Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano. And this is, this is Peter Wormka.

And I guess by default, I'm the CIA guy.

I have been quite a few years now retired. Yeah, yeah, he is a CIA guy. I'm not. I mean, you spent time at Langley, correct?

Fortunately, compared to my entire career, very little, because just like Langley is like any, you know, the headquarters is like any headquarters of any government agency and even corporate entities. Headquarters is a place that you probably want to stay the least amount of time. It's much better being out in the field. So I spent most of my, my career, uh, overseas, which I really enjoyed.

Yeah, I— the only thing I know about Langley is of course the fact that, you know, you, you see it on the, the, the TV show Homeland where they spent a lot of time at, uh, and, uh, you know, you hear about Langley your whole life anytime you hear like FBI, CIA, something to that effect. And then there's been like a couple of like, you know, active shooter type crazies down there over the past, uh, I don't know, a few years or whatever. So yeah, uh, but, um, yeah, Peter is the real deal.

And you know what, you know what, but hey Robert, you know what drives me crazy though? When I watch these movies and they're like supposedly, you know, they'll, they'll show an overview shot, you know, uh, taken by a drone or a plane showing, you know, headquarters. But then when you're inside, I said that they didn't film that in headquarters at all. That doesn't exist. Or, you know, in the fact that they're all running around with their cell phones. No one uses cell phones inside Langley. You can't. At least when I was there. I mean, unless— I don't think they changed the policy, but there's a lot of things they do in Hollywood. Everybody's on the telephone, and you know just as I know how vulnerable we are from a security standpoint when we're using mobile phones. So it's just like, it drives me nuts.

Yeah, yeah, well, that would make perfect sense. Uh, so Peter, uh, we've got all kinds of, uh, interesting and, uh, you know, uh, sometimes scary things to talk about today. Right here, as everyone can see, this is FBI tech support scams now use couriers to collect victims' money. Okay, so this is via Bleeping Computer. Tech support scams, Peter. So why don't you just describe really quick what a tech support scam is?

Well, I mean, they come in different varieties, but typically an individual, and a lot of time it's a senior, that's the group that gets the most targeted by this, they're on their computer and all of a sudden, it could be an incoming text message or it could be something that's already, you know, shows up on the screen. It maybe looks like malware but probably isn't even malware, but it shows that, "Hey, you got a problem and you got a virus and you got to take care of this right away or it's going to get worse." And then they give you a telephone number, "Please call this number." And so it's sort of like it creates a problem, creates a fear, And it gives them sort of, you know, in the minds of the victim, a solution. Let me call this number and see what can be done. And then it just, you know, they call that number and these people sound like they're, you know, real tech support. And they'll, you know, they probably in most cases, they don't even have access to the computer yet, but they will tell the people, well, you know, please, I'm going to send this to you. Please click on this link and I'll help you resolve this issue. And then the bad guys are going to have full access to the computer. And maybe create even additional problems. Long story short, to solve all these problems, they're going to ask the individual to pay a certain fee to resolve these issues. And traditionally, it's been, you know, you pay the fee online or over the telephone, you'll send money to them. And now, according to this article, which is pretty interesting, is that they've changed sort of the delivery mechanism for making these payments to be a courier, right?

Yeah, so today the FBI warned about courier services being used to collect money and valuables from victims of tech support and government impersonation scams. The public service announcement follows a surge of reports regarding criminals using couriers, couriers, to cash collect or precious metals like gold, silver from victims, many senior citizens, whom the scammers instruct to sell their valuables. The FBI is warning the public about scammers instructing victims, many of whom are senior citizens, to liquidate their assets into cash and/or buy gold, silver, or other precious metals to protect their funds. Criminals then arrange for couriers to meet the victims in person to pick up the cash or precious metals. So while some scammers choose to impersonate tech support workers or US government officials, they've also been spotted masquerading successfully as employees of technology companies, financial institutions, or the US government. They could pose as Microsoft, they could pose as Apple, and so on. Listen, the, the outlandish nature of this particular scam, uh, is just so brazen, uh, and just so ridiculous that the majority of our listening, viewing audience is looking at this and saying, who would ever fall for this? And that's the thing, see, sometimes it's the people that we love and that are closest to us that we know that may be somewhat, you know, naive or gullible or vulnerable in certain aspects of their lives, maybe of a certain age, say senior citizen, whatever that might be, 60s, 70s, 80s, that, um, you know, you wouldn't think in some cases they would fall for something like this. But the methodology that the criminals use is to tap into their instincts, to tap into their feelings and their emotions. And once they strike a nerve, then all bets are off. You know, your grandfather who might have served in, you know, the Korean War or Vietnam or whatever the case is, who's like a pretty hardcore person, uh, may be, you know, affected in a way that you wouldn't even imagine when he gets a phone call or an email or pop-up like this, and he begins to react and respond that you did not predict. You know what I mean?

