The Security Guy and CIA Spy PodBroadcst

Welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka from sunny Orlando.

How are you doing up there?

In Boston, uh, doing good. Uh, it's getting warmer and, uh, I am sorry, uh, 12 days into COVID. What?

Are you serious?

I finally got it. Yes, I, I had not had it since everybody in my house got it and I got it on a recent business trip. And, um, the, the, the cough thing is still, you know, in my chest But I didn't get like really sick. I got like a couple of days of aches and pains, no fever actually, uh, and then, um, you know, tested and here we go. Uh, but yeah, from traveling, you know, I got it probably, you know, the last gig that I was on, flying and all that fun stuff. And, uh, so, you know, yeah, but I, I, I tested negative a couple, 3 days ago, but I still have the, the, the, the aftereffects of it.

But, you know, uh, that's a good reminder. We don't hear much about it anymore, but, you know, there are still quite a few cases out there. Maybe not quite as— thankfully not as severe as when they first came out. But, uh, these are things that you can easily pick up. And you're right, I think out of all the things that can happen where you might pick this up is travel, getting on airplanes.

Yeah. And whether or not my previous vaccinations— because I got vaccinated— whether or not my previous vaccinations helped me, I don't know, uh, whether it's the same strain or not. I'm glad I did. Uh, but you know, um, it's, uh, it's, it's, I guess it's the flu, and it's, uh, it wasn't awful, but you know, I survived it.

Well, I'm glad you're back. I'm glad you're back. You're doing better. So how are we doing here? What's going on?

So man, we got all kinds of fun stuff to talk about. Like for example, Gizmodo talks about stop using your face or thumb to unlock your phone. So this is kind of interesting. So the laws surrounding Fifth Amendment protections, and I'm often asked by my audiences You know, should we use our thumbprint? Should we use our face to unlock our phones? You know, can it get hacked is generally the concern, you know? And I say, look, you're gonna have a hard time— a bad guy's gonna have a hard time hacking Apple to get access to your thumbprint and/or, you know, face recognition. And then the other question is, you know, can somebody just use a photo of me to unlock my phone and so on? And the answer is generally no. That facial recognition requires 3D, you know, and so a face on a photo is not necessarily going to bypass, you know, facial recognition on your phone. But there's a concern in here. The laws surrounding Fifth Amendment protections of biometric passwords are still undecided, so just turn it off. So it says, last week, the Ninth Circuit Court of Appeals in California released a ruling that concluded State Highway Police were acting lawfully when they forcibly unlocked the suspect's phone using their fingerprint. Interesting. You probably didn't hear about it. The case didn't get a lot of coverage, especially because the courts weren't given a blanket green light for every cop to shove your thumb to your screen during an arrest. But it's another toll of the warning bell that reminds you to not trust biometrics, to keep your phones and sensitive info private. In many cases, especially if you think it you might interact with the police at a protest, for example, you should seriously consider turning off biometrics on your phone entirely. So, hm, you know, somebody who's deceased or knocked unconscious, their phone could be opened with, you know, their face and/or their fingerprint, you know, one of 10. So that is certainly a concern, whereas your passcode cannot open up your phone. Peter, what are your thoughts?

Well, it's interesting. I mean, I'm— I think I'm not going to be— me personally, concerned that I'm going to have the police opening my phone because I've been arrested. I mean, hopefully not. But that being said, I think, uh, and I have— well, probably most of us, you know, we use the combination of having the passcode or we're using the biometrics, or, uh, and it is a convenient feature. My concern, probably more so, are there's still individuals out there that once they unlock their phone, they probably, they probably leave it open the entire day and don't have the timing out of the feature, right? I think there's some people that, you know, I think you need to really be careful and have that phone timeout, uh, within a, you know, whether it's 2, 3, 4 minutes and not let it go the entire day. That's probably a bigger risk to people.

So my phone times out after 60 seconds, 1 minute. And I use facial recognition to unlock my phone. And I'm going to continue to using facial recognition to unlock my phone too. Certainly, the password, 4, 6, 8 characters, whatever it might be, digits, is definitely more secure. It's something that you know versus something that you are. And so something that you know, can't be taken from you if you are unconscious or deceased. Something you are still can be. And law enforcement, even if you're not, you know, deceased or unconscious, can forcibly utilize a fingerprint in or your face. So that issue is in fact an issue of convenience and of course security and privacy, but it's that convenience that utilizing that methodology of access control that, you know, is vulnerable. But, you know, I'm going to keep doing it. If you are what might be considered, I guess, a high-value target, then you might want to consider just using a passcode.

