The Security Guy and CIA Spy PodBroadcast

And welcome to The Security Guy and CIA Spy. I am Robert Siciliano and this is Peter Wormka.

Robert, how are you?

Hey buddy, I'm doing pretty good. How are you doing?

Um, Doing well. I've been traveling more, which is a good thing. It means business has picked up, but, uh, the flights are not without, uh, complications. Delays galore.

Yeah, um, I have done a bit of traveling myself, um, March, April, a little bit in May, and, uh, I almost missed a couple flights. I was delayed a bunch of different times. I had a flight canceled. Uh, and you know, it's messy. Uh, and the worst part about it is people are as impatient as I've ever seen them in my entire life. Patience is gone and nobody has it, or too few people have it. And, uh, yeah, it's, uh, taxing to say the least.

It was a related story. My wife and I went to— we live in Orlando, right? We went to Tampa to see a baseball game between the Rays and the Milwaukee Brewers, and we came out and we went to a near, not too far from the stadium, we went to a Wendy's. And we were in Wendy's and, uh, there was a, a lady with her young daughter and there was a, another lady with 3 little kids. And, and, and all of a sudden there was a commotion at the drive-through and the guy was started pounding, you know, he was in his vehicle and he started pounding at the, the window for them to open it. They didn't. And he, and he parked his vehicle there, he ran inside and he started screaming. And, and you could just imagine, you see the faces of everybody in the, you know, in Wendy's that were just like terrified. Because when you see something like that, you don't know what's going to happen, right? You just don't know. Fortunately, it didn't escalate to a point where it got physical, but I mean, it got, it got pretty scary there for a minute.

And, you know, the first thing you would say is, well, did he have a gun? Did he start shooting? Like, because now that's what's going on. And Like, what we've seen is like a kid's ball ends up in a neighbor's yard and the kid gets shot. Uh, you know, people are driving, you know, we've heard of like road rage and people using firearms a lot in the past. Now it's becoming like as common as anything, you know, that just the most innocuous thing, you know, kid knocks on the wrong door to pick up his brother and the, the homeowner shoots him thinking like the guy, the guy, the kid's breaking into his house. It's like people just lost their minds.

Yeah, ever since, uh, people came back, you know, from COVID-19, right, and started going out, circulating again, and now it's— I think it's come back even worse than what it was beforehand.

No question about it. All right, uh, let's talk about some less horrible things. All right, so—

well, that doesn't look too good either. What up there?

Well, it's something that we all need to be aware of. So EPA stresses the need for improved water cybersecurity. Look at this article, came out like just over the past couple months, and the fact that the EPA is saying, hey, uh, you know, municipalities— the EPA is stressing the need to improve the cybersecurity of drinking water systems. According to the EPA, a recent survey shows that many public water systems, PWSs, have have not adopted basic cybersecurity best practices and are at risk for cyberattacks, whether from an individual cybercriminal, collective, or a sophisticated state or state-sponsored actor. The memorandum would require states to survey cybersecurity best practices at public water systems. So what they're saying is, is that even the absolute basics, that you have, say, a municipality's public water system is run by two old guys who are former plumbers, and they have no understanding of cybersecurity basics. And no offense to old guys, and no offense to plumbers, it's just that they're just not prepared for the fundamentals. And so when you go to the EPA's website, they talk about the EPA cybersecurity water sector and what needs to be done. And you click on the basic training, right? And it brings you to a video which I watched, and it's about cybersecurity, and it is, it is as 101 as it gets, which is fine because if that's what they need, if they need 101, fine. But they need to take it up several notches as quickly as possible. Peter?

Yeah, I know we've been talking about— I mean, this has been an issue for probably at least 10 years. Concern about these systems being, you know, attacked. And there's even been, you know, evidence of some of our adversaries, including the Iranians, that have hacked into water treatment plants. So, you know, it can be done. It wouldn't surprise me if a number of our adversaries didn't have, you know, plans on the shelf, just, you know, when the moment is right, just go ahead and commence these attacks because it's not that hard. There is— I was— I just looked this up— there's 153,000 public drinking, uh, water facilities in across the United States, and I would bet you vast majority of them are not prepared. And it'd probably be easy for anyone to even take a look and say if some of them did get prepared, they probably posted it on their website that they've upgraded X, Y, and Z. So it's probably pretty easy to find just from a cursory search which ones are probably vulnerable without even doing any necessary, uh, probes into the system. But this is serious. I mean, we've had countries that have gone to war because of the lack of drinking water. People die because of the lack of drinking water. And you know, this is worse than if you lose your power.

