The Security Guy and CIA Spy PodBroadcast

And welcome to The Security Guy and CIA Spy. I am Robert Siciliano, and this is Peter Wormka.

How are you, Robert?

Peter is the CIA spy.

By default, because you're the security guy.

Yeah, I'm doing pretty good, Peter. It's, it's been a bit too long. It was a really, really busy summer. I, I dropped my, my first child off at