The Security Guy and CIA Spy PodBroadcast

Good day and welcome to the Thursday, July 6th CIA Spy and Security Guy pod broadcast. I am Robert Siciliano.

I am the Security Guy and this is Peter Wormka, speaking from the hot, hot city of Orlando, Florida. But you, how are you doing up there? A little bit cooler, I think.

Yeah, we're a few degrees cooler. I guess July 3rd was the hottest day ever recorded on record.

Insane. Wow.

Yeah, that's—

got to really take care of not overdoing it outside because it can— people can fall from heat stroke and very little amount of time.

Yeah, that whole hottest day on record ever thing is just scary, man.

Hmm.

Yeah. So we got a lot to talk about today, including the MoveIt breach, how to spot and avoid a variety of different scams, and former CEO retired CIA spy. Peter has a new book out, which— yes, as well. And as usual, y'all, if you have questions, comments, feedback, just plug it into the comments section. We may or may not see it and/or respond to it, but we will do our best. So Peter, so, right?

Yeah, the movie, that's it. To me, that's, uh, it's amazing huge. This has huge implications, but I don't think it's gotten enough attention by our media. There's only been a couple articles that have come out about this.

So via TechCrunch, millions affected by MOVEit mass hackers as a list of casualties continues to grow. So hackers have compromised the personal data of more than 15.5 million individuals by exploiting a security vulnerability in the MOVEit file transfer tool. So MOVEit is a private company. It's a, it's a product, it's a service that moves data from one place to the other, and the number of victims' organizations continue to grow. There are more than 140 known victims of Clop ransomware attacks targeting a vulnerability in MOVEit Transfer, an enterprise file transfer tool. A ransomware expert threat analysis said that while only 10 of these victims have so far confirmed the number of people affected, the number exceeds more than 15.5 million. This includes approximately 3.5 million Oregon driver's license holders, 6 million Louisiana residents, and some 770,000 members of the California Public Employees Retirement Systems. And I mean, the numbers just go on and on and on. Peter, like, so what's your thoughts on this?

Well, the thing is that there was also a mention of a number of federal agencies that were impacted in the sense of having been breached. But what's very interesting here, this is a Russian group, no? And they predominantly are using this to extract ransoms, ransomware. That's the primary goal. Now, they said, you know, and these type of groups do not operate unless they have the permission or consent of, of the Russian intelligence forces. I mean, there's, there's no way, because they can be shut down in a heartbeat if they, they cross any lines. So they're operating under the, uh, let's say at least the, uh, concurrence that they can operate and do these things against, uh, U.S. companies. And, and then they say, well, we hacked into these government websites, but don't worry, we deleted that information right away. We're not doing anything against the governments. Websites, which I find very strange. It seems to me I would be, you know, I would be very surprised if— yeah, they, they're not going to, you know, attack it with ransomware, but the information that's been obtained, uh, definitely I believe it's gone back to, to Russia, um, to be used at a later date.

You know what it says right here on TechCrunch? That the Russia-linked ransomware gang has been exploiting the security flaw in MOVEit If it's, if it's based in Russia, meaning if it's a Russian-sponsored ransomware gang, you're saying that there's no way that Vladimir Putin would facilitate or allow that to happen under his watch because he controls the internet. It's, it's not like the US here, we've, well, we've got a lot more freedom and flexibility, and we're allowed to come and go as we please. Nothing happens in Russia without the Putin administration knowing about it and having some control over it. Is that what you're saying, Peter?

Yes, that's exactly what I'm saying. To what extent, you know, but it's, uh, it's not like this wasn't already, you know, they, they were— they just did it on their own hoping, you know, they could do it. No, they, they definitely have the, the consent, you know, of, of the Russian government. Otherwise it'd be shut down in a heartbeat. And to me, it's just strange that they say, you know, don't worry, they're US government, we're not, we're not going to, we already deleted all that information. We're not interested in it. Yeah, right. I don't think— why would the Russian government allow them to do this and not look to also take advantage of it if they were able to? No.

Now, are you aware if any Social Security numbers were compromised in this particular breach?

There's none that have been— I don't think it's been named in the press or discussed in the press, but it wouldn't surprise me. I mean, with a lot of these, with the PPI information, there's a number of them that would have the Social Security number. Even the— I don't know, don't you have to many times, even when you're applying for a license, provide a Social Security number? I don't know, because it's another point of reference to your identity.

