The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Wormka, Happy New Year, Robert!

How was your— how was your end of year festivities?

Uh, eventless.

Oh my gosh.

Yeah, well, you know, I, uh, I didn't go out. Um, I, uh, I was exhausted because we had a pretty long week of, you know, family and everything else. And by, by the time New Year's came along, I was just wiped out. Uh, but, uh, overall, uh, the whole holiday break with the girls was wonderful. You know, I still have my college-age kid at home, and the other one went back to, uh, high school, um, so her break's over. But, uh, yeah, it was a great family time and great food and great friends, and I'm glad it's over.

Yeah, we got a new year. I mean, we got a new year here, and things are, uh, I mean, it keeps on building from previous years, right? The issues that we talk about, and, and especially regarding cybersecurity and how not just companies but individuals, you know, can really, really, you know, suffer for some of these things. And it gets more and more sophisticated. And it's important that we talk about these things too, because it's increasing, increasing our threat, increasing the business for us, which is a good thing for us. But I mean, we never like to see people being victimized.

Yeah. And, you know, that brings a couple things to mind. You mentioned, you know, getting so much more sophisticated, and that That is certainly true. Part of that is more so that they are more organized. The bad guys are more organized than ever, and that makes them look smarter, right? I don't know if they are any more sophisticated or smarter today than they were a decade ago, but what they do now is they treat cybercrime like it's a business. Therefore, yes, in that regard, they are more organized, which leads to being more sophisticated. You know.

Well, also the barrier— barriers to entry for them are as much lower, you know. Uh, you can be— and you don't have to be a professional hacker to, to be able to acquire some of these tools, as well as tutorials on how to use these tools. And so I think it increases the surface base of, of the amount of individuals out there who are, you know, work as threat actors. And so by, by, you know, it also increases then the the number of individuals that can fall victim because more attacks, to say more targets.

Yeah, and with AI, ready-made hacking tools or hacking kits are available for a small fee that can make anybody with access to the internet a criminal hacker with a few keystrokes and a Bitcoin payment, and then they launch an automated attack on whoever. You know, so we're all about being proactive here, putting systems in place, recognizing risk, knowing what your options are. And look, you know, in as much security as you may have in place, bad things still happen. You know, you look at what happened in New Orleans on New Year's Eve, which is absolutely tragic. You know, I've been down Bourbon Street multiple times. Look, that's considered what's called a soft target. And a soft target is one that, you know, it's— there's so many points of entry, there's so many vulnerabilities, and you can only make it so tight, you know. I run the Boston Marathon every year, and the Boston Marathon was attacked back in 2013, and that's considered a soft target. And along the route, running 26 miles, I see hundreds of ways in which a car could jump onto the field, which basically is the road. And, you know, there's only so many ways that you could prevent that. Right. And the fact that nothing worse has happened since the 2013 bombing is really astonishing to me. But like, look at— None of this means that you just kind of throw your hands up in the air and give up because, hey, if they're going to attack, they're going to attack. No, you still put systems in place. You still recognize risk. If you see something, you say something. If you can install antivirus, if you can have a credit freeze, if you can invest in identity theft protection, if you can, you know, do something to minimize your risk, you become a tougher target. And, you know, the likelihood of something bad happening to you reduces even just a little bit is always a good thing.

Oh yeah, absolutely. As you mentioned, becoming a harder target while other individuals remain soft targets. The, the criminals are always going to go after the individuals that are softer targets.

Exactly. Yeah, yeah. So right here, um, you know, hackers are hot for water utilities. Uh, this is via Dark Reading. The U.S. water sector suffered a stream of cyber attacks over the past year and a half from a mix of Cybercriminals, hacktivists, and nation-state hacking teams. Here's how the industry and security experts are working to better secure vulnerable drinking water and waste utilities. I'm actually keynoting at an event in Indiana in February on this very topic. So it talks about the unprecedented wave of high-profile cyberattacks on US water utilities. Over the past year has just kept flowing, pun intended. Uh, in one incident, pro-Iranian hackers penetrated Pittsburgh area water utility and defaced a touchscreen, which if that's all they did, great, with an anti-Israel message, forcing the utility to revert to manual control of its water pressure regulation system. A waste— the water and wastewater operation of 500 North American communities temporarily severed connections between its IT and OT networks after ransomware infiltrated some backend systems and exposed customers' personal data. That's all they did. Yes, significant enough. Great. It's, it's when they mess with the controls to a degree where it could infect the the quality of the water being delivered, clean versus not, whether it can overflow or stop the flow of the operation of sewage, you know, backing it up, releasing it into freshwater or into the environment, and so forth. That's where you start to get into significant problems.