Right, because first of all, they, you know, they're using fear. It's a situation that creates a fear. And now all of a sudden you're talking to an individual who sounds very trust— you know, gains your trust and feel like they're going to help you. They know, they can understand that. Yeah, you know, these are problems, you're probably really concerned right now. Don't worry, we can take care of this. Just follow my instructions, do this, and we'll take care of it, and nothing bad is going to happen to you.

So yeah, so how to protect—

they're professional.

Yeah, exactly. So how to protect against scam attempts. So it says, to defend against such fraud schemes, FBI advises never send gold or other precious metals to legitimate businesses, government agencies. I mean, duh. But what this really, really boils down to is like a couple of technology things, like don't click on unsolicited pop-ups, don't contact unknown telephone numbers provided in pop-ups, don't download software at the request of an unknown individual who contacts you. Don't allow unknown individuals to access your computer. Okay? You and I know this. The majority of our audience knows this. But there are going to be certain people in your life that you need to be that much more, you know, aware of their vulnerabilities and sit them down and bring this to their attention today and say, "Hey, in the unlikely event you get a pop-up on your computer and they tell you to do all these different things," Don't. Pick up the phone and call me first. Like, text me, email me, call me, whatever the case might be, so that I can give you, Uncle, some insight, Grandma, uh, Dad, as to what to do in response to this particular situation. No matter what, how they make you feel, your blood pressure rising emotionally, whatever the case is, don't just engage. Call me first. Awareness is key.— some type of intervention prior to, you know, planning that this might happen to your loved one in the future. Doing something about it now could prevent some type of catastrophe down the road.

Absolutely. When I'm out speaking or conducting training events, many times, you know, I do talk about elderly fraud, and many times people will come up to me at breaks or at the end and say, that's exactly what happened to my dad or my mom, or, you know, one of my siblings. And so, and almost everybody's got a story like that, you know. So it does happen. And, uh, it's almost, as you mentioned, we probably know, we all of us, all the listeners know somebody who've had something like this happen to them. Yeah, maybe they didn't tell them, maybe they haven't told you this because maybe they're embarrassed, but it's happened to them. It's happened to me. So rampant.

So my dad's 75, and I got a call from him like 2 weeks ago And he's like, Robbie, because he calls me Robbie. He's like, I got an invoice today from Symantec, the Norton antivirus people. He's like, I don't have Norton antivirus. He's like, so I called them. I called them to tell them that I don't use their services. And, and then I called PayPal afterwards, because they were going to charge my PayPal account. And I didn't even realize I had a PayPal account. And I said, Dad, first of all, you don't call Symantec because they sent you an email. That email is fake. I get that email all the time.

Yeah.

And so I had to like kind of probe. I'm like, Dad, did you— what did you give them? What information did you give them? Did you give them like your name, address, phone number, credit card number, anything else? He's like, well, they know my name. And they know my email address. I gave them that. I go, but I didn't give my PayPal address. I didn't give them a credit card information. I said, like, Social Security number? He goes, absolutely not. I said, fine. I go, so the phone call you had was likely with a scammer or somebody who's working for a scammer overseas, I'm guessing, more likely in at a call center, usually in India. And whenever you get an email like that, just hit delete. If anything, call me. Don't just react. Don't respond. And I know you don't want to pay a bill that you— I'm not supposed to pay, of course. But you're going to be getting these fake invoices for the rest of your life. Oh yeah, go ahead, Peter.

