The ongoing vulnerabilities of U.S. #23

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it and welcome to the Security Guy and CIA Spy Podcast.

I am Robert Siciliano and this is Peter Wormka.

How are you doing, Robert?

Doing pretty good, Peter. Happy summer.

I thought we entered summer like about a month ago with these temperatures. I, I was surprised that summer was only starting just, uh, what, on the 20th yesterday, right?

Yeah, yeah, yeah. Despite, uh, you know, y'all's political beliefs, uh, it's warming up. Yeah, in, uh, New England where I'm at, um, you know, the Boston area, uh, the striper fish are running. And, um, I have a really good— he got me a striper yesterday. And I have a really good friend who, uh, fishes, uh, who said that mahi-mahi is up here. And mahi-mahi is a southern fish, uh, so they're, they're here at a very warm climate. And we're seeing a lot more seals up here. And, um, if anybody's been paying any attention to shark attacks, uh, in the nation, you'd know that Cape Cod, Massachusetts is one of the prime hunting grounds for sharks these days because of the seals who have migrated to Cape Cod because of the, um, the waters, and that sharks are up here. Uh, it's, uh, yeah, it's getting kind of crazy.

Yeah, I mean, I just came back from, uh, I, I was in, uh, Miami on Monday doing a keynote presentation, and I got on the airplane to go up to Minneapolis thinking Oh, it's going to be a few degrees cooler up in the Midwest. And I got off the plane, I was like, what has happened? It was like, it was like 6 degrees warmer. It was a heat wave going through.

Yeah, yeah. Uh, so, uh, what are we talking about today, Peter? Um, we got actually got all kinds of interesting stuff to discuss. Uh, I, um, hold on one second. I have been pretty freaked out by the, uh, attacks on our nation's water supply. How about you?

Oh, no, this is really, this is really of concern because, I mean, there's a lot of different attacks going on or potential attacks, but when it hits the water supply, this is something that can have devastating consequences for those individuals who would be affected.

And that could potentially be everybody, right? So Threatpost produced an article, US Water Utilities Prime Cyberattack target experts. So there is a specific, uh, point in here. Environmentalists and policymakers warn water treatment plants are ripe for attack. Industrial controls governing water-related U.S. critical infrastructure are woefully underestimated as cyber attack targets. The potential for attack, says policymakers, is too great to ignore, with consequences potentially devastating to populations. So for example, like in the Massachusetts area, we have the Mass Water Research Authority, and I think, um, like the Quabbin Reservoir takes care of like 56 or 58 cities and towns. And if that was to be attacked in such a way where it was polluted, uh, chemicals were induced into it, um, there was, uh, a mess— somebody messed with the, um, the, the, the, the— what is it— the the, the SCADA, um, which is the industrial controls, then they could release like all kinds of chemicals into it that would, uh, poison people, right?

And then what?

Now you don't have any actual running water that you could drink, cook with, shower. Now you rely on bottled water. And I remember in Massachusetts, maybe about a decade ago or less, one of those pipelines had burst that supplies water to all those 56 towns. And you could actually see a video of it, you know, they had a video of the actual explosion where it burst. And, um, they had to bring in the National Guard to distribute bottled water to all those cities and towns. So it was a state issue. And, um, when the National Guard came in, uh, you know, they deployed everywhere, like in Walmart parking lots. And I remember at one point, like, the news showcased like a situation where there was a rush from people, like, rushing to get the water. And like, you'd see people getting knocked over, and like little ladies like getting their case of water pulled from them and stuff, like, you know, ripped from their arms. And it was like, I'm looking at this, I'm like, the US is like a banana republic. Like, these people are knocking down each other to get water.

Yeah, yeah.

The thing about this particular, um, problem that we had was that you still had running water. You still actually had water coming in, so they had a backup pipe, right? So the water that was coming into your faucets was, was a little stagnant because it was the backup pipe, but you still had running water. And the thing about it was, like, if you had any common sense whatsoever you just boil the water that was coming in. You had running water, but instead people were rushing to Walmart parking lots to get free water from the National Guard and in a panic and didn't even think or know enough to just boil their water, which is what I did. And I had backup water anyways, which is another example of how woefully underprepared we as a civilized society are.

Oh, it's very true. And I think there's a lack of understanding about the nature of this type of attack or target. If we're looking at the threat actors out there, if we're looking at cyber warfare, our adversaries, whether it be Russia, Iran, China, whatever country it could be, they're putting on the shelf different scenarios, different attack scenarios. We've heard a few in the past of probes into utilities, just probes without anything actually an attack necessarily taking place. But these are set in motion so that if there is a decision that goes forward for actually launching a cyber war, they already have the plans on the shelf. Because it's just a little bit different than criminal. Criminal groups might go in and they have— there's been a few of these reported, very few. I think maybe not all of them are reported. Attacks that have shut down systems for ransomware, you know, for a ransom. And probably the utility companies have paid those ransoms without it even coming public. But the biggest danger here is the attacks that could take place by a state actor. And that could be, you know, like turning on a light switch pretty much if something were to happen that— and it would happen across the country., against a number of these at the same time, probably.