Right. I mean, it's good to know. It's good to be thinking about these, you know, what's the downside, right? And it definitely is a downside. I mean, I've usually used the facial recognition. I mean, actually more so the thumbprint, but having the code as a backup is good to have. Because I've had to use the backup many times.

I think that if you are what would be considered a high-value target, like maybe, you know, a form of a politician, a significant moneyed individual, celebrity, and so forth, then I think that a password would probably be the most secure form of access control. Whereas fingerprinting and biometrics are really just a form of convenience. The technology itself I would consider secure, but it's the way in which you are coerced to provide that authentication would be the issue.

You know, I'm surprised that they haven't developed yet, um, for unlocking your phone, uh, voice recognition. That's even more convenient because you don't even have to be— you don't even have to touch the phone. I mean, you can be using voice recognition at a distance away.

Yeah, and voice recognition is being— is in the process of being decimated with, um, AI, uh, and AI of voice cloning. Uh, that is a huge concern, which I saw recently, I think it was Citibank was duped, um, in a test run with, uh, an AI voice clone.

Yeah, easy.

Yeah, yeah, scary. So, uh, moving on, uh, Bleeping Computer, which is an actual publication, I talked about dark web monitoring and what's the value. So, uh, the term dark web conjures up images of shadowy netherworld of cybercrime, espionage, drugs, and guns. In reality, dark websites are are simply websites ending in .onion that need to be accessed through a special browser. Cybersecurity firms have long sold dark web monitoring packages, with each package meaning something slightly different. And in many cases, practitioners have struggled to find value in monitoring the dark web, particularly where a vendor sells them on a comprehensive package that— but doesn't align the value with the organization's security needs. So what this is for, for most of you, because I get I get actual emails and text messages from friends, colleagues, clients all the time saying, hey, I just got a dark web notification that, you know, my information, my email address, my Social Security number, my, you know, my information is in the dark web. What do I do? Like, I'm freaked out. And that's primarily what dark web monitoring does for companies that offer it, is it sells fear, uncertainty, and so on that gets people in a bit of a tizzy. Okay, and that tizzy is what gets them to buy or continue to, uh, you know, pay the monthly monitoring fee, whatever their product or service might be offering. Now I'm all about like knowing that your information is out there, but okay, so it's out there, now what? What do you do about it? What are the repercussions of it?

Exactly.

What are your thoughts?

No, I absolutely agree with you. I wonder, you know, several years ago when I first got into, you know, these topics, I would, you know, try to educate individuals about how careful they have to be and what types of information they share and how to protect their information, which I still do. But now there's been so many breaches that are completely outside of individuals' controls where our PII information has been breached and is out there. So you can practically assume, you should assume that your information has been breached and it's out there. And now based on that assumption, how are you going to protect yourself from someone using that information against you? What are some of the red flags? What are some of the precautions that you need to put in place so that bad people don't use that information successfully against you? But just assume that is out there, right?

So I've had criminals email me my Social Security number. Hey, security guy, here's your social. Haha, gotcha. Whatever, you know, I care less. I have identity theft protection, I have a credit freeze, I have credit monitoring, I have 2 or 3 layers of— or 4 or 5 layers of protection, you know, or, or that alert me to any activity in regards to if any new accounts are being opened up, which is which is unlikely because of a credit freeze. So the idea is, is to first and foremost know that it's likely your identity has already been stolen, is what I tell my clients. Meaning that you may not have necessarily suffered any financial harm, or even, you know, any fraud for that matter. But when I say your identity has been stolen, it's likely in the hands of a criminal as we speak. They may not have just got to you yet, or because you have systems in place to kind of make the data useless to the thief, That's the goal. That's the idea. Making the data useless to the thief means even if they do have your Social Security number, you have a credit freeze, you have identity theft protection, you have credit monitoring. They really can't do much with it because you have essentially vaccinated your identity with, you know, various systems in place— credit monitoring, identity theft protection, and so forth. Same thing with passwords. Even if they have your passwords, because you should have multiple, as long as you have two-factor authentication on all those all those various accounts, they would have to have your mobile phone or whatever key fob in their possession in order to access that account, you know. So making the data useless to the thief in regards to passwords is either changing them up, but more importantly, having two-factor authentication for all those critical accounts.

Yeah, the, uh, the point is basically you're making yourself a hard target. You're hardening yourself in such a way that criminals are only going to go so far. When you make it difficult for the criminals, they're going to move on to easier targets because there's plenty of easy targets out there. So if you make yourself a hard target, you really have, you know, shouldn't have to be so worried about these things. Yeah.