You're— you'll be on that, that list, right? That, that list that everybody, you know, they sell to other people because they know that someone who's been victim, the more likely to fall victim again, unfortunately.

Or somebody who even picks up the phone and calls to question about the invoice is, is put up higher on the list, right? Because that person now is— has the, the, I guess, the, the vulnerability to react to that email, like, so much so that they pick up the phone. You know, so now his phone number is at risk, meaning that his phone number goes higher up the chain of, you know, sucker list. So I'm like, Dad, you got to be aware every single time an email comes in, every single time the phone rings, don't just engage, just hang up. It's not Symantec calling, it's not Apple, it's not Microsoft, it is a scam.

And he pretty much— I don't know about you, Robert, but I probably get at least 40 a week, oh, you know, of these type of things, whether they come in by text message, you know, a real phone call or email, you know, um, at least 40, probably more. Yeah, every day I'm just, you know, that's another one, that's another one, you know. I'm so used to seeing them and not acting on them, of course, except deleting them. But, um, you know, if I were to start to count them, they'd probably be, probably be much more than that.

Yeah, it's flipping awful. All right, so, uh, next, uh, uh, NBC News talks about sex sex extortion training materials found on TikTok, Instagram, Snapchat, and YouTube, according to new report. Yahoo Boys is an informal network of cyber criminals who have gained cultural clout over the last several years in West Africa. So a form of cybercrime called financial sextortion is rapidly rising in North America and Australia. It's been around for quite some time. And with a major portion driven by a non-organized criminal group in West Africa who call themselves Yahoo Boys. According to a new study from Network Contagion Research Institute, sextortion is a crime that involves adults coercing kids and teens into sending explicit images online. The criminals threaten their victims with the wide distribution of explicit images, including to the victim's friends, families, unless the victims pay them. So not too long ago, uh, Peter, you and I might have already even discussed this, I got a panicked instant message on Facebook from a friend, a woman, girl that I essentially grew up with. I dated her sister back in high school, and her boy, um, got hooked. Uh, he, you know, young kid, underage, you know, thought he was talking to a hot girl and ended up, you know, providing a photo that he, you know, did out of you know, his, his, his 17-year-old boy feelings, you know what I mean? And, uh, immediately the sextortionists, uh, told him if he doesn't pay that he's going— that he— that they're going to share that with everybody in his circle. And he paid. And so she called me because her son was devastated, and she's like, I don't care about the money. I go, I don't care about the money either. I go, because you're not going to get the money back at this point. Um, that money's gone. I go, the most important thing right now is that you are there for your son in a way so that he understands that there's no shame in what happened here. That as, as, as, as awful as he feels about the whole thing, he should not feel shame. Um, that he should understand that he's a victim of a crime. And that, um, he needs to realize that it's going to be okay. This too shall pass, and you just need to learn and don't do it again. And just be a tough mom. Just console him, let him get it out of his system, and just pay more attention than anything to his mental health. Because, you know, he's likely a, you know, grounded kid but the trauma of something like this happening, which I, I don't know if you can say that this is a form of sexual assault. I don't know if you can say that. Um, it's definitely sextortion, but it is definitely an assault of some kind, you know what I mean? I mean, it's fraud. He wasn't physically hurt or harmed, but, you know, I mean, even when someone is making sexual commentary about someone else, unwanted, that's sexual harassment. So this is a form of harassment, extortion. I don't know. It's just not good.