Yeah, we'd be screwed. So they say that in the article, water may be the greatest vulnerability in our, in our nation's infrastructure, says Samantha Ravish, chair of CCTI. Much of the problem lies in how decentralized water systems are, she explained. Each of these systems operates in a unique threat environment, often with limited budgets and even more limited cybersecurity personnel to respond to those threats, she said. Conducting federal oversight of and providing sufficient federal assistance to such a distributed network of utilities is inherently difficult. So we really need to get our, you know, S-H-I together. Um, I, uh, on my other website, safer.me, put together an article that y'all can access, Storing Water for Survival. It's a couple years old, but, you know, the article itself stands today, uh, about how to store water, you know, storage barrels, uh, reusing your bottles, uh, bringing water to a full boil, uh, drink— you can drink pool water, actually, It's not ideal, but it's, it's doable. You need about a gallon a day. If you have dried foods that require water, you know, you need water. And then if you go to Amazon, right, hold on one second, let me show you something. If you go to Amazon and you search water tablets, so you have options. This right here is something that you definitely want to get. So the portable, uh, potable Aqua water purification tablets for $8.25. This is designed to basically purify your water. So if you get those 5-gallon jugs and you store them for a year or 2 or 3, you add these tablets to that water and it keeps it such that— so that it's drinkable. So it eliminates bacteria, viruses, all that stuff. Um, and you know, everybody should have this. I, I, at any given time have between 50 and 60 gallons of water at any given time that I continually recycle.

You need to have a little bit of that, not to be, you know, extremist, but a little bit of a prepper attitude regarding a lot of these things. Because when it happens, it's too— if you haven't prepared, if you haven't researched this and prepared, it's too late. Everybody at the same time is going to be looking for everything and you're not going to find it, right? Uh, here in, uh, Florida, for better or worse, we do have a little bit of a mindset when it comes to water. Because of the hurricane season, and people will stock up on a number of these things in advance because we're a little bit more prone to those types of things happening. But I think a lot of people really don't think of this outside of the normal, you know, hurricane season, that this could happen at any time, really.

Yeah, we're all about, you know, preparation. You know, if you fail to plan, then you plan to fail, as they say. I'm a full believer in that. And it doesn't take much, like $8.25 along with, you know, gathering— look at, you know, those, uh, 5-gallon water bottles that you— like a Poland Spring water bottle that you would like put on top of a bubbler. You could buy those for $25 on Amazon, have them shipped to you. And if you have like a friend or a neighbor that gets water delivered to them, uh, those water bottles, they don't generally recycle them, meaning like they throw them away. So like if you have a neighbor that like is throwing those things away all the time get a few, you know, uh, because you just put them in your basement, put them in your garage, and, um, you know, for free. Like, they're worth $25 on Amazon, so just grab a bunch, and I'm sure your neighbor will be happy to give you some.

Very good advice.

Yeah, and I'm, you know, thrifty, right? So, uh, this one I kind of don't like a lot at all. Scares the heck out of me. CDC raises monkeypox alert to level 2, recommends mask during travel. So I'm wearing masks on planes still. Uh, CDC warns that the disease has been most prevalent among men who have sex with men. Okay, um, that's it.

That mask is not going to protect you from that then.

Definitely not, right? But like right here, you know, like that right there is enough to say, yeah, I'm wearing a mask.

Yeah, they, they, I think a lot of this is more passed through very close proximity and maybe contact with the skin or contact with fluids, right? Compared to something that would be like the coronavirus that could be airborne and you could get that from a greater distance away from somebody. So I think the transmission, the risk of transmission is so much lower, but I mean, those pictures look awful.

Yeah. So the World Health Organization, we'll include this link in the notes, show notes, has all kinds of information about it. In this particular article, which was back the beginning of June, it says there was 21 recorded cases. I think that there is as many as 300 at this point.

Worldwide. Worldwide, no. In the United States, less.

Is that worldwide?

I think it's worldwide. I think in the United States, it's like 18, 19, 21. But I could be wrong.

Monkeypox, U.S. outbreak situation, CDC. Let's see if they have anything new. Um, I don't think they have a running number here, but, uh, look, it's enough to do something about it.

Yeah.

