you. Nice to meet you. And many of you have probably seen me do some TV stuff in the past. And behind me basically is my satellite office, which means I drove the kids to school today. Sometimes you'll see me in my home office. A couple of weeks ago, many of you saw me in another country. So these coaching call webinars move around as I move around. That's the beauty of doing stuff online. Benefit of COVID I guess, right? Other than 300,000 people getting killed, and that's awful. Otherwise, you guys have a great holiday season. Season. Uh, thank you so much for all of your participation. I appreciate your comments and feedback. And hey, uh, more importantly, be careful