Yeah, the, the cyber— the criminals are typically when they're hacking into these systems, like the, like like water. And what they're, you know, what they want to get out of this is financial, you know, reward. Typically it's going to be through the ransomware. And that we see, and we see the result, we know. What we don't see very often, although we know that it takes place because from time to time we hear of probes that are conducted, you know, from various nation states, predominantly Iran, Russia, China, is to be able to get into, 'cause water is considered, you know, one of the top amongst the list of critical infrastructures that we have in the United States. It's like if we lose clean water, I mean, it causes lots of problems. So yeah, my concern is that there are a lot more probes that are taking place than we're even aware of, and they're finding the vulnerabilities in these different systems and possibly even planting malware that if it comes to the right timing, when we enter into a real, you know, cyber war, you know, we're kind of in one right now, but we get into that cyber warfare, these types of things can already be, you know, they're at their attack plans on the shelf. So we don't really know the extent of how much, you know, how vulnerable we really are at this point.

Yeah. And I've been saying for years and years and years and continue to encourage people, to make sure that they have, you know, backup water, right? Um, that's not a very difficult thing to do. So I have in my living space, basically in my garage— if you're looking at this, can you see this on the screen, Peter?

Yeah.

So this is a, you know, 55-gallon water drum. Uh, this is $120 on Amazon. And I'll tell you straight up, if you do a quick search on Facebook Marketplace for a 55-gallon water storage battle— but a barrel, I'm telling you, you will find them for as little as $10, $20, $30. They're all over Facebook Marketplace. Now, that, that might be a recycled barrel that might have had, um, you know, soy sauce in it or another food-grade type product in the past. That would take nothing but, um, a little bit of rinsing and maybe even using a little bit of bleach, which is perfectly fine and perfectly safe depending on, you know, how much water versus bleach and so forth, whatever the concentration is. And you'd have a clean, sterile 55-gallon water storage barrel that you could put in your garage or basement. And, uh, if you do your research you can get a, a valve you can tap into this barrel for like $15, $16. And then a water purifier for about $20. It's actually two little bottles for $20 that'll purify that water for up to 5 years, which means every 5 years you drain it and you start over again. You hope that you never need it. But 55 gallons is a lot of water that would be for food,, for consumption, right? And, uh, even for bathing if necessary. And with the various valves and, um, pumps that you might get for another $20, $30 to siphon the water out, um, you hope you absolutely never need it. But for— if you did it via Facebook Marketplace for under $100, you could easily set yourself up, um, for a couple hundred bucks, you know, if you just, just didn't want to deal with it and just bought it all, um, you, you could easily set yourself up as well. But, you know, I'm a, uh, I'm conservative in that regard. I like to save a couple of bucks, and I don't mind a little bit of legwork. So I was able to do everything for under, under $60, actually. Um, so I would recommend to anybody, you know, consider this because it's a real thing. And, uh, worst case scenario, you know, um, you have backup water, right?

Right. It's a very, very good idea. I mean, as you mentioned, not, not that what very expensive, uh, to also, um, employ.

So yeah, yeah. All right, so here, AI is becoming the weapon of choice for cyber criminals. All right, so now I think that this particular article is a bit misleading as far as the title is concerned, uh, because what this article talks about, and I'll read it right here, uh, it says the overreliance on Gen AI to develop software compromises security. So it's saying that 96% of security and software development professionals report that their companies use GenAI-based solutions for building or delivering applications. Among these respondents, 79% report that all or most of their development teams regularly use GenAI. More developers than security professionals report concern over loss of critical thinking due to AI use in development. AI learning mechanisms may lead to increased code-based leaks. Okay, so what they're saying is 43% of respondents concerned about the potential for increased leaks in code-based highlighting the risk of AI learning and reproduce patterns that include sensitive information. So they're saying that like AI and its, its use in building out software and in learning where to get and how and generate personal information is part of the problem here, that it's taking humans out of the process of building and developing software, which, which could lead to code links. So it's not necessarily the traditional what we would think using AI for social engineering. It's using AI to do human-based development tasks, and they're overlooking the security of those tasks. That's the issue. And that bad guys are taking advantage of those vulnerabilities in the development of that software. Essentially, they're not using application security in the development of that software to the degree that they probably should.