And to be aware of it and, you know, not to say, oh, it can't happen to me, you know, because close contact, that means like, you know, bodily fluids, right? And bodily fluids are on doorknobs, you know. Somebody sneezes, they touch a doorknob. They go to the bathroom, they touch a, um, you know, urinal or, or, you know, a handle. So, you know, wash your hands and don't touch your eyes or nose or mouth, you know, wear a mask and yeah, so that's that.

I mean, we've seen, you know, there's been an evolution of continuity of these sort of really bad diseases that are becoming, you know, worldwide and because it's because of the globalization, these things can easily spread everywhere and, you know, We've got to think, okay, are these— some of these are just naturally, you know, develop and spread, or, you know, are we in an age where it's also— think about it— in the age where biological weapons can be produced and utilized at some point, do we need to get into this mindset to be just more careful in general about how we conduct ourselves when we're out there in the general public and executing these type of safeguards that we have over these past couple years with COVID right?

Yeah. So the Fox article goes on to say that while not to the level of COVID-19, monkeypox has spread across the globe out of Africa since March. Symptoms begin as flu-like and expand to the swelling of lymph nodes and a rash across the body and the face. Ultimately painful lesions form on rash areas leaving severe scarring. Cases of monkeypox have been reported in Europe, North America, South America, Africa, Asia, and Australia, which essentially is, you know, there's like 5 or 6 of the 7 continents or whatever. Um, some cases are reported among men who have sex with men, you know, so, uh, that's obviously an issue there. All right, so, uh, moving on, uh, what to do when a cop asks to search your vehicle.

Very good question. Hardly anybody knows the answer to this.

So I read this article, and frankly, it's a little clickbaity, but it does have some good information in it. So if even if you've done nothing wrong, you have plenty to worry about, and you do, you know, because you— any, any sudden moves. Americans spend a lot of time in their cars, says Lifehacker. So it's not surprising, uh, to, uh, to the police that pull over a lot of us. About 50,000 people get pulled over a day, about 20 million cars every year. If you've ever been pulled over, which I definitely have, And based on those numbers, you probably have, you know, how nerve-wracking the experience can be. Put simply, police have all the power of a traffic stop, or at least they want you to believe they do. So when a police officer asks if they can search your car, it's hard to know what to do. So basically, it goes on to say, be polite. One of the most stressful aspects of a traffic stop is the power of disparity.— or the power disparity. While most police officers will conduct themselves professionally, it's paramount you not escalate the encounter by being angry or insulting. There are certain requests or commands you should absolutely 100% comply with. So number 1, produce your license, insurance, and registration when requested. Obey specific commands. If the police officer tells you to step out of the vehicle, you do it. And that's pretty much it. It says there are also things the police can do without your permission, like visually examine the exterior and interior of the— or visually examine the exterior of the vehicle and examine databases to see if your car has been reported stolen or if the registered owner, presumably you, has any outstanding warrants. Visually examine the interior of the car. If something is plain in sight, like a roach in the ashtray or alcohol, the police don't need further justification to proceed to do a search or an arrest. So they really do have all the power. So ultimately, you just have to be polite and you know, don't be doing anything wrong. No sudden moves, that's a big one, right?

Absolutely. But they can, uh, I mean, but they can say probable, you know, probable cause. They can pretty much search anything they want. And a probable cause could be your vehicle matches the description of a vehicle that's been reported in a burglary in the neighborhood, right? Right. I mean, how are you going to refute that? Or, you know, if they should come up with a probable cause like that Um, right, so pretty much to do what they want, right? And you're right, the biggest advice here is just cooperate politely and, and avoid any sort of escalation.

I would say, looking at the past decade, I would say on average I am pulled over biannually, once every 2 years. I kind of got a lead foot.

We all do.

Yeah, I kind of got a lead foot, um, you know, and I do a lot of driving. So the more driving you do, the more you're gonna get pulled over, you know. So yeah, and, uh, and, and what I do when I get pulled over is I actually have my, my hands on the steering wheel. So as soon as they pull me over, as soon as they walk up to the car, I put my window down immediately. I put my interior light on and I put my hands on the steering wheel. So when they walk over, they see the interior light on, they see my hands on the steering wheel, and I don't do anything until they tell me to. So hands stay in the steering wheel, interior light on, and then I'll get license, insurance, registration, all that stuff. I don't want to be digging around while they're coming up to me looking for that stuff. I want to wait for them to you know, tell me to do it, right? Because it's all about seeing the hands. They want to see your hands. Where are your hands?

Exactly.

Yeah, yeah. All right.

And I don't envy them in their job, especially— I mean, every time they're stopping the car, you know, their adrenaline level is probably also raised a little bit, right? Yeah. What can happen during this stuff?

Yeah. What are they getting themselves into, right? Are they violent? Are they some type of an offender? You know, so yeah. All right, so Peter, moving on, uh, last but not least, 7 NFT scams that could be targeting your brand or targeting you or that you could get involved in.