This is cringy. Yeah, if we lose clean water, it's over, Johnny. You know, uh, we are not prepared for that. Most people don't have a clue. So I'm sure I've told you this story in the past, probably about at this point maybe 10, 15 years ago in Massachusetts. There was a rupture in one of the pipelines that's responsible for most of the drinking water to all of metropolitan Boston. And there's two pipes that serve that area, one being a backup. And that rupture, you actually saw it on film. They had a film of it and it blew up. And so basically it shut down what they considered clean drinking water to like 58 cities and towns for like a week. Okay, so they called in the National Guard, and the National Guard brought in drinking water in the form of bottled water to Walmart and Supermart parking lots throughout those 50-something municipalities. Okay, and what happened was pandemonium, meaning that it came down to people waiting in line for water, water running out, okay, and people freaking out, and little old ladies getting knocked down for their case of water, okay. And here's the thing, everybody had water. Water was, was coming into their kitchen sink, into their bathrooms. They could flush their toilets. They could take a shower. They all had water, okay? What they didn't have, or they didn't know they had, was clean drinking water. And apparently not a single person ever got the message that all you got to do is boil it and it's clean, right? Okay. And what it boiled down to was that spare pipe that for a while had sat stagnant, it hadn't been flushed, they determined after a week was over that actually that water that was coming through was okay to drink.

Well, see, this could be a lot worse. I mean, if you have someone attacking the system, they could put something in the system that actually would be, you know, react— be poisonous that you couldn't even use it for other, other, uh, purposes, right?

Yeah, they increased the chlorine levels to the point where it's undrinkable. And that's something that happened, uh, or was, was, was messed with slightly in Florida not too long ago. I think it was Clearwater, Florida, which made international news. So this is a big deal, and I would recommend that everybody find out what's going on via your local public water supply and at what level they're prepared, or not for that matter, and that they need to bring in someone like Peter or I to talk to their people as to what they should be doing. A basic security awareness training Understanding what the basic 101 systems need to be have in place at a minimum needs to be had.

Yeah, because it's not only the possibility of contaminating the water supply, it's also that a lot of these, um, a lot of these facilities are also subjected to possible ransomware. And once they get hit by ransomware, they're shut down as well.

Shut down. Yes. So we will provide links to the Security Magazine article and the EPA's website in the show notes. And this is like— this one is a big deal. I would suggest that not only do you follow up and find out what's going on with your local municipal, you know, water supply, and/or, you know, talk to the mayor, talk to the city council, talk to the city aldermen, whoever, right? Governor, for that matter. And then you need a water backup. Peter, I have like at this point, I think maybe 150 gallons of backup water that should last me like a good 6 to 8 weeks, maybe. Uh, that may or may not include bathing, but it definitely includes drinking and cooking.

Yeah, we don't have quite that many, but we're gonna be— we're in the process of stocking up now because hurricane season is just starting, and, and that's the biggest concern, you know, when it comes to, uh, hurricanes— loss of power and especially loss of drinking water. So everybody here is beginning to stock up.

Yeah, getting the 5-gallon jugs that, you know, you see, uh, at the water cooler. Those can be had for $20 on Amazon. Sometimes people throw them away or recycle them. I would grab them from your neighbor if they're, if they're getting rid of them and refill them. And you could buy the caps online for like $1 or $2 each, and then have purification systems. You can get tablets to do just that. And then, um, there's something called the WaterBob. So Google it, WaterBob. It basically is a liner that you fill, that you put in your tub and you can fill your tub up with water. Pretty cool.

Good suggestions.

Yeah. All right, so, uh, next in line, uh, check this out, Peter. So hackers leaked over 721 million passwords in 2022.

It only gets worse. It never gets— oh, it's like a broken record, isn't it? Just the record gets louder.