Yeah, it kind of reminds me of a kind of overall problem with companies' use— I mean, companies' considerations of cybersecurity. They're looking at ways that they can use AI to make the process maybe more efficient, And, you know, maybe they can, they can move things along quicker and with less, you know, less expensive than paying, you know, more and more engineers to undertake this. Just like companies, you know, what, whether, you know, they're going to look at what's, you know, what's the risk that I'm, I might have with something happening, and how much is it going to cost me to, you know, to maybe to increase, to, to reduce the risk, and can I afford, you know, Is it, I can afford better just to undertake, you know, hopefully nothing's going to happen, but if something happens, I'll be okay. I'll, I'll have some, you know, it's going to be a little bit of a financial, uh, problem, but we'll get through that. Versus, am I going to be spending all this money every year for this type of beefed-up cybersecurity? So it's kind of like, you know, what, what the bottom line, what does it say on the, on your, uh, you know, income revenue at the bottom line? How much am I making versus what is what is for the good or benefit of your customers or for your clients, especially for the individuals. You know, a company many times don't even think about the consumer other than, oh, will I lose consumers and that's going to affect my profitability, but not really concerned about protecting the, the privacy and the data of the customers, just doing the bare minimum. Yeah, kind of, kind of saddens me. It kind of frustrates me.

Yeah, and that, that bare minimum, uh, you will eventually bite them. And so we're gonna see that coming. We're gonna see that coming. All right, so right here, um, McAfee, which is the antivirus company, who's been a client of mine when they were with Intel— State of the Scamiverse: How AI is Revolutionizing Online Fraud. So for less than the cost of a latte and under 10 minutes, scammers today can create shockingly convincing deepfake videos of anyone— your mom, your boss, even your child. Imagine receiving a video call from your mom asking to borrow money for an emergency, or getting a voicemail from your boss requesting urgent access to company accounts. These scenarios might seem straightforward, but in 2025, they represent a growing threat. Deepfake scams that can be created for just $5 in under 10 minutes. And you and I already talked about the fact that, you know, ready-made, um, hacking tools, hacking kits that include AI can easily be deployed and consumed by the bad guys, purchased off the dark web by anybody. And this is only going to get worse. Now, there is, I guess, a bit of good news here. And it's only a fleeting bit of good news. It's like, I just saw an article very recently that talked about how artificial intelligence and deepfakes didn't do too much to negatively influence the elections.

Correct. Yeah.

Which is a good thing, which— but that's primarily because the deepfakes aren't that good yet. Coupled with the fact that, you know, companies that are paying attention, security companies, news media, and so on, when they see a deepfake, that is designed to influence in some way, whether it's, you know, for an election or if it's for, you know, fraud, uh, which could be back to the election, um, you know, they, they quickly point it out, the media takes hold of it, and they, they let everybody know. But inevitably somebody is going to get hooked, and your job, our job, is just to recognize risk and not be so gullible in the moment that you you get a phone call or an email or a video, whatever it might be, that raises your blood pressure and gets you all freaked out because it's a loved one in distress, stop and think about what might actually be happening.

And, um, McAfee came up with a product, or is coming out with a product right, uh, right now, which is, uh, to provide to consumers to help them identify, uh, potential, uh, defects Which I think—

yes, McAfee Scam Detector Suite, um, starts with McAfee Smart AI, the same technology that already powers our online protection. From there, it helps keep you safe from email, text message, and video scams. It has a text scam detector, detects suspect texts that scammers use to trick you into giving them money. An email scam detector checks your inbox for suspicious emails that flags risky messages. A deepfake detector spots AI-made videos. Letting you know if someone you're watching may, uh, not be what or who it seems. Which, it doesn't seem complicated to me that McAfee would come up with a product like that, because, uh, you can do searches for AI, uh, detection for as far as like articles and content and such. And so there's like a basic algorithm that goes into producing artificial intelligence related text. Uh, it follows a certain protocol, certain algorithms. And so it would make perfect sense that a scam detector would be a software program that is essentially reviewing incoming text, uh, emails, text messages, even video, uh, and, and a comprehensive software that would look for that algorithm that produced that content.

Yeah, I mean, this, this sounds very encouraging to me because a lot of the products that have been rolled out during 2024, 2023, or more, uh, by companies that are looking to provide these services to other businesses, right, business to business, not so much for the consumer. And so, I mean, there's only been a couple that have come out that I saw recently that, and they are free. This one, I presume, there's going to be a fee. Hopefully it's not going to be a lot of money. It's going to be more accessible for individuals. But I pose this question, you know, Robert, you know, we speak at length about all of these things that we can do, we can do as consumers, and, you know, to improve our security and to include, you know, being able to spot, you know, AI and other types of ploys and potential scams. And we, you know, or even like, you know, talking about freezing the credit, we speak to this at length, and yet all these free things that are available, people are not taking advantage of. And so for me, it calls into question, are people who don't want to take care— take on these free things, are they going to pay now for a service? I think unfortunately not enough of them will. I think they're still going to be complacent. They're not going to want to pay for anything.