So what are NFTs? Not many people are familiar with those.

So not many people are familiar, agreed, but I think more and more people, it's coming up on their radar and they want to know what it is, right? So I did some research and The Verge talks about NFTs explained, right? So what is it? So basically, there's, um, uh, all right, what is an NFT? What does it stand for? Non-fungible token, right? And that doesn't make it any clearer, they say, right?

It makes it worse, right?

So non-fungible more or less means that it's unique and can't be replicated with something else. For example, a Bitcoin is fungible. Trade one in front of the Bitcoin and you'll have exactly the same thing. A one-of-a-kind trading card, however, is non-fungible, you know, like a one-of-a-kind baseball card. If you traded it for a different card, you'd have something completely different. So if you gave up a Squirtle, whatever the heck that is, and got a 1909 T206 Honus Wagner, which is— Stadium Talks calls the Mona Lisa of baseball cards— then, you know, you'd have one for the other. So non-fungible basically means it can't be duplicated. And even though these are digital, um, they are not replicable. So digital, you would think copy and paste, you would think it could be, you know, multiplied, but that's actually not the case with a non-fungible token. So it's the digital version of, say, a Mona Lisa that can't be copied.

So it's like, these are, these are assets, digital, digitalized assets, basically, right?

So how do NFTs work at a very high level? Most NFTs are part of the Ethereum blockchain, though other blockchains have implemented their own versions of NFTs. Ethereum is a cryptocurrency like Bitcoin and Dogecoin, but it's a blockchain, also keeps track of who's holding and trading NFTs. So All that being said, um, you know, more and more people are becoming victims of NFT-type scams. And so this article talks more so from the B2B level of like how your brand can be targeted, but there's some good info here for consumers as well. So it goes on to say that, um, NFT scams revolve around celebrity or brand impersonations, counterfeit NFTs, unprotected marketplaces. So putting aside the irony of relying on centralized players like a marketplace to execute decentralized transactions, these third parties can also introduce significant risk. Uh, there are 200 different marketplaces for NFTs, fake platforms, untraceable payments, cryptocurrency scams, text or email scams. So for your consumers, be aware of, you know, email, text scams where somebody's offering you an NFT for something specific. It's more than likely a scam. Uh, if you're interested in getting into the NFT game and maybe making a quick buck, I would suggest at a minimum reading this article, reading the article from The Verge, doing your own research, and not laying down any, um, Ethereum or Bitcoin until you fully understand what is going on here and what the risks are. Like any investment, right? And we're not invest— we're not, you know, providing investment type advice here, With any investment, you know, there's nothing guaranteed. And with these new NFTs, non-fungible tokens, even less so. Yeah. All right, Peter, so what do you got going on these days?

Well, doing— I just came, as I mentioned, came back from travel. And believe it or not, first time I had uninterrupted flights. The flights took off within 10 minutes of their their scheduled time and no problems with connections. I was amazed. First time in a long time, and I shouldn't brag about it, knock on wood. I know a lot of other people that are listening probably haven't had those experiences because there's been a lot of flights that have been canceled. But yeah, I was down in Miami one day and I had to be up in Minneapolis the very next day in the morning for a presentation. So I had these flights and if they were going to be delayed, it was going to be a disaster. But fortunately everything's worked out well. It's been nice to be in front of— in person, in front of audiences and having that connection, speaking with them. And then later, I'm coming up to during book signings and really engaging with them. I really love it. Gives me a lot of energy. So I look forward to additional presentations at conferences and training events. And I always want to keep on plugging my book. And I'm finding— fortunately, I'm finding even companies— the book I'm referring to, Confessions of a CIA Spy: The Arts of Human Hacking— companies, some of them have already even purchased these books to use as a training resource for their employees. So if you haven't picked one up yet, I encourage you to take a look at it because you might want to recommend it to family, friends, and/or your employer.

Yes. And, um, you could see me and my team online at protectnowllc.com. That's protectnowllc.com. Our e-learning is live. I am definitely flying and speaking. I head out again next week Um, I was actually part of, um, the Memorial Day weekend. 3,000 flights were canceled, and I ended up spending an extra day in San Antonio, which wasn't the worst thing in the world. It was actually pretty good. Uh, Father's Day weekend, Juneteenth weekend, 5,000 flights were canceled. So yeah, I feel your pain there. Um, yeah, any— anybody who's in, you know— so, uh, last words, look, just be nice to each other, you know, and, uh, stay safe out there. Peter?

Yeah, take care. I look forward to seeing you next time, Robert.

And please hit the subscribe button. Uh, thank you to all your new subscribers, and please, whatever platform you're on, please hit the subscribe button, and we'll see you again next time.