Yeah. So your Social Security number generally is in the back end office, and it's an identifier for you as a US citizen, even though it's only supposed to be for Social Security benefits. Something called functionality creep crept in, in regards to the use of the Social Security number and so many other aspects of our lives in which it was never intended. That said, although your driver's license number is your actual driver's license number, it's not your Social Security number. It is referenced, my guess, my belief is in the backend system. So even though they may not have got direct access to socials, it seems like they have access to enough information. And you mentioned PII. PII is name, address, phone number, its email address. In many cases, it's your physical address. And while that is relatively public information, and in, in of itself, by itself, isn't necessarily vulnerable to identity theft, it's used to piece together the puzzles of what it takes to develop a full identity, which would include a Social Security number, and in some cases account numbers, credit card numbers, you know, bank account numbers, investment account numbers. So all of that data, while it's public information, the driver's license number itself shouldn't be exposed as an actual, um, set of personal identifying information, publicly available numbers. Uh, it generally should be under lock and key through the registries of the Departments of Motor Vehicles That in the hands of a bad guy could be used to further manipulate someone. And there are a number of entities that are using your driver's license as what would be considered a secretive numerical identifier as you, similar to how a driver's license is being used today. I'm sorry, similar to how a Social is being used now and in the past.

Well, we'll see if any individuals, I mean, begin to receive these letters from some of these organizations that were breached. Because by law, and this is dependent state by state, right, that many— most of these states do require that the organization disclose the data breach that has impacted specific individuals in their state if their personal identifying information is among the data that gains access to or stolen.

So I actually wrote a blog about this on my LinkedIn profile. And by the way, all of you feel free to head over to my LinkedIn and subscribe. We are approaching 98— we're approaching 10,000 subscribers. We, we, uh, take on about 200 different subscribers a week, which is pretty awesome.

Yeah, congratulations, everybody.

Uh, yeah, and so, um, we have listed here how businesses react to the MOVEit attack. If you use MOVEit, patch the software immediately. Only download the software directly from the Progress Software site. Be alert for additional updates on vulnerabilities and patches from Progress Software. Unpatched software may still be vulnerable to the exploits used by the Clop ransomware group. It's all— we also talk about access the potential damage and Progress, we'll talk about that. Change login credentials. All logins must be updated. This is a good time to consider adding two-factor authentication or a password manager. If you do not currently have them. And Peter, we always recommend a password manager, two-factor authentication, different passcode across all accounts.

Yes.

Alert any potential impacted clients or customers. So if you are a MOVEit affected customer, uh, you want to alert any of your member organizations if their data was included. Discuss phishing and pretext risks with employees. That means, you know, providing a security awareness training like what Peter and I provide, either internally or bring in outside experts like us. Okay. All right. Next, this is via the Federal Trade Commission. So how to spot, avoid, and report tech support scams. So I think all of us at some point have received either an email or a pop-up or a phone call for that matter, in regards to an organization posing as— or scammers posing as Apple or Microsoft or others for that matter. The tech support scams want you to believe you have a serious problem with your computer, like a virus, of course. They want you to pay for tech support services that you don't need to fix a problem that you don't have. They often ask you to pay by wiring money. Putting money on a gift card, prepaid card, or cash reload card, or using cryptocurrency or a money transfer app, because they know those types of payments can be hard to reverse. So, Peter, that—

it's interesting, these tech scams is the number one scam amongst the elderly, at least over the— during 2022. I, I got the report from the IC3, which is the uh, where you can report these scams to, uh, to the FBI, right? And so they publish the report every year that kind of gives a breakdown by people over 60, by state, and by type of scam. And what it's reporting here is that there was a total of $587 million lost by, by seniors, people over 60, to specifically to the tech scam, okay? And there was It was the number one, ending up with 17,810 victims. I guess the elderly are very vulnerable to this because they'll see a pop-up coming up on their computer or they'll get a telephone call and they won't really begin to question it. They'll just be afraid all of a sudden. A lot of them aren't very tech savvy. Some of them are, but they see a problem or they hear a problem and then there's somebody immediately there. On the phone that will offer to provide their assistance. So they, you know, they trust that individual, and it's not only paying, you know, the amount to resolve what is not a scam, I mean, what is not a technical problem at all, but in addition to that, they typically will be asked to click on a link from an email that will give them back it will give the scammer, um, um, control over the computer. And so they can also do a lot of things to the computer, to adding different types of viruses or, or downloading, uh, a lot of personal data from the target. Unfortunately, it's, it's huge.

