The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Wormka, how are you, Robert? Hey buddy, I'm doing pretty good. Uh, Merry Christmas, Happy Hanukkah, happy holidays. Uh, how's everything?

Thank you, likewise. Been a really, really busy season. I've been traveling quite a bit and looking forward to some downtime. Um, I would— I, I don't know if you know, I was just in— I think I mentioned it to you, this has been coming back from Las Vegas. Last week when I was there, when it was in the news everywhere about the gunman, the active shooter on campus. I was there when it happened, literally not that far away, and by the grace of God, he was put down by a campus police officer before he got to the area. I was in the student union and it was right next to Beeman Hall. Beeman Hall was the business a, if you want to call it the business class course, a department. And he went there apparently with a target, with a hit list, very disgruntled that he, he was a, he was a professor and had applied for a job there. He was turned down, and that apparently, uh, what triggered his decision to go in there and try to shoot a number of the faculty and staff members there in the business program. He killed 3 of them. A fourth one ended up in the hospital. I do not know, I think they are going to recover, but very, very surreal experience for me because I had never been in a situation like that of an active shooter and the fact that it was just like right there. I was in the middle of teaching a course. We had 12 federal Brazilian judges that were up and the course was, we decided to rent space at the university. And this happened right there at 12:45 when I was in the middle of my lecture. And we— there were hundreds and thousands of police officers that came into the area and they had to start, you know, clearing building by building by building. Ours was probably the one of the first buildings to get cleared because we were right there. We were in the student union on the second floor. If he had gone to the student union, he could have really killed a lot of people uh, potentially even including, uh, people in, in my, in my, in my group. But he went on to Beeman Hall because he had specific targets in mind. Um, but you know, it's just weird because if I look at— I was thinking about this, you know, for a few days afterwards, and probably if I were to look at this experience, probably a lot more potentially dangerous than anything that I had experienced in my 23 years as a CIA officer, 20 of those being overseas. It was that close. I mean, active shooter right next door, pretty much.

Yeah. Yeah. I think all of us at some point in our lives will come close enough to tragedy that we understand and recognize and appreciate risk management. Some people don't come close to it until, you know, later in life. Some people come close to it early in life. Some people are directly affected by it and in such a way where, you know, it casts a shadow over their lives in perpetuity, you know.

Yeah, you experienced the Boston Marathon tragedy, right?

Both my wife, my two young daughters at the time, uh, you know, I think they were like 5 and 9, uh, my dad, my sister-in-law, her girlfriend, uh, they were all at the finish line when the first bomb went off and the second bomb. Uh, I was just turning the corner from Hereford to Boylston when the second bomb had gone off. And, uh, you know, when you're running a marathon— I'm sure I've explained this before— The whole course, the whole 26.2 miles, is like one long tailgate party, which if you've ever been to a tailgate party at a sporting event, it's barbecue, you know, it's burgers and dogs. And so the whole time you're smelling that, uh, which is like a little bit torturous. And then when I got to Boylston Street and the bomb had just gone off, I didn't hear it, you know, because I had earbuds in and I'm listening to music in my time. And, uh, when we got around the corner, they stopped us. We're all like, you know, what are you doing? Why are you stopping us? And we were all just seeing the finish line and just wanted to go. And they had just started to barricade things, and they had just started to like prevent us from moving any forward. And we all just wanted to go. And so we're resisting the officials that were telling us no. And, um, ultimately, you know, I smelt it and I was like, what's that? And it was very sulfuric in its nature. And then I realized, okay, a bomb just went off. And that's when, like, I— my entire mindset changed and everything about what I wanted to do as far as getting across the finish line was gone. And everything that I needed to do was get to my wife and kids. So yeah, that affected me still to this very day. I'll, you know, it's, it's just something that stays with you. And when you come that close to evil like you did, it certainly, you know, makes you sit up and realize like what you have and, and ultimately what you need to do to make sure that like if this was to ever happen, you know, what, how would I react? How would I respond now and in the future? Mm-hmm. Yeah, yeah, it's nuts, you know. And, and that stuff is never going to change. We're always going to be affected in such a way where we need to know what our options are. And those of you who are here today, those of you who are paying attention, those of you who are taking the time, like, this stuff matters. Like, we're not here to like spread fear, uncertainty, and doubt. We're here to like just discuss what's going on out there in the world. And while our focus is, you know, that of security and being proactive and being prepared It's understanding and recognizing risk, you know, both in the physical and virtual worlds. And like, you know, like this stuff has been on my doorstep right here. It's on your doorstep. Like it's gonna be on your doorstep as well. Like whoever you are, if, you know, at some point in your life, you just need to know what is the appropriate reaction. Like, do you freeze up and, you know, put your head under the covers? Or do you take decisive action? Know, have a game plan ahead of time, know what your options are, whether it's, you know, protecting your identity, your data, your person, your family, you know, whatever, right?