Yeah, yeah. And scratchier. So there's no simpler way to hack someone's account than to enter their username and password. In fact, threat actors routinely leak users' login credentials on the dark web where they can be purchased by cybercriminals and fraudsters to commit further cybercrimes. According to researchers today at— by cybercrime analytics provider SpyCloud, researchers discovered 720+ million exposed credentials. Many of these credentials are harvested from third-party business applications exposed to malware. To make matters worse, Peter, researchers found that 72% of the users whose credentials were exposed in the last year breaches were found to be still using already compromised passwords.

I believe it.

That's—

it's gotten to the point where you can harp on this so often that I think maybe the only solution is going to be getting rid of passwords entirely and using another system. And I know there's There has been some development of systems, at least for companies, where they might be able to do that. Maybe we'll get to the point where the consumer will be able to get on a passwordless system. I don't know.

We're on our way. Passphrases and so forth, we are on our way. Google and Apple and others are rolling out various systems where they recognize the device, they recognize your IMEI address, they recognize your IP address.. And once you are, are authenticated, you are authenticated for a good period of time. But we have not phased out passwords quite yet. So on my site, protectnowllc.com, we have access to 13 billion stolen credentials, including email addresses, uh, as pass— as, uh, usernames and passwords. So check if your password has been breached. Password Checker. So you should not have a password, duh. You should have multiple passwords. Okay, so give you an example. If I type in— check if your password has been breached— if I type in, oh, I don't know, 1, 2, 3, 4, 5, 6 consecutive numbers, and we do a quick check, 1 through 6 as a password, duh, has been used 37,615,083 times. That's the epitome of dumb.

So, but I mean, for example though, it, uh, it won't pair up— this, this database won't pair up your username with the password. It's just showing how often that password, which you thought was unique, let's say, uh, whoa, there are other people using the same password. Exactly.

If I type in password, then we get Oh, I don't know. Oh, wait a minute, hold on. Oh, that's in caps, that's in caps. That's, um, 112,000 people are using PASSWORD in caps as a password. Let me do it in lowercase, p-a-s-s-w-o-r-d. So lowercase password, 9,659,000 times.

It sounds like a very good tool. I would encourage everybody to, uh, just— I mean, even if you think you, you're doing a really good job, it doesn't hurt to take a look at You know, how many other people are using your password?

This is so bang your head against the wall, I just can't even get over it. Okay, um, uh, what else, what else, what else, what else did I want to talk about? Uh, so this one is, uh, a bit bizarre, but I think it's important. Uh, those of you who have kids, okay, especially, you know, 18 and under, but the problem is not just 18 and under. Uh, you know, sextortion is a problem. I have a friend, her son recently engaged in sextortion, meaning as a victim. He met a pretty girl online and, uh, she, which is probably a he, convinced her son to share a penis pic. And so he made the huge mistake of doing one of these with the photo, which was his face and his junk, and he provided it to this scammer who immediately blackmailed him, sextorted him, uh, and, uh, he— the boy paid like several hundred dollars in Bitcoin money, like, probably without the parents knowing about it initially, right? Yeah. And the, and the boy, you know, like freaking out caught— got his mom involved. And, um, you know, he was very upset, crying the whole thing, like, obviously for obvious reasons. I mean, that's traumatic. He's a victim of a crime here, you know, of really of a sex crime, okay? And, um, you know, the mom called me because she's a friend of mine, you know, and I said, number one, the money's gone. That's not your concern here. The concern is your boy's well-being. It's his mental health. You know, I said to her, do not repeat this to your boy. He's the victim of a sex crime, and it's not something that you necessarily— a term you want to repeat to him, because that'll only just like make it worse in his head, you know. But it's something that you need to understand, and it's serious, and that this form of cyber sex crime, sextortion, a form of bullying, definitely financial fraud, has affected kids in certain ways where they've taken their lives. And that's the issue, okay? That's the big problem here. And I explained to her that this is not a technology problem, this is a parenting problem. And you're a great mom, and everybody knows that. This does not make you a bad parent. It just, it just means that you need to connect with your son in different ways that you didn't— never thought you had to.