And even if they have your name and your address and your phone number, so does the White Pages, you know, so does every government agency out there that you've ever done business with. So does, you know, every company that you've ever provided credit card information to and so forth. You know, your, your personal identifying information, your PII, isn't all sensitive information. It's just, it's often public information. And even if it's sensitive, like a credit card number, or a, a, and with the credit card number, you can't protect a credit card, but you can monitor your charges, get push notifications, and refute those charges as they occur, if they occur, and so on. So it's a matter of making the data useless to the thief, or just simply living with the fact that, yeah, My information is out there. Big deal. As long as I'm on top of it, getting these various notifications from these various services that push out that notification to me and so forth, then I can just, you know, be aware of it. But don't get freaked out because your data was found on the dark web.

Big deal.

Absolutely.

Good points.

OK, good. All right. So here, Daily Mail talks about Russian cyber attackers hack Texas Panhandle drinking water and flood town in first ever raid by Kremlin-aligned group. So, uh, here's what they did. Um, it says Russian hackers claiming to be backed by the Kremlin are believed to have remotely accessed the Texas town's water tower. The suspected hack in the Texas Panhandle town in January will be the first-ever disruption of a drinking— U.S. drinking water system by Russia after Iran and China carried out similar attacks. The hack, um, led to the tower overflowing with thousands of gallons of for almost an hour, leading to a state of emergency to be declared. So what's freaky about this is that it's, you know, possible, right? The fact that there was some type of a control of sorts that was probably using a default username and passcode, potentially a username being admin and the passcode being passcode that wasn't changed up. That's a possibility.

Yes, it is.

Or the system itself was remotely targeted and hacked in such a way where there was a vulnerability in the hardware or the software that allowed backdoor access, or an employee on the inside was socially engineered providing credentials. It's one of those 3, potentially 4 or 5 things, you know, it could have been, um, a couple of other things we're not going to get into right now. But it's like, the fact that something like that is possible today is a real problem. And there are hundreds, if not thousands, of municipalities across the country that control their own, uh, water, their own water and sewer, uh, for cleaning it, for distributing it, and so forth. That, um, it's that scattered approach to security and that they're not making the necessary investments in their information technologies that make them and many of us vulnerable.

Yeah, I absolutely agree. I think this is more widespread than most of us would believe because I think this has been going on for a number of years right now. The water is part of the critical infrastructure of the United States. And if you think about it, in some ways it's even more critical than electricity. We could survive a while without electricity. It can be chaos. But if we don't have water, that sustains life. And we've had a number of adversaries. And we've heard from— it's been reported in the news that there's been a number of water treatment facilities that were penetrated by the Iranians more for probing, uh, sakes. And so probing that in the event that there would be a serious, uh, conflict between the United States and one of the adversaries, that they could hit us in some of these critical areas such as the water. And so there's no doubt that there's plans on the shelf, because when you're going to attack a target, you're not going to start then to look at you know, the vulnerabilities, you're going to put— you're going to study those in advance and put those plans on the shelf. And we know that over these last years, some of these municipalities have been hit, hard hit by ransomware attacks against these facilities. A lot of this hasn't been reported, uh, and so they've been hacked and ransomware attacks. Now the interesting thing is though, why did they actually put this in your field? Why would this Russian group all of a sudden, like, put this in your face. Gotcha. You know, we were able to do this. You know, what's the motivation? Is it more like just, you know, them having fun, or she was like warning us, hey, we have this capability, don't forget? I don't know motivation behind disclosing that, right, or making it so obvious.

I, I think it's terror. I, I think they want us to be fearful. I think they want us to be divided. I think they want us to be broken. I, I don't know that China and Iran and Russia want us to be completely in the dark and disabled and be completely like, you know, uh, back in the Dark Ages, because there's so much commerce that goes on between the countries, uh, that they, they, they, they have so much to benefit from. But I, I do think that they want us to be broken in such a way where, uh, we don't trust our government, we don't trust our politicians, we don't trust in general, and that, you know, we're divided, uh, and fractured. And the more fractured we are, I think, and the stronger they are, I, I think that their, their, their own people look to their own governments as, oh, we're, we're so much better off than the Americans. I think that that's a, a significant primary goal for them.