Yeah. I mean, this is, you know, the trauma that can, that someone can be left with is even worse than if it were, you know, the money they pay, or if they would have got physically hurt in some capacity. And maybe it's not quite as bad as this, this sort of emotional trauma that can be with them for a long time. My— something like this happened recently to one of my nephews who also, you know, got, he got pulled into something like this. I don't know all the details, but he also, well, you know, they, they demanded that he pay so much, otherwise they were going to send this information, and they, they, uh, to, you know, send these photos or information to, uh, friends and family. And they even went as far as impersonating the local law enforcement from our town. All right, so it was like this, this poor kid, it was just like devastated, and he just thought the only way out was going to be paying this money. He didn't say anything to his— to anybody, but then I think his mom realized something is not quite right, and I think she kind of like pressed him a bit, like, what's going on, what's going on? And he finally told her because he was on the way to make the payment, and she said, stop, this is a scam. This is, you know, this happens a lot. Do not, you know, you know, let's, let's, let's file, you know, a report, but do not make the payment. So I mean, it's hap— I mean, so you mentioned it's happening in this around us with our family members. And then, you know, what's even worse is not only that people are left kind of with this trauma, or they, you know, they paid this money, there are, are people that end up— kids that end up committing suicide, whether it's the because they've been targeted by a sextortionist who wants money, or they're just, you know, somebody that started something and, uh, spreading an image or another, and, you know, the fake image of them that's sexually explicit, and then they're bullied, you know, to the point of they feel that there's no hope. They go down this dark hole. That's—

yeah, yeah, it says it right here, Peter. It says sextortion is a transnational crime threat that is actually causing a significant number of American deaths. This form of crime, which has mostly impacted boys and young men, can be so devastating that it drives its victims to suicide. So, it's a real thing, you know, and my friend's kid got out of it relatively unscratched. It says here, in August of 2023, two Nigerian men were extradited to the U.S. and faced charges in a sextortion scheme that authorities say prompted the suicide of a 17-year-old Michigan high school student, The men pleaded not guilty and were denied bail in September. Wow, I can't even believe that Nigerian government, uh, extradited them.

Yeah, I was just gonna say that. I mean, that's, that's amazing, you know. At least, you know, at least maybe it's just symbolic or who knows, but at least they're, they're doing that. Because, um, if not, so many people getting away with conducting all kinds of extortion. But they're— even if they can, even if they can eventually be identified Good luck in trying to get them extradited, extradited from the countries where they're conducting this from into our legal system here. It's so, so difficult.

Yeah. Yeah. Peter, so next in line, maybe last but not least, this one right here is nuts. So Gizmodo talks about Taylor Swift AI porn forces changes at Twitter and Microsoft. Elon Musk's social media platform Blocking searches related to Taylor Swift after AI porn created to resemble artist went viral. Uh, something went wrong, says X, when you search for Taylor Swift on Monday morning. Try reloading. Uh, so the AI-generated nude photos of Taylor Swift started circulating on X late last week, with one post garnering 45 million views. The post immediately started drawing backlash from Swift's fan base, ultimately prompting X to block accounts sharing the content and remove the most viral posts. So the White House even commented. And I gotta be honest with you, Peter. I did not even make an effort to check these photos out. I didn't, on principle. That principle being, A, you know, like, she's, she's literally Miss Americana. And I just thought, like, A, it's just wrong to begin with. B, I live in a family of Swifties. My wife, my two daughters are nuts with all this stuff. If anybody can get me tickets, please let me know. Uh, anyways, like, I just— I didn't because I just thought it was just, you know, inappropriate to do so. So what do you— what are your thoughts on this, Peter?

Well, yeah, exactly. I haven't either. But let me get a little bit on a rant. I'm sorry. Uh, why does it take a celebrity at the level of Taylor Swift to all of a sudden make people concerned about this and paying attention and saying, you know, the government needs to do something because this happened to Taylor Swift. I mean, I feel sorry for it with regard to this. It should not happen to anybody. But this has been happening for how many years? It's happened to celebrities and gotten very, you know, just a little bit of attention because celebrities tend to be a little bit more, uh, targeted for this. But it's also happened to so many people, you know, uh, who are not celebrities. So many— we're talking about thousands of people that, you know, that a lot of them don't report it. But even if they do report it, nothing is done. I mean, this problem has gone on for a long time because no one's just seemed to care. If it didn't happen to you, you know, if it happened to somebody else, well, you know, what is it? Just, you know, some more pictures that are up there. But it's just devastating. I mean, look what happened to, uh, even Aaron, um, what's this, the— I'm not Aaron Rodgers, the one that reports to sports sometimes on, on the, on the news.