So a lot of times not even the parents are aware of this level of, of, uh, criminal activity, let's say, right? So they don't— you know, if some of them— if more parents were aware of this, they maybe would have conversations with their kids. Oh, you know, I heard about this, I read about this, or read this article. But if the parents are kind of like in the dark, they don't, they don't, you know, highlight this for their children, and the children probably think, ah, it's not a big deal. Um, it's funny— well, it's not funny. I was at an event yesterday. I was at a Bankers, uh, cybersecurity event, and one gentleman was even saying that it's not just young people that can be, you know, taken in by this. Even individuals who are over 65— there's been cases where elder elderly gentlemen have been, uh, you know, people that look— that are kind of victims of a romance scam. But in this case, it's actually, you know, it's extortion the way that it actually ends up. So it's— people of all ages can be victimized by this.

Totally. Romance scams are awful. So this article via Daily Beast was, uh, written by, um, uh, cybersecurity experts, and they said, we conducted a forensic investigation of the links and found that 19% 71 links were embedded with malware, 5%, 18 links led to phishing websites, and 41%, 154 links were associated with what is called Whereby, a video conferencing platform operated by a company in Norway. It goes on to say that it was immediately obvious to us how some of these links could help a predator victimize a child. Online predators use malware to compromise a child's computer system and gain remote access to their webcam. Phishing sites are used to harvest personal information. Which can aid the predator in victimizing their target. For example, phishing attacks can give a predator access to the password to a child's computer, which can be used to access— can be used to access and remotely control the child's camera. At first, it was unclear why Whereby was favored among online predators or whether the platform was being used to facilitate online sexual abuse. After further investigation, they found that online predators could exploit known functions in the Whereby platform to watch and record children without their active or informed consent. So the child predators in this case recognized that Whereby had a vulnerability. And I think it's important that people understand that these child predators gather together on forums and talk about what they do, and they share videos and photos of their exploits. Like, this is what they do, and they have no like problem doing that, meaning that, A, it's easy for them to do this. Uh, they're on these forums and they are like-minded, and they have no, like, remorse that, that they share all of the various tools that they use to exploit children, and they have no empathy, no sympathy, no remorse whatsoever. Knowing that this is going on, knowing that this underground is happening, parents need to be involved in the kids' digital lives.

Absolutely. I mean, this is very different than looking for that predator that's outside of your house, right? Concerned that you're— you might— they might come by and pick up your kid, you know, uh, when they're driving a van and trying to entice them to get in, or this or that. These are ones that are coming in digitally, you know, into your child's bedroom. And it's not just maybe one individual. You have these syndicates a very large group, especially overseas. I mean, these are not individuals necessarily in your town. They could be individuals on the other side of the world that are do— that are doing these on, you know, each person that's, that's doing these maybe are doing it against 10 people at the same time. It is a huge business. Yeah, and you're not gonna— you're not gonna be able to shut it down. We're not gonna be able to shut it down. It's gonna come up, pop up. It's just a matter of really as Robert Siciliano says, protecting your children, make sure your children are, you know, receive the proper guidance on this because it's always going to exist.

Parents need to be as digitally, if not more digitally literate than their children. I am more digitally literate than my children. And my children are, you know, 14 and 17-year-old girls who are pretty savvy based on what I've taught them and based on, you know, the access that they have. But I still know more than they do. I definitely know more than their mother. And I know that most moms are similar to my wife in that regard, that they don't really know what's going on in their kids' digital lives. Now, I bring it to my wife's attention all the time. But being the mom of a 14-year-old and a 17-year-old, she's fully invested in their development. She has only so much bandwidth to invest in the their digital lives. She understands, uh, she's engaged but does not fully comprehend the repercussions of what could happen. And that's most parents. So get involved, parents. That's all.

Okay.

And while we're talking about kids, last but not least, uh, in the digital lives, TikTok says via Gizmodo that it's never seen this type of content trend after teen dies from Benadryl challenge. Okay, so teen Jacob Stevens from Ohio took more than a dozen pills of Benadryl when participating in a TikTok challenge. He died days afterwards. It's a really sad one, Peter. So TikTok responded to the death of the 13-year-old Ohio boy who overdosed while participating in the Benadryl challenge on its platform, stating that it had never seen this type of content trend before and had blocked searches on the topic for years. The social media platform's response came days after Jacob Stevens died after spending nearly a week on a ventilator. The teen was at home with friends who were recording him when he took more than a dozen Benadryl pills as part of the challenge, according to the local media outlet. Stevens then started seizing and was taken to the hospital, where doctors and teen's family said he would never wake up. So I think we all have like an immediate reaction to this. And what's your immediate reaction, Peter? And no, and no judgment, what's your immediate reaction to this?