It's huge. And what's alarming about it is, uh, it's a well-thought-out scam that occurs while you're Let's say it's a pop-up. You're on your device, you're doing whatever internet searches you might be doing, you know, you might be doing processing a Word document, you can be doing anything at all, not even necessarily, you know, searching anything online. But your browser might be open. And then you go to your browser to do anything. And there's a pop-up. And that pop-up, in some cases, might actually reference Windows that you actually already have open on your machine. So the software, the, the, the, the scareware, in this case, the tech support scam, is smart enough to reference information that you already have going on on your device at the time. So in other words, it reflects what you're currently doing on your machine, which is convincing to you that what's occurring because it's referencing what you're already doing, must actually be legit. Makes sense?

It does. And sometimes you might think, well, maybe just close this window and come back, and you can't get rid of that, or pops up again. So when that happens to me, it's not just— not just ignoring it. What I typically would do is just reboot, reboot the machine, and you're going to find out that it's no longer there.

You may also have something now installed on your machine that could be in the form of like a malicious adware or malicious pop-up that may not necessarily provide backdoor access to your machine. But at the same time, it might be intrusive enough that it's annoying enough that it makes it difficult for your device to function properly, because you might have a lot of processes going on in the background that affect your device's ability to function normally. Sapping up a lot of bandwidth, processor speed, memory, and all that fun stuff. So depending on if you have a Mac or a PC, it might require a malicious software tool removal, or malicious removal software tool, whatever the case is. And it might require you to shut down, disconnect from the internet, maybe even load up your antivirus, and you should have antivirus on a Mac. As well. Yes, should have antivirus on a Mac and run it because it might detect it and quarantine or remove it for you.

Okay, let me talk about different influence techniques that these scammers use, you know, to play upon our emotions. And in this particular one, it's the, it's the fear factor, right? All of a sudden you think that you're infected with a serious virus and it's only going to get worse and I need to take care of this now. And these they're conveniently there for take care of your problem, or they provide you with that phone number that's easy for you to dial and get that assistance right away. That's what they're— that's what they're counting on, right? That you're going to act upon this immediately out of fear.

And the other part of it is, if the phone rings and it's Microsoft, it's Apple, it's whoever— they're posing as McAfee, they're posing as Norton Symantec, they're posing as an antivirus company, whatever the case is— The phone rings, it's— it's— you just have to know right now it's fraud. It's not Microsoft. It's not Apple. They're not calling you. Any time the phone rings and it's anybody posing as anyone via tech support, it is a lie. It is just as simple as that. It doesn't matter what they say. It doesn't matter what the ruse is. It is purely a lie. And that's that.

Absolutely.

Now know this, if you didn't already, listening audience, viewing audience, uh, but your, your mom, your dad, your, the seniors in your life, even those younger, whatever the case is, anybody in your life that may or may not, that may be vulnerable to this, needs to know if the phone rings and it's tech support posing as Microsoft or Apple, it's a lie. Just simply hang up the phone and that's that. Don't question them. Don't yell at them. Don't engage. Just hang up the phone. That's it. That's all you can and should do. Same thing if it comes in via text message. If, if it's an email posing as Microsoft or Apple asking you to click a link or to visit a website, just delete it. As simple as that.

Mm-hmm.

Okay. Now, Peter, you actually have uh, written a book talking about this, right?

