The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Wormka.

Robert, how are you?

Hey buddy, I'm doing pretty good. Uh, yeah, where are we? We're, uh, May-ish, May 15th-ish. Uh, good. Uh, anticipating, uh, you know, a warm, hot summer. Hoping to do some boating, spend some time with the kids, a little bit of downtime. Still have to work, which is fine. How do you get—

wait a minute, how do you get downtime? This is good. Things are crazy, Robert.

We're never—

we're never going to be able to even retire. I mean, no, literally talking about this before. It is just amazing how the fraud is rapidly increasing and there's so many threats, especially now with AI. I'm finding that we're losing this war and it concerns me because a big part of this is public— first piece of this is public awareness. I'm finding that so many people still remain so unaware of these threats and I'm getting Sincerely, getting really concerned, man.

I, I agree with you 1,000%. Uh, it's, it's without a doubt AI has amped up fraud in such a way where, uh, it's likely that everybody is going to fall victim to something, you know, whether it's, um, national media and there being some type of a video or audio or something that one of the major news, uh, news organizations is, is scammed by, therefore they present it to us and we're scammed by it, uh, based on something from a nation-state, you know, a Putin or Xi or something that, that deepfake puts out there that, you know, convinces us that a nuke is coming, anything. Like, it could be anything. I get it, right? But listen, like, here's what I tell people. Don't worry about any of this stuff, but we got to do something about it. Like, inaction is your greatest enemy. Sitting by and doing nothing is, is, is the problem. And too many people just don't want to believe that these things can happen to them, or that we even have a problem for that matter. They would just prefer to function in denial. And that's the biggest issue that most of us face, is that we trust too much and we don't know.

Robert Siciliano.

Happen to us.

With you and I, you know, are really serving the role with a lot of us as educators and trying to create this awareness and helping, helping to guide, you know, we helping to guide individuals. And, and the first part is understanding. I just came back, I was in Hershey, Pennsylvania, uh, yesterday. What a great place, Hershey, uh, especially if you love chocolate. Anyways, I, I was at the Hershey Country Club, which was the venue for a conference of over 100 certified fraud examiners from Central Pennsylvania. I'm also a certified fraud examiner. It's a great group of fraud fighters. And my presentation was a 4-hour-long presentation on— in regard to AI and basically the AI threats, and as well as what tools there are out there that can help us combat some of these threats. And what really amazed me is, I mentioned this is a very professional group, and I was just amazed by how little most members of the group knew about AI in general as well as AI threats. So I mean, if this group at this level, professionals, are not really that attuned to it, means that the general public is even further behind. So we got our work cut out for us.

Yeah, it's scary. But, but getting back to the original question, downtime— like, when I— dude, I, I, I still need to turn it off.

I know, I know.

I mean, I need to turn it off because this stuff is nuts. And so getting out in that boat, wind in the face, salt water in the air, you know, uh, chugging on my favorite adult beverage, whatever that might be, and, um you know, heading into Boston Harbor or any of the Boston Harbor Islands or any of the great beaches we have in the New England area, it's like, okay, all right, all right, I, I gotta decompress.

I guess this is— you see how I decompress? I'm having lots of java, a lot of coffee. Uh, it's getting me overly excited about, about these topics and I just can't relax, dude.