To me, it's— I mean, it just sickens me. It makes me so sad because, you know, we have a young, a young kid that, you know, what, kind of wanted to be, you know, take up the challenge because he's watching us, you know, on TikTok and, you know, other social media platforms as well, these different challenges without understanding what the consequences are. It's all kind of fun and games, right? It makes me wonder, is— are any of our schools having educate— I mean, you know, there's a lot of talk about, you know, sex education, right? I'm not going to get into that, but there's a lot of discussion about that. So many of the schools are, are providing certain level of sex education, but is there any sort of education in the schools regarding these types of issues? Apparently it doesn't look like it. There's very— I mean, I'm not aware of it. Are you, Robert Siciliano?

Yes. So a couple things, let me respond to what you just said. So number one, you are far nicer than I am, hands down, because my reaction is, how dumb could somebody be? And the reality of it is they could be 13-year-old dumb. And I remember being 13 and I was dumb, okay? I didn't really smarten up until I was like 53, and I'm 54, so it's taken me a while, okay? And I can see how a 13-year-old could just be so dumb. And, and then the next question is, well, where are the parents? And that's always the next question. And I know where the parents are— clueless. And I can't blame the parents, and I can't blame the kids, because it's just like— I mean, yes, the victim is— while they're not responsible for what happened to them, they're in the best position to prevent it. And while the parents, you know, are there to parent How are they even supposed to know that a 13-year-old is so stupid to take 13 Benadryls? Like, it's just so unbelievably ridiculously dumb that you can't even imagine that that's something that would end up on video and on TikTok for that matter, and then it's a challenge. Like, it's— that's how ridiculous we as a culture and a society have become. And so it's just so important that parents are involved in their digital lives, that they are that aware. Like, if you do a quick search for most dangerous TikTok challenges, you'll see, you know, 7 dangerous TikTok challenges kids fall for. The blackout challenge has been linked to 20 deaths. You know, like, it doesn't take much to find this resource and scroll through and find out what the hell is going on out there with our kids and what are they doing that's just so ridiculously dumb. The risks that we faced as kids would be overdosing, you know, like on regular drugs like speed right, or cocaine for that matter, or alcohol. Now it's like Benadryl or a variety of other over-the-counter or pharmaceuticals that their parents may have access to. I mean, that's been going on forever, right? Uh, dying of, you know, car accidents, like, because we sped. Like, I can— I can't— I don't even know how many times I've done in excess of 100 miles an hour. The fact that I'm still here and I haven't killed anybody, you know, as a teenager But now, parents, knowing that this is a thing, spread the word, please.

Yeah, we can't— we shouldn't be able to plead ignorance, right? The information's out there.

That's it. The information is out there. All right, Peter, so, uh, all that being said, tell everybody where you're at, what you got going on.

Well, my site, counterintelligence-institute.com, uh, where I— you can learn a lot about the different activities, conferences, and training programs. And please, if there's any interest in— and I will extend that also for Robert Siciliano— interest in either of us to come out and do a presentation for your company or your organization that you remember, or even do something virtually, please reach out to us. I'm on the road more and more now, and as people are getting back into the swing of having in-person meetings. I'm also doing some writing. I'm going to be unveiling another book, my second book, uh, during the next podcast. So I don't want to go into that yet, but I'll unveil it next time. What about you, Robert?

I, uh, can be seen at, uh, protectnowllc.com. And I would say go to any of the dropdowns as a cybersecurity speaker, uh, trainer. We have e-learning, and you can download our speaker topics PDF. At protectnow.com/cybersecurityspeaker. It's all right there. We'll include that in the notes. Peter, last words.

Stay safe out there, and also, you know, look after your children, look after your loved ones, and make sure that, uh, they're staying safe as well. We need to— we need to be guardians of our fellow, fellow loved ones.

We do. And just be nice to each other. Right. Talk to you later, Peter. Take care.