Just released it within the last couple of weeks, Why Are You Messing with Me? Senior Survival Guide on Fraud, Privacy, and Security. And the reason why I decided to write this is the following. I mean, you know, up to now I've been focusing a lot on social engineering, uh, and, you know, the attacks against companies of all sizes and focusing on creating the security awareness in these companies and for them to understand what these attacks might look like, how do they target their employees to conduct the breach, etc. And so most of it has been so much focused on the organizations and it trickles down to their employees in the training. But this is a sector, a demographic, the largest among all of us, where it's the most vulnerable and victimized, our senior citizens. And, you know, the training that I'm providing really, you know, hasn't been focusing on them. And so I really thought this is the most victimized segment of the population. Actually, last year, $3.1 billion in losses due to scams targeting seniors. $3.1 billion. And that's ones that have been reported. There's so many of these that take place and the seniors are not reporting them because, you know, there's sort of embarrassment, you know, and so they don't really necessarily want to report the the, the crime against them. So 3.1 is still on the lower end of the spectrum, and it's amazing, uh, how much that is. That comes out to like $35,100 per individual if we average it out. Um, and so I wrote this book, released it a couple weeks ago, and it's not— it's not your typical, typical like, well, cybersecurity, because I feel that sometimes cybersecurity, the terminology is— it's, it's not tangible. So when I talk about cybersecurity within the book, it's I talk about telephone, computer security, and I talk about security across all aspects from physical security in their house, physical security while they're transiting on the street. I talk about identity theft. I talk about all different types of scams. I talk about security when it comes to having to move into assisted living quarters. And I talk about security when they're traveling, you know, vacation traveling, whether domestically or overseas. All aspects of security for senior citizens. So it goes much, much beyond cybersecurity, but all these areas, which I think it's, you know, we have to take care of our seniors, you know, and I see this all around me where it's just amazing the amount of scams that are taking place. We talked about technical scams, but right behind technical, the number one scam scam affecting seniors this past year has been romance scams. We talked on the show about romance scams, and, but it's, you know, it's a little bit more, it's a little bit different with seniors, but they are really pulled into, to romance scams as well. So this book goes into considerable detail, and as you're showing there on the screen, it is available on Amazon. And I'm sure Robert Siciliano will be speaking more about different specific types of scams that seniors have to be concerned about because, uh, we, you know, we need to provide them with that type of information.

I actually, um, responded to, uh, a journalist's query this morning in regards to romance scams, and, uh, I was asked or tasked to talk about the profile of romance scam victims. And, you know, they're often emotionally vulnerable, uh, who may be lonely, recently divorced, widowed, widowers, uh, and simply, you know, seeking companionship. They often, uh, are open up to forming a deep emotional connection right off the bat, quickly, you know, and exploited by rapidly professing their love by creating a sense of intimacy in that dialogue. And too many people who are feeling lonely will take that bait real quickly. And often, as you say, you know, they might be seniors and they're at a point in their life where, you know, they're not necessarily paying attention or managing risk effectively and they just want to be loved. And they're a perfect mark for this type of a scam.

They are. So this, this book, you know, really is intended for seniors, but it can also be of value to, to the children of seniors to help better understand the type of world that their parents, you know, the type of risks that their parents face. Because many times the parents are not going to necessarily, you know, ask these questions. They're going to be thinking, uh, what's happening at the moment and how to react to it. And sometimes they're just not— they're, they're not aware. They're not aware of, of how much they're— I mean, why are seniors so much— why are they number one target group? Because they as individuals have the most wealth typically in the country, right, compared to a 20-year-old. How much, you know, savings do they have, or how, how much do they have in their credit? You know, seniors have a lot. They're easy, huge targets for—

I think it's that coupled with the fact that it's a generation that was brought up, uh, to trust authority in such a way where they didn't necessarily question it. The way that it is being questioned today, or really the, the, the, the generation of the past, you know, 20, 30, 40 years. When you think about like my parents, baby boomers, um, who, uh, or the, the, like, they, they, like, the children of the, uh, '60s, they questioned— the children of the '70s, more than anything, they questioned authority quite a bit. The Vietnam War, they fought back quite a bit. Whereas those that are, you know, on the upper tier of the baby boomers, you know, late '70s, '80s, they're even more vulnerable. I would say that, you know, all those, you know, post-'70s certainly, you know, to a degree fall into that category. But as you get up there even higher in age, there is a— that segment of the population is even that much more at risk.

Yeah, it's not only trusting authorities. I mean, people just in general, that's a generation that pretty much trusted anything. I mean, why would it— why would someone lie to me, right? He pretty much trusted everything that, that, that's communicated to them.

So that book can be found on Amazon. Can it be— is it linked on your website?

I guess it is.

All right, and Amazon. And Confessions of a CIA Spy and Why Are You Messing with Me, Peter. That's great, man. You're awesome. Okay, so any last words, Peter?

No, just, uh, be careful, stay cool, and, and, uh, watch out for those scammers because, you know, they don't— can't— scammers, they can, they can work from their air conditioning houses. They can call you anywhere they want to. They're continuously operating. So take care of each other and yourself and take care of your parents.

Yeah, and, uh, real quick, uh, check us out, uh, my team at protectnowllc.com. And, uh, let me see, last bit of housekeeping. Hold on one second. Oh, uh, actually, that's it.

Pete—

Peter, I'll talk to you soon.

Okay, take care.