But check this out, and there's, there's plenty of reasons not to relax. So check this out, this is via, um, The Guardian. And we're— I'm seeing this more and more and more on, and it's becoming more frequent. CEO of the world's biggest ad firm targeted by deepfake scam. So fraudsters impersonated WPP's CEO using a fake WhatsApp account, a voice clone, and YouTube footage used in a virtual meet. So it goes on to say that the head of the world's Biggest advertising group was the target of an elaborate deepfake scam that involved artificial intelligence voice clone. Uh, the CEO, his name is Mark Reed, detailed the attempted fraud in a recent email to leadership, warning others at the company to look out for calls claiming to be from the top executives. So fraudsters created a WhatsApp account with a publicly available image of Reed and used it to set up a Microsoft Teams meeting that appeared to be with him and another senior executive. According to the email obtained by The Guardian, during the meeting, the imposters deployed a voice clone of the executive as well as YouTube footage of them. The scammers impersonated Reed off camera using the meeting's chat window. The scam, which was unsuccessful, targeted an agency leader— so somebody in the company that, you know, had the ability to pull some strings— asking them to set up new business in an attempt to solicit money and personal details. Fortunately, the attackers weren't successful, Reed wrote in an email. We We all need to be vigilant to the techniques that go beyond emails to take advantage of virtual meetings, AI, and deepfakes. So without getting into the weeds here, what, what it seems like is that there were too many red flags in this particular scam, meaning like it was kind of like a haphazard attempt at utilizing photo and video and YouTube and text in chat, and it just wasn't successful because they were just— it wasn't well thought out, well planned out. The scam itself wasn't that effective because they just didn't do a good job. But look at this, right? Deepfake scam. Scammers walked off with $25 million in its first of its kind AI heist. This is back in February, so not too long ago. The incident marks the first of its kind in Hong Kong involving a large sum of money and used deepfake technology to simulate a multi-person video conference where the participants, except the victim, were fabricated images of real individuals. The scammers were able to convincingly replicate the appearance and voices of targeted individuals using publicly available video and audio footage. The Hong Kong police are currently investigating the case. With no arrest reported yet. I believe since then a bunch of people were arrested. So the $25 million, and they were successful at it. He was convinced that these were colleagues, that these were real people. And in a sense, they were real, other than the fact that it was AI-generated real people. And, uh, he fell for it, which, look at We have grown to trust audio. We've grown to trust video. We've grown to trust the printed word, text, video, audio. And why wouldn't you, you know? Because after a lifetime of trusting— my mother would say, trust nothing of what you hear and half of what you see. And at this point, you can't even trust what you see, or anything you hear, or anything printed for that matter.

Well, this is a really interesting development because, you know, we've heard about the pictures being created, you know, uh, deepfake pictures. We've heard about the, you know, cloning of the voice. And here, and now we get a combination of the two, which is even more convincing, right? You're hearing, you're hearing the CFO who was there, I mean, who was in this video, in the Zoom, uh, I think it was Zoom, right? Was it a Zoom platform?

Something to that effect. Yeah, they're using Microsoft Teams, they're using Google Meet, they're using Zoom, they're using anything and everything that they have access to that's free to small fee to free.

At the end of the day, we can't prevent these things from happening. Uh, in the case of the first one with the CEO, I mean, kudos to them in regard to at least there were people that had that certain level of awareness that they call it the red flags. Probably in other companies, if the same thing would have happened, uh, it could have been very detrimental. But at least they were able to detect something was wrong and investigate it, and then even further, being able to report or bring it to the light of the public, saying, this is what happened to us, which is so important because I think there's, you know, there's hundreds of these happening every day, and, and companies, but no one's talking about it. And I think more and more, and so people don't realize that these things are happening. So providing those testimonials is very important. And I think even more than looking at, we can't prevent these attempts, but we can take action about whether or not we are going to respond to those attempts in such a way that we comply with them versus verify, have having— building in a verification system, whatever it may be, and it's gonna be different types of verification systems. That's where I think where the focus really has to be, uh, in combating, combating becoming victimized.

So right here, SC Magazine, just in the past month, talks about LastPass for its attempt to deceive employee with deepfake audio. So a LastPass, uh, employee was targeted by a deepfake audio call earlier impersonating the CEO, but because it was done via WhatsApp, which isn't a normal channel that, that WhatsApp— that LastPass employees use and not part of the normal business communication, the employee didn't fall for the scam. So again, poor planning on the part of the scammers. An employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating the CEO. Due to the employee's suspicion regarding the presence of many of the hallmarks of the social engineering attempt, such as forced urgency. Our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally. So great for the Yahoo— for the LastPass employee for thwarting the attack, for recognizing that it's fraud, and at the same time for LastPass, you know, coming out and saying, hey, this is what's going on. So between the Hong Kong company LastPass, this, you know, the largest ad firm in the world, That's— those are just the ones that we're hearing about.