I think it's like Erin Anderson, maybe.

It's, uh, well, I think most people— and I can't— I have a moment here, senior moment. I can't remember her name, but, but, you know, she had these pictures taken of her by an individual who got a hotel room next to her and through the peephole was able to take pictures of her, you know, fully undressed. And, uh, those pictures were uploaded. There was no way for her to get those pictures down ever. Google never took those pictures down. They're probably still up there. Uh, so this has been going on for years. What, you know, whether it's mainly done by somebody taking pictures on the camera and uploading them, or it's being done, you know, by pictures that are circulating, or it's being done especially with using deepfakes, like the case with, with Taylor Swift. So, you know, I'm glad that action is being— I'm not glad that this happened to her, okay? I, I, I think it's atrocious that happens to anybody, and I'm glad that it's getting the attention. But what I don't understand is why would the general public not seem to be concerned that it's happening to so many other people? They're only concerned, wow, that it happened to this, you know, idol. That's what's got me on my rant.

I'm sorry, you know, I— look at— I, I I understand your perspective 100%, and you're not wrong in that regard. I think that when it does happen to somebody of notoriety, that we do as a culture pick up and take notice. You and I, I don't think it was too long ago, we actually did a story on a young woman in New Jersey and her mom on CNN talking about how some boy at school likely was responsible for sharing photos, AI-doctored photos about her and a bunch of other girls that she went to school with. And that those photos, you know, circulated and obviously, you know, caused some distress for her and her girlfriends. And that the mom and the daughter wanted the government to do something about it, you know. And I think that, that it's stories like that, that you and I, you know, cover, that are evidential that not enough is being done to protect the public. That being said, I agree with you. And I think that this story is the beginning of there being some type of legislation that makes a photo like this being distributed by someone a form of assault, a crime, in such a way where there is an actual victim. And I think it's stuff like that that needs to take place in order to prevent— at a minimum, prevent the kid in high school from doing it, or at least make him think twice., or make, make his buddies think twice after he gets busted for it, and he's not going to do that again. And then other kids, you know, perk up and say, okay, I'm not going to do that mischievous type thing that does result in harm, and it's illegal. So, um, there is a, like, I guess, a benefit of somebody like a Taylor Swift from, you know, being, I guess, victimized in this case, as, as awful as that is to say. Um, but in the end, you know, hopefully, uh, government officials, law enforcement, the public in general take notice. And we know that this isn't going to stop. It's just not going to stop. But it, it at some level will be curtailed to a certain degree.

Oh no, I agree with you, but, and I really believe that the best way to potentially, you know, address this issue, uh, try to fight against it, is going to be focusing that legislation on the means of distribution, which are going to be these social media, predominantly social media platforms, when they're the carriers of these, uh, whether, you know, it's, it's videos or deepfake photographs that are used that could, you know, they don't, we don't care if they're out there just for entertainment, you know, but when people are victimized or with this misinformation or disinformation or things that are detrimental to society, that's when these platforms need to be on the hook for being the conduit, the distributor of this information. So, if they say that they are starting to use filters to weed out, you know, things that are AI-generated that could be, you know, detrimental, if they're in fact doing that, because they say they are, they should be the first ones' line of defense to say, we're taking this down immediately.

And what did you think of Zuckerberg's apology yesterday?

That was not— I mean, in my opinion, I didn't see it as an apology. First of all, he, you know, he was— it was like put on the, you know, put on the spot. You know, you're on national TV right now, You know, will you apologize? And so, okay, he stands up, turns around, and he just said that he felt sorry for what people have suffered. Didn't say that he felt sorry for what he did or what his platform did. He just— it was sort of like this blanket of, I feel, I feel bad for people that suffer from these things. So I— to me, it wasn't very genuine, in my opinion. What about you?