Yeah, I agree. But haven't there been other incidences of things going down and without really a good explanation about how, why they happened? I mean, I, I I'm just thinking of it off my top of my head, like major cell networks all of a sudden go down for an entire day and there's no really explanation later on what was the cause of that. Uh, there was also like air, air traffic control, right? Uh, about a year and a half ago, and all, you know, these whole networks going down without any explanation about why it happened. It's kind of—

I do think that in, in some of those circumstances it's, it's actual, you know, just failures of our own technology., that, uh, at some point, you know, may or may not have been disclosed, but they just didn't necessarily make the news. Uh, but I do think that there are, you know, still many situations where stuff just stops working, stuff breaks, you know. All right, so, uh, last but not least, uh, Bleep the Computer again talks about T-Mobile, Verizon workers get texts offering $300 for SIM swaps. So check this out, Peter. Criminals are now texting T-Mobile and Verizon employees on their personal and work phones, trying to tempt them with cash to perform SIM swaps. The targeted employees have shared screenshots of messages offering $300 to those willing to aid the senders in their criminal endeavors. According to many reports, this is part of a campaign targeting— targeted at current and former mobile carrier workers who have access to the systems required to perform SIM swaps. Myself and a group of former employees all got the same message, all from different numbers and with different verbiage, one of the targeted people said. The attacker's message claimed the source of the contact information is employee directories, as first spotted by the mobile report. I got your phone number from the T-Mobile employee directory. I'm looking to pay someone up to $300 per SIM swap done. If you're interested, reply and we can talk, the criminals say in the messages. So at some point, the T-Mobile employee directory was either, I don't know, posted online or stolen by an insider, by an employee, or it was hacked in some way, leaked in some way, a misconfigured server. It was found in some way. But, you know, gaining access to insider information, who the employees on the inside are, an Excel file, whatever that might be, I think would be, you know, a significant benefit to the bad guy, knowing who the players are on the insides and making those offers for $300 for a SIM swap. You know, that employee who, uh, can, you know, I guess facilitate 10 SIM swaps a week, that's $3,000. That's, you know, lots of money, uh, $12,000 or so over the course of a month. The employee who's making $18 an hour, why wouldn't he?

How easy is it to detect that? Or to, you know, now knowing that there is this problem or potential problem, if they were to take a look at it, you know, AT&T or Verizon were to look at this, how easy is it? Is it really, really difficult or impossible to detect who might have done this?

So I've actually been involved in a legal case with one of the, or two of the telcos actually, where I was an expert witness and discussed how this happens and how people are victimized. And it is often somebody on the inside at either one of the big companies themselves, you know, the T-Mobiles, AT&Ts, and Verizons of the world. But more than likely, it's actually one of the resellers. It's somebody on the inside as a reseller who's approached, uh, to make these SIM swaps. And that, that person could be offered, you know, $300 to $1,000 or more. Uh, and in the case, one of the cases that I was on, they ended up transferring out over $20,000 worth of crypto out of a Coinbase account, which is pretty significant, you know. And as those with crypto accounts are being targeted, it's usually, in this case, it was a result of their email initially being compromised. And we saw when an email was compromised, it's often because they're using the same passcode across multiple accounts and/or because they were phished. And once the bad guy was inside their email and saw that they have a Coinbase account, then from that point on, they begin to, um, uh, determine what's necessary to get inside their actual 'Coinbase account.' And when they realize, okay, well, you know, they have a username, they have a passcode, they have two-factor authentication, now we have to swap out their SIM to be able to get control over their mobile phone so we can get that second factor text to us, so we can then log into their, uh, Coinbase account, and then from there, you know, make the swap. So there's a number of things that have to happen in order to get paid, but accessing $20,000 of crypto based on a SIM swap, that's the key to get in. And it's the employee on the inside of the organization, it's the reseller who might even own the company. It could be an employee inside the company that facilitates that SIM swap that overrides— ultimately overrides two-factor authentication, that becomes the point of contention, that becomes, you know, the key to the kingdom essentially. Uh, and yeah, I mean, that's the— those on the inside that are, are made these offers, the incentives are just so great for them to say no. Yeah, that's how it works. Yeah. So Peter, uh, what do you got going on?

What's going on?

What can people find?

Well, a lot of things are starting up here now, especially during May, a lot of travel, unfortunately, good things as far as conferences and educational events where I'll be presenting. And hopefully I'm not going to catch the COVID Hopefully, be safe traveling. But yeah, we're all headed like more toward October when it's Cybersecurity Awareness Month. So if your companies are looking for engaging speakers like myself or Robert Siciliano, please keep us in mind.

Uh, your website, your website.

Yes, counterintelligence-institute.com. I'm also on, on LinkedIn. And, uh, my books, my books. Yeah, Confessions of a CIA Spy in English, Spanish, and Portuguese. And the follow-on book, Why Are You Messing With Me? It's in English. And, uh, great book if you're looking for some, some materials to give to your loved ones, your parents and your grandparents.

And y'all can see me at protectnowllc.com, also on LinkedIn. Uh, we're of course providing ongoing cybersecurity awareness, cyber social identity, and personal protection training. And, uh, Peter, last, last words.

Everybody stay safe out there, take care of each other, and don't forget that COVID is still lurking.

And as my dad says, be good, behave, and be careful. Talk to you guys later.