Exactly. You know what, uh, the fact that the, that the first thing that comes to my mind regarding their use of WhatsApp is because it is very, very popular in certain countries overseas but less popular in the United States as, as a communication tool. So it probably was, you know, like we would suspect with a lot of these coming from overseas.

Yeah, absolutely. Now check this out from, um, our favorite publication, The Sun. Not exactly credible, but still they put together decent stories. Uh, don't speak— why your voice is no longer safe on social media as AI clones mimic speech to deceive family and break into bank accounts. Okay, so, um, AI voice clones that can trick family and break into bank accounts are already a threat, experts warn. Cyber thieves have are increasingly scouring for clips of people's voices on social media to mimic them in potentially devastating scams. Easy AI tools make it super simple for fraudsters to rip off a person's voice with little technical knowledge. And one of the easiest, safest places for them to look for audio of you speaking is on social media, such as Facebook, Instagram, LinkedIn, YouTube, whatever you're on. AI-generated voices are already a threat to personal identity in at least two contexts. That includes, first, the voice can be used to breach speaker verification software. In order to first gain access to systems such as bank accounts, so spoofing biometrics. Further, AI-generated voice could be used to deceive other human listeners. The technology already exists to produce speech which is indistinguishable to most listeners in best-case scenarios, but there is still a lot of variation in the quality of AI-generated speech. I'm going to dispute that. Just very recently, I was listening to an AI-generated voice that CNN put out there via ChatGPT, which isn't ready for prime time yet, or at least it's not being deployed to the masses. And they put together a 15-second clip of a guy who had a pretty, you know, I guess, distinguished voice. And then they put together another 15 seconds of an AI-generated voice. And man, I don't care what you say, I couldn't tell the difference. In a million years, I'd never be able to tell the difference. Like, It was perfect. It was perfect.

Yeah, they are perfect. And I think even if there were slight, you know, variances, when a grandparent or a parent gets this telephone call and, you know, it's referred to them by, you know, like their daughter Emily or their son, whatever, you know, and they hear help and they hear this distress, you know, they're not thinking, well, the qual— you know, the, the quality of the, the voice is not quite— I mean, could be any kind of distortion in the line. So people are not even thinking about that. They're, they're in a totally different state of mind that they want to help. You know, it's fear. The fear, you know, if they don't do something, if they don't send this money, something bad is going to happen. And that's emergency scarcity. Yeah, scarcity of time. You know, the, you know, they got to do something right away and they got to send it to, to help their loved one. You know what I— what this article though says about getting the sampling of the voice from social media, I'm I think that's minimal because you can find people that have their, you know, their, their video, like young kids having their videos and stuff online. But I think the way I, the way I would do this if I was a bad person would be I would be getting on social media and looking at Facebook and looking at the elderly, looking at people that, that I can identify, the grandparents. I can identify that they have money. Then I can probably see from their social media, identify their children and their grandchildren. And then, you know, then I can look at the grandchildren, let's say, and learn about their pattern of life and what they're doing, you know, where they go and this and that. So that when you develop a scheme to call the grandparent, you already know the name of the child, you know their pattern of life, and you can include things about them that, you know, you've been able to gather from social media that the parents or grandparents say, oh, that's definitely my, you know, my kid. Then getting the voice is very easy. If you have the telephone number of the child, you call that number and you can get a voice sampling of whatever it is. I've heard 3 to 5 seconds, I've heard 10 seconds, but that's not much time. That's all you need. You can get them on a phone with a very brief conversation or at least getting to say, "Hello, who's this? Who's this? Can't hear you." Or it goes to voicemail and a lot of them will set up their voicemail with their own voices these days. So that's enough of a voice sampling. So it's— I think it's, uh, I mean, the article more or less is talking about these issues correctly, but I think the flow, uh, optimal flow of how to— how they would target people would be a little bit different.