Absolutely.

Yeah, yeah. All right, so, um, yeah, moving on, right? Uh, Peter, uh, this time of the year, uh, is, um, uh, a, a, a, a, a, a, a, a good time for bad guys, right?

Oh, this is the best time of the year for them. Really is.

It really is.

So check this out, right? Uh, look at this. Let me, uh, show you something here. All right, so Peter, nod if you can, uh, hear the video. This is, uh, theft of 4,600 gift cards in Braintree, likely part of a larger scam ring. Uh, police say the pair— this is a pair of women in this case— uh, are part of a larger scam ring that involves stealing the information off of valid gift cards repackaging them and returning them to their displays, then waiting for them to be purchased, activated, and then they drain the gift card. So gift card scams, Peter. Uh, this particular article was published on December 13th, which is just a few days ago. Yours truly is featured as one of the experts in the, in the video. So let's just watch it, Peter. As long as you can hear the video, nod.

A warning for really anyone buying gift cards this holiday season, scammers have found a new way to steal the value of the gift card even before you buy it. And now police say this coast-to-coast crime has landed in our backyard. NBC 10's Michael Rosenfeld joining us live from Braintree to explain how this scam works and to make sure it doesn't happen to you. Michael?

Yeah, Priscilla, shoppers have to be very careful. Two women from New York were arrested here in Braintree this week. They were busted right here at this CVS. Stolen gift cards, more than 4,600 of them, filling up plastic bags. This is what Braintree investigators say they found inside a car after employees at the CVS noticed two women stealing gift card after gift card. The suspects, both from New York, were arrested.

This particular scam has been going on for quite a long time. I've never seen it so organized before, where you have essentially gangs of people going in and stealing thousands of gift cards at a time.

Here's how the scam often works. According to police, thieves steal gift cards, tamper with the packaging to find the gift card numbers, barcodes, and PINs. They then repackage the gift cards and place them back on the racks and monitor them using a database. When a shopper buys the gift cards, the suspects are alerted and quickly drain the gift cards by making purchases online. The money is gone before the shopper even gets a chance to spend it.

I love gift cards. I think I think they're one of the best gifts to give, but every year there seems to be a different scam that people come up with in a different way to take the money.

Shoppers being warned to make sure they look at gift cards closely to see if they show any sign of being altered.

I'll definitely take a look at the back and make sure that, you know, uh, there's no numbers that have been scratched off or it's been open and somebody put it back. And, and, uh, and definitely be a little more careful.

In the Braintree case, the 4,617 gift cards or for Nike, Apple, Sephora, and Visa.

I usually worry about not having the value on the card, so typically I'm the person that keeps the receipt to make sure that, you know, yes, I put $50 on this card and here's the receipt to show it.

If you're buying gift cards, best bet is to purchase the ones that are behind the counter. They're more protected rather than the ones in the middle of the store. We're live in Braintree tonight. Michael Rosenfield, ABC 7 News. NBC 10 Boston.

So Peter, that is a relatively new twist on this scam that I was unfamiliar with, where they're actually taking the gift card off the shelf or off that, you know, center aisle like rack. Derek Hoff is keeping fans updated. And, um, they are essentially unpackaging the gift cards, scratching everything off, getting all the, the codes and stuff, and then repackaging the gift card Uh, and then once it's on the shelf, uh, and it's eventually sold, then the scammer in this case will simply go online and log in and see if the card's been activated. And if the card's been activated, they simply drain it by making purchases online, whether for other gift cards, uh, which is what they probably want to do, um, to turn that into cash eventually, and/or merchandise that they could resell. My guess is they're probably turning it— they're buying other gift cards with the gift card cash, or they're buying products at Sephora or products at Apple, or using those Visa gift cards to buy stuff, or again, buy other gift cards. Uh, yeah, the repackaging of it is something that I haven't seen yet, right?