Well, okay, so I, I, I, I, I, I feel similarly to how you do. I am also a huge proponent of personal responsibility, meaning that I just think, like, I mean, I know that I've had multiple conversations with my girls in regards to this stuff and what this looks like and what to be aware of and how to be— how to not end up a victim of these various issues, you know, or at least, you know, know that, you know, anything that they put out there, uh, can end up, you know, causing harm. That my girls have not had— they didn't get their phones until they were 14, and they don't have, uh, social accounts where they're sharing their photos and everything else all over the place, and they're still at risk you know, but because there are pictures of them out there somewhere. Uh, that said, I, I, I, I prime them to the best of my ability to be aware of what to do and what not to do, and the fact that, you know, anything they put out there could be used against them.

I agree with you, and I think that's very, very— you know, I've always tried to do that. I did the same thing with my daughter. I did not you know, she wasn't going to get a cell phone. This is quite a few years ago, until she was 16. But then what happens? Her friends bought her one. So I mean, a lot of times parents can have the best of intentions in trying to protect their children, and, you know, both from what they try to prevent them from getting, as well as try to educate them. And but many times these, these children are, you know, being influenced to get around those type of controls. Unfortunately, you know, we're probably only talking about 20% of these kids that maybe are, you know, paying attention to, to what they hear as far as, you know, the dangers, but a lot of them aren't. So yeah, I agree. I think, you know, that would be definitely the first line of defense if everybody was, was doing it, but unfortunately they're not. So I was thinking that maybe one uniform measure would be focusing on the distribution done by the platforms. That's my opinion.

Agreed, agreed, agreed. So Peter, tell everybody what you're up to and what do you want to promote?

Oh, I see you have my book up there. And yeah, that's getting a lot of attention. This specifically focuses on, you know, fraudsters targeting of seniors and different types of fraud and how they can protect themselves. My other book, Confessions of a CIA Spy: The Art of Human Hacking, focuses on some of the same issues, you know, the social engineering by bad guys, but more to how to protect organizations and their employees. I'm doing— now things are beginning to pick up a lot of incoming requests for speaking at conferences and seminars for companies. I hope that continues. I think there's more and more interest now, which, you know, I think finally we're getting people that are starting to pay attention. We need to do something about these issues. So, you know, things are starting to pick up for me. We're never going to be able to defeat the bad guys, but we want to harden ourselves, right? So the bad guys go on to someone that becomes a softer target. That's just reality. You can't defeat the bad guys. We just, we just make sure that we can protect ourselves from them.

And your website is counterintelligence-institute.com. Excellent. And y'all can see me, um, at protectnowllc.com. Again, that's protectnowllc.com. And, um, uh, if you, uh, on a side note, uh, kind of a fun thing that happened to me in the past couple of weeks If anybody knows who Jonathan Van Ness is, who honestly I didn't really know who Jonathan Van Ness was up until a couple weeks ago, I guess he's one of the 5 from Queer Eye for the Straight Guy. And I was on his podcast, I believe it's called Getting Curious, and that dropped January 31st. And Jonathan is a character. It was a lot of fun. This was a— this is a podcast. It was a little off the beaten path for me, um, in, in, in regards to our dialogue and our interaction, uh, and when I say that because Peter has a potty— I'm not Peter, uh, Jonathan is a potty mouth. And, and I, I, I swear all the time. Like, I swear in my personal life all the time. I've never been on a podcast before where where the, the host swore a lot, which I was very comfortable with. It was just very different for me, but he's a character. It was a lot of fun. We talked about home invasions and personal protection and identity theft. So it's called Getting Curious with Jonathan Van Ness, a great guy, a lot of fun, uh, great podcast. It was about 40 minutes, and if anybody, uh, wants to check that out, uh, he went— the day that it launched his Instagram feed. He's got like 5.7 million followers, uh, like, like almost 6,300 likes, like right off the bat, you know.

Um, put in the show notes. You want to put the link in the show notes?

I'll put a link in the show notes. That's a really good idea. So yeah, Jonathan Van Ness, uh, Getting Curious. I'm on his January 31 podcast. Lots of fun. I think you guys are gonna kick out of it. It was really good.

Yeah, I want to see it. Yeah.

Uh, all right, so, uh, Peter, last, last words.

Stay safe out there and do everything you can to, to, uh, protect your loved ones against all types of threats.

And be nice to each other. Thank you, Peter.