And you know, it's just a matter of time, Peter, until somebody out there gets creative and they use our podcast and our video and our audio, our likeness, and they use it like to spoof us. It's just, it's coming. It's not going to be pretty.

No, no, that's when you're going to be on your boat when that happens.

Hey, Security Guy, how do you like this one? You know, I, I've had, I've had, I've had criminal hackers email me my Social Security number, uh, be like, hey, Security Guy, haha, gotcha. You know, and I don't really care about that, that they have my social, because I know that, like, I know that my social's out there. Everybody's in. Like, to me, it's like, okay, yeah, whatever. But I have a credit freeze, I have identity theft protection, I have credit monitoring, I have multiple layers of services of protection to basically make that data useless to the thief. You know, even if they have my social, there's not a whole lot they can do with it, you know, because, uh, it's, it's not an attractive numerical identifier due to the fact that all the restrictions that go along with it due to, you know, credit freezes and everything else. Uh, but with, um, all the audio and all the video we put out there, I mean, they could put anything out there. Yeah.

Hey, what percentage of people do you believe have— I mean, because you've been involved in this for some time and talking to people about, uh, credit freeze, uh, how many— what percentage of the US population do you think actually have their credit frozen?

See, I don't know, and the credit bureaus are not going to tell you. Uh, I, I would surmise it's definitely less than 10%.

And, and that's sad, man. That this is like the number— if you could only give one piece of advice to help people protect themselves from fraudsters when it comes to their, you know, their, their, their protecting their identity, right? That's like the— I think that's like the number one biggest thing that they can do. But yet, and we talked about it so much And yet people just don't get around to it.

It's, it's less than 10%, and I would say that it's probably even less than 5%, uh, and, and I base that on just my audience interactions. So I get in front of an audience of 100 people and I'll ask, how many of you have a credit freeze? And if I get 5 to 7 people raising their hand, then that's it. And that's usually what it is. I've never ever had more than 6 or 8% of the audience raise their hand ever in a presentation that I've done, ever. And I asked that question every single time I discuss credit freezes. How many of you actually have a credit freeze? And, you know, the, the, the few hands go up and that's it, you know.

This—

that's how I base my research. That's it.

Well, maybe we— you know, unfortunately we are not like the big influencers, right? If you got somebody like Taylor Swift coming out saying I highly recommend that you do it, you know, credit freeze. All of a sudden everybody would be doing it.

Well, you know, and, and there may be some truth to that, but even still, um, when it comes to security, man, people just, they just don't wanna, they just don't want to believe it. They don't want to think that they can be targeted. We inherently don't want to think it can happen to us, and therefore we do nothing about it. And by doing nothing about it, we're almost ensuring it's not going to happen to us. Like, it's just kind of like this ridiculousness that we possessed it. If, if we get— if we begin to think about it now, we're acting paranoid. It's like, no, you're not acting paranoid. You're taking responsibility. You're putting systems in place. You're reducing risk. And it's like, that's what you're supposed to do. You don't put a seat belt on because you're paranoid. You put a seat belt on because it's a smart thing to do. But it takes like a whole lifetime of training. Look at the seat belt has been around my whole life. It has literally been around since the '50s, but it's been required to be installed in American-made or American-sold vehicles since 1968. That's when I was born. That's 55 years— well, going on 56 years. And I only started wearing the seatbelt a decade ago, and it's been around my entire life. But that's most people though. It takes laws to be established. It takes awareness campaigns. It takes a beating on the head. It takes ding, ding, ding, ding, ding, ding. The car won't stop dinging at you until you put the seatbelt on in order for people to manage their risk in the car.

I have a funny— I have kind of a funny anecdote that comes to my mind now that you mentioned seatbelts, because, you know, here in America, cars, as soon as they were required that people use seatbelts cars came with— that was a standard feature, right? In some other countries, you had to almost like pay extra to get seat belts installed. And I remember, my wife is from the country of El Salvador, and in El Salvador, way, way, way back when, when they started saying you need to have seat belts, instead of people going out and buying and having seat belts installed, because there was a bit of a cost, right, they had t-shirts with the imprint of a seat belt across the, the chest of the t-shirt, which they would wear. People were selling those as a It's a cheaper solution than buying sea salt. Can you believe it?

Yes.

It's not cheap anymore, but I'm saying, it's crazy.

That is so ridiculous. And it makes perfect sense, because we are ridiculous creatures. Okay. So, last but not least, selfie spoofing becomes popular identity document fraud technique. Document image of image was the most prevalent identity ID document fraud technique in 2023. Occurring in 63% of all IDs that were rejected, according to SoCure. So a concern— a concerning trend. Selfie spoofing can be carried out quickly and easily thanks to the availability of public social media profiles. Selfie spoofing and impersonation dominate document-related identity fraud, says HelpNet Security. Document image of image occurs when the user takes a photograph or uses a screenshot image of an ID Rather than providing a live capture of the document, document headshot tampering takes place when a user purposely manipulates facial imagery. And selfie spooking entails taking a picture of an image on a computer screen, printed on a piece of paper, or even an actual headshot on a different document, often carried out to steal identities or fraudulently access systems. And so any financial service professional, bank, mortgage company, you know, lender that uses— investment company that uses photographed, texted, emailed driver's licenses as a form of authentication are at significant risk right now. So that's always been, I think, always been a significant risk. Using identity documents that are sent electronically as a form of authentication, which I would think that at this point in my life, it's probably at least 2 or 3 times a year. And I have my driver's license front and back on my actual, um, uh, mobile phone, uh, like, meaning like ready to go, like, as in my camera roll, because there's been so many instances where I've needed it, you know, to send off to whoever to establish an account. And that technology is being decimated with AI.

But there are some tools, and I've seen— I, I actually demonstrated one, uh, yesterday, an AI tool that's used for analyzing IDs, right? And analyze it from a lot of different points, you know. But of course, this kind of thing does cost a little bit of money. I'm not sure how much, but it costs a little bit of money, and, you know, it's going to take maybe a little bit of time. To actually, you know, not a lot of time, but to be able to run it through the system. Uh, and until companies though start using these type of tools, they are going to end up, you know, paying a price.

Yeah. All right, Peter, so tell— where can everybody find you? Where can they see you? What are you up to? Where can they get your book? Talk to me.

Well, at the moment I'm finally back in Orlando, but I'm going to be traveling again soon, which is good. I mean, on the road quite a bit. But, uh, I would rec— you know, people, think about it. If you're looking for— if you wish your, your, your company had a presentation on the kind of things that Robert and I speak about, you know, think about reaching out to us, uh, either individually or even, you know, we could do something together as a presentation. It could be even virtual, whether it's in person or a virtual, a virtual event for your companies. I mean, those are— we're able to reach a lot more people, uh, if we do things virtually. And, and, uh, So just think about it, you know, or anybody else you think that might be interested in this podcast, please have them tune in.

Uh, what's your website address?

Counterintelligence-institute.com.

Yep. And your books?

Yep, that's, uh, Messing with Me, written for our seniors in our lives. Uh, it's available on Amazon as well as the first book, Confessions of a CIA Spy: The Art of Hacking. So these are available on paperback on, um, on Kindle version as well as audio.

All right, and y'all can find me at protectnowllc.com. Again, that's protectnowllc.com. Obviously, uh, security awareness training— I call it security appreciation training— but you can always find me on the interwebs. Just Google, uh, Robert Siciliano, S-I-C-I-L-I-A-N-O. And Peter, last words.

Stay safe out there and, and take care of each other.

Yeah, and as my dad says, be good, behave, and be careful. Talk to you guys soon.