And it seems to me what the stores are going to have to do is more and more of them are going to have to put those gift cards near the checkout or put us— put a camera right on the gift, you know, because I mean, a lot of these are located in areas where you're lucky if even a customer walks by you when you're at the gift card. I mean, it's— there's so much screening that most people would not even notice that you're doing anything. So you think they're actually taking them and like putting them in their pocket, going outside the store, or going into the bathroom, and then scratching off, repackaging them, and then putting them back on the rack? That's how it's going?

I think it's more than that. Because if you look at this particular story, it's, it shows two women, both of Asian descent in Flushing, New York, were each charged with shoplifting and receiving stolen property. I've seen a dozen articles about this since CNN, USA Today, and many of the perpetrators of this particular scam are of some form of Asian descent. Okay, which tells me some type of Asian gang. Okay, if they're all of a particular, you know, I guess, um, uh, a culture, uh, part of the world, then, uh, it's usually it's some type of gang-related crime. Uh, that being said, uh, uh, the sophistication of this crime— they probably are renting hotels and, uh, they're going back to the hotel room, they are scratching off everything, they're they're logging everything into a computer. I mean, they could be doing it in the back of a car, logging everything into a computer, having good records of everything, and then repackaging the gift cards, which would probably require them to be in a hotel room with, you know, heat, laminators and all that stuff, and ultimately put them back on the shelf. So that requires a little bit of time. I don't think that they're doing it right in the store. I think that, or even in the car for that matter, they're probably renting a hotel room, spending all night long in this process, and, uh, because they want everything to look right. And once you buy the gift card, everything's all scratched off, and you, not being any wiser, don't realize that there was something that needed to be scratched. Uh, you just see like those codes in plain text without, you know, being obscured, um, via the scratching, right? So, uh, yeah, and, uh, once that card is sold just refreshing that browser, they see that that card is now live and, um, they immediately liquidate that card before you even have a chance to give it away.

But even physical— I mean, if they do it, they're doing a really good job at it. Even a physical examination of that card, a cursory examination of the card, might not— you might not be able to see that it was tampered with, right?

Exactly. Because really, it's just like, it's either in a plastic or cardboard sleeve And just putting some heat to that cardboard sleeve, you know, lifting off the glue and then putting it right back together isn't really that big of a deal. You know, it's, it's, it's, it's, there's no, you know, mad science going on here.

It's just, you know, so there's not much recourse really because, I mean, unless the store will, I mean, give you back the, the money, which I think is probably problematic. I mean, you can buy it, I guess, maybe if you bought the card using a Visa, I mean, a charge card, right? A credit card. You might have a recourse through the credit card company.

Yeah. And I would imagine that the first thing the credit card— the first thing the retailer is going to say is, no, you just use that card and try to get, you know, trying to get some free money, you know, trying to steal back from us. But as the crime proliferates and there are more and more gift cards that are stolen in certain locations, these retail environments, they see a trend. The Visas and the Mastercards and the Sephoras and the Apples, they see a trend. When they see a number of cards stolen at one location, they realize, yeah, you know, there's this many people reporting fraud at this particular location, then it must be fraud. And so there are zero liability policies that kick in, and, uh, you know, they have their methodologies to detect what's called familiar fraud versus um, uh, actual, you know, retail theft. Uh, and so, uh, I would imagine that there are going to be more, uh, uh, systems in place to, to, to get your money back, but that's still— it's a risky proposition. And, uh, save your receipts, you know, at a minimum.

Oh yeah, yeah, yeah. I actually personally, I don't, I don't like gift cards that much. And at the end of the day, a lot of people, they won't spend everything on the gift card. And so these companies actually are are pocketing the money that, that is not spent. And I mean, they're making a lot of money on these things.

Yeah, yeah, yeah. I, I love gift cards.

I do.