You know, they don't want to think it's going to happen to them, therefore they're not going to do anything about it until something bad happens.

Yeah.

And even then, they throw their hands up in the air and go, how did that happen? It's like, well, because you did nothing about it to begin with.

Right?

Yeah. So right here, North Korean hackers stole $1.34 billion in crypto in 2024. North Korean state-sponsored threat actors stole tons of money this year, more than half of all the crypto stolen in hacks according to blockchain analysis firm Chainalysis. In addition, the frequency and speed of the attacks are accelerating. And the hackers are expanding the organizations they're targeting, pulling in as little as $10,000 in some attacks. Mm-hmm. So when examining the Democratic Republic— People's Republic of Korea, uh, activity in comparison to all other hacks we measured, it's clear the DPRK has been consistently responsible over the last 3 years for most large-size exploits.

So, well, yeah, we've seen this for a number of years. They have been the singular group who have conducted more, gained more revenue through ransomware attacks than any other single element. And so this is a continuation, right? 'Cause they're looking for hard currency basically because they don't really, they're not able to export much of anything that's gonna bring in hard currency. So they're looking for ways to do this through cybercrime. Ransomware, you know, it's still important for them, but this is kind of overtaken now I think the source of hard currency that they're looking for.

Yeah, yeah. Uh, so for the everyday consumer, uh, who possesses cryptocurrency, here's the deal. Like, it's not that difficult for you as a consumer to make sure that your accounts are safe. For one, make sure you're using US-based cryptocurrency wallets, uh, like Coinbase. Is fine. You know, Coinbase knows what they're doing. Uh, they have two-factor authentication set up by default. Generally, they're going to require your mobile phone number as that second factor. And while that's not the end-all cure-all, it is a step in the right direction, and it can work effectively as long as you do a few different things. Number one, um, they will, uh, recognize if your SIM is swapped out. How they know, I'm not really sure, but they know if you are logging in using second two-factor authentication and you're— you've changed carriers over since the last time you logged in. They some way, somehow can check an IP address, a MAC address, something that tells them, oh, you're on a different cellular carrier than you were previously, which is a good thing. And so they will make you jump through additional hoops in order to log in. So if somebody swaps out your SIM, which traditionally has been the way that criminal hackers have been gaining access to your cryptocurrency account, um, it's not going to work in most cases because you have to again jump through additional hoops to authenticate yourself beyond, um you know, using two-factor authentication, you have to also make sure that your email is secure. You know, like I ask my audiences all the time, and I, I have an ongoing question that I asked them from the very beginning of the presentation, and I raised my hand because I know what my answer is, and I say that I know what my answer is going to be. How many of you use two-factor authentication for all your critical accounts, including email? If I get 15 to 20% of the room to raise their hand, that's a lot, which means 80% of the public are not using two-factor authentication for email, which is horrible. And so once the bad guy gets inside your email, as they say, bad guys say, own the email and you own the person. Like, it shouldn't be like that, you know. So Setting up two-factor authentication for email is your first thing that you should do to secure your crypto account and any other account. And then two-factor for your, your crypto exchange, and you should be good. Additionally, if you want to throw all your coin on a Ledger, that's fine too.

Well, you're so right, as emphasizing the email. I mean, that's really your your base of all your communications with not just people, but I mean with other friends and contacts, but regarding all your other accounts that you have when you need to reset a password. I mean, everything's going back to your email, and if someone's able to hack into it, it's amazing. I mean, it's really amazing what they can do, and, and it's—

and they're, they're doing it on the backs of people that are just not clued in when it comes to their own information security. They're not becoming tougher targets like we suggested. And it's so easy to do, you know. All right, so to finish up, 15 of the biggest fake images that went viral in 2024. Uh, no robo dogs were harmed. Yeah, I love it.

Yeah.

Uh, let me— so, oh my God, that's just so ridiculous. Uh, all crime is legal now. Stolen goods must remain under $950. I think that's a dig for California. Yeah, yeah, yeah, yeah. Not true. All right. Let me see what else we have here. The lines on maps divide states aren't real either. Yeah, that's, that's not true.

Okay.