Yeah, because I know what I want, you know. And, and unless you're my wife or my kids and I tell you I want this, uh, there's no way you're gonna be able to figure out what I want. Although I have received, you know, plenty of gifts that I have in my possession that I love. That I'm so glad that I got that were very thoughtful in their nature. But, um, you know, in this day and age, I'm just perfectly fine with a gift card because I know—

Robert, what's the difference between— what's the difference between a $50 Amazon gift card and giving you a $50 bill?

Uh, nothing. I would take the $50 bill. Yes, I know. Cash is of course king, as they say. So yes, gift cards, cash, as far as I'm concerned, same thing.

Yeah, yeah, yeah. Yeah, in any case, you need to watch out for this because this is happening a lot.

Yeah, it's a big deal. Okay, uh, a few other things, um, uh, real quick on this one. US alarmed as China hacks critical systems. What can you do? It talks about how China has made its way into critical American critical infrastructure, which we already know about this, without being detected for over a year. The known targets include a water utility in Hawaii, uh, on the West Coast, and an oil and gas pipeline The goal for China is to leverage a position over the United States to create chaos, cause panic, and disrupt logistics. So the article goes on to say, you as a small business or as a government agency, how can you protect yourself and your organization? And they talk about two-factor authentication, changing up passwords. Like, a lot of the vulnerabilities are in the humans that sit in the chair in front of the computers who aren't deploying two-factor authentication or are using the same passcode or easy to guess, easy to crack, easy to hack passcodes across multiple accounts. So as long as all of y'all do that, um, two-factor authentication, use password managers, different passcodes across each account, y'all gonna be good. Your critical infrastructures are going to be good. Peter, you're seeing this where elsewhere? Like Iranians are doing it, Russians are doing it.

What's going on?

Yeah, almost any, any country that has a sophisticated intelligence service is doing it. I'm sure, hey, I mean, I don't— I can't speak, uh, say this is sure, but I mean, the United States would have to be doing this as well against some of his adversaries, right? So China, United States, Russia, Iran especially. There's been reports over the last several years of the Iranians, Iranian hackers going into water, uh, treatment plants. I mean, hacking into them to probe, a lot of probes. Uh, there's been— hey, there was two days ago There was an article about the Israelis hacking into the Iranian— some of these service state gas service stations to pretty much bring them down, make them useless for a period of time. Uh, so I mean, it's, it's— this is happening. Uh, and what we have to hope is that there's never a real situation where we have a strong, uh, you know, a major, major, major conflict like a World War III where all of a sudden this stuff you're going to see unfortunately a lot of it happening because the technology there, they've happened, you know, a lot of adversaries who are creating this capability. So no surprise.

No surprise. Yeah. Okay. All right, uh, a couple things. Uh, last but not least, uh, Avast talks about are you sure that online store is real? You might be surprised. So a new trend in online fashion, an increase in counterfeit boutiques, understanding them, recognizing the signs. And take actions if you're scammed. So the surge in online shopping has unfortunately paved the way for numerous internet frauds. Cyber criminals are craftily establishing phony online boutiques offering an array of products from trendy apparel to high-tech gadgets and even occasionally pets. So I personally have seen more in the past year of fraudulent online stores popping up to offer too good to be true on whatever, whether it's you know, fashion items, electronic gadgets. In this case, they said pets as well. They talk about fake online stores pose a serious risk. What's even more alarming is the effectiveness of these scammers in drawing substantial traffic to their deceptive sites. They accomplish this through social media advertising and the use of unethical SEO, which is search engine optimization tactics, ensuring high visibility in search engine results for popular items. Peter.

So why, why is not some of these social media platforms who are paid for advertising do the minimal of vetting regarding the, the companies that are approaching them or the people that are, that are approaching them to, uh, you know, there should, there should be some minimum requirements, but it seems like they're by law they're not required to. So I guess that why should they, right? Take in the advertising revenue but no responsibility at all for, for posting, you know, these advertisements on their platform. And that's, that's part of the problem, I think.

It is part of the problem. There are two problems here, and I'm gonna, uh, elaborate on them really quick. So you're right, like social media, Facebook, Twitter, LinkedIn, those who are providing advertising, Google, um, all of these organizations that provide advertising, the for-profit entities it is in their best interest to accept those dollars even if the site itself is fraudulent. When you think about it, uh, why would they want to turn the money down for advertising even though they're supposed to? And they should be vetting the sites in which they are accepting money from to make sure that they are legit. And even like for me to post a Google ad, uh, they have to approve my ad before it goes live. And so you wonder what that vetting process looks like, because I know when I do my live presentations, I actually take users to different websites and show scammy, fraudulent websites that are selling scammy, fraudulent stuff. Like, literally, they're selling illegal stuff, and Google is accepting paid advertisements from these companies. You can see the link to that website as a sponsored result, which means Google is accepting money from them to pay for advertising to sell a scammy fraudulent product. And Google should know that.

Isn't that sort of— maybe we could call that money laundering, and then it could get— then we can get some traction into doing something about it, because it's just ridiculous. That won't change for a while.

Yeah. Now part of the other pro— the other aspect of the issue is like I consider myself a savvy, frugal shopper, which means that, number one, savvy, uh, when I want something, I'm pretty good at finding it, okay? And I'm pretty good at finding the best price. I like my stuff and I don't want to pay top dollar for it, so I am pretty good at digging deep and finding what I want at the right price, okay? It's often beyond the first two pages of search. So that might mean doing certain searches to find what you want. That being said, I also come across the scammy websites that sell what I want, uh, for a lot less. And so, for example, if I'm looking for a specific type of, heck, ammunition, okay, uh, there might be, uh, you know, a bunch of websites selling it, but it also might be out of stock at a lot of websites because, you know, it's in demand. And so the deeper I dig, the more I find, uh, the more websites I find for this specific ammunition that I want that is now, um, on this website that is a really good website. Everything about it is, you know, looks legit. But then when I go to the checkout, uh, to the, to the cart, they want me to pay via Zelle or Venmo or Bitcoin. And I'm like, no, that is fraud. Okay, I do a quick search on the name of the website, scam, right? Name of the website, the word scam, and immediately I'll find like a Reddit forum that talks about the particular website, and it shows other guys, gals, that have been scammed at a particular website. And you find websites that their job is to flesh out whether or not a website is scammy or not, and you'll often see, yep, that website is in fact a scam. And then I'll also find other websites that accept credit cards, and I'll do the same search for the name of the website and the word scam, and I won't find anything that says scam. But I might find on Reddit, let's say, uh, a forum that others have had good luck with a particular website, credit card or no credit card, Bitcoin or no Bitcoin. You do that search for the name of the website, the word scam, uh, and you're gonna find you're going to be able to crowdsource your security intelligence on whether or not others have had issues or they've had success.

Yeah, another thing you might consider doing is a lot of these scam sites don't have a real physical address, uh, or they might have a phone number, but it's easy to put a phone number up there, right? But an address they might not have. Uh, so if they don't have an address, that's a big red flag, and you might You might want to anyway do a Google search on that address and see what pops up. Um, agreed.

All right, Peter, tell everybody, uh, what you're up to these days.

What I'm up to is I'm preparing some materials for early next year. I got a number of things happening, but, uh, trying to also spend more time with the family in these days coming up and looking forward to it. And I want to put a plug in for anybody, any of these last Minute Procrastinating Shoppers. Why not? Got that book that's available for your, your parents or any other individuals in your, in your family that might be getting up there in, in years, or maybe even for yourself. And then the other book, uh, my original book, Confessions of a CIA Spy: The Art of Human Hacking. Very good reads in paperback, Kindle, or even in audio version.

And your website URL, Peter?

Yes, counterintelligence-institute.com. Okay, you can also find me on LinkedIn.

Nice, nice. Thank you, Peter. And, uh, y'all can see me at protectnowllc.com. We are running some continuing education training for a number of cross-industries, uh, real estate agents as well, uh, in January, February, and March. Check us out at protectnowllc.com. Peter, last words?

Hey, have a great holiday season and be careful with the fraudsters, even though You know, they want to get their money as well, but you want to donate to them or what? Take care of yourself, take care of your, your, you know, your family and friends, and have a good time.

And as my dad says, uh, you know, be good, behave, and be careful out there. All right, you guys, uh, happy holidays, uh, uh, Merry Christmas, Happy Hanukkah, Happy Kwanzaa, and we'll talk to you soon.

Bye-bye.