All right. There's no division in the Pacific Ocean. Something Mike Lindell said or did. Don't know. I guess he was drunk. Uh, let me see what else. The McDonald's goof. This guy's smoking at McDonald's. Oh, he's an interesting character, right? Uh, what else do we have here? Oh, he's got, uh, I think three fingers. Um, this guy passed out in the background. I mean, we could go on and on and on. So I, I'll, I'll look at this. That's a croissant.

Yeah, that's pretty good actually.

That's pretty creative. That's pretty creative. Yeah, yeah. Yeah, you know, you know, it—

I, I—

what I, what I do like about AI is just how creative it is. It is a time saver with certain things, but there is a lot of creativity there. It's the people behind the creativity that I find most intriguing, you know. Uh, there's, there's really no limit to the— to human ingenuity, and AI is, is increasing the human ingenuity's capacity, which is really cool to me, you know.

Uh, Robert, you're— I've You're probably familiar with the artist Salvador Dalí, right?

Oh yeah.

And, and, uh, down here in Tampa, the Tampa area, they have a great museum, and I was visiting there a couple days ago, and it blew me up, you know, blew me away how he was so creative and being able to express these things, you know, back into the '30s and the '40s and the '50s and the '60s. And what he would do if he had— if he was here now and had, had AI. I mean, it's just It's just incredible, just incredible, the force magnifier.

Yeah, awesome, awesome. So Peter, tell everybody what you're up to, where they can find you.

Okay, well, beginning of the year and starting to get calls for events, training events as well as speaking events. And I can be contact— I recommend this for both myself and for Robert— reach out to us. And I reach out to me through counterintelligence-institute.com or directly to me on, on LinkedIn. And it's a lot better to do this earlier in the year than later, because you're going to find if you try to reach out to individuals to get them to provide training or speaking at events, that their calendars fill up. So don't procrastinate on this.

Yeah, Peter is a TEDx speaker, and he's written two books, Confessions of a CIA Spy: The Art of Human Hacking, and Why Are You Messing with Me? Senior Survival Guide on Fraud and Privacy. Both are available at his website, counter-intelligence-institute.com, as well as on Amazon. Yeah, yeah, on Amazon, the link is right there. And you can check me and my team out at protectnowllc.com. Uh, January actually has got off to a pretty good start so far. I've already booked 4 gigs this month already. Which is very exciting. This is the best January I've had since pre-COVID. So, you know, what I'm finding, Peter, you may be finding the same, is that, you know, while phishing simulation training is absolutely necessary and companies should deploy it, you know, we provide it through third-party vendors if you're interested, but they— it's necessary, but it only solves one part of the fraud prevention puzzle.

Exactly.

You know, it gets users, employees, coworkers, those who you as a CIO might be responsible for, into a certain mindset to reduce risk when it comes to email. But it may not address other aspects of fraud that your employees aren't prepared to deal with. And that's like really in their own personal life, too, you know, like protecting their own identities, just getting them to care about security. And that's what Peter and I do is we kind of flip the switch on that and get the employee thinking differently about security, what it is, right, what it means, what it isn't. It's not about paranoia. It's about managing risk. It's about taking control. It's about doing something about preventing the bad guys from choosing you, which they might, you know. People say, well, it can't happen to me. Well, there's no sense in functioning in denial. Like, what good is that going to do? So, you know, part of the training that Peter and I both do individually is, you know, like, challenge your belief systems as to what security is and isn't and get you thinking securely because it is a good thing for you.

That's absolutely right. And I think, I mean, there's no doubt in my mind that 2025 is going to be a record year to the attacks, successful attacks, both companies but especially individuals. I think we've seen, I think we've heard about attacks against companies for quite a while, but I think we're going to see a lot more, we're going to hear a lot more about individuals being victimized, which is going to jeopardize their own personal financial security. So it's a lot closer to home, right? And so I think all of us owe ourselves to become more literate when it comes to what types of, what types of scams, whether they be cyber or not even connected at all with the computer, but ways that people can try to scam us out of money. We need to be more aware of these things. So public awareness is important, and also educating our, our own family members and friends. You know, I have my second book I wrote was focusing on on the elderly population, because if we as their children don't try to help them, who's gonna help them? And it sickens me to see, you know, the elderly people that have worked all their entire life and had their little nest egg and all of a sudden being scammed out of, you know, most of that, if not all of that.

So devastating.

Take care of each other.

Yeah, agreed. Famous last words. Thank you, Peter. Like my dad says, be good, behave, be careful, and we'll see y'all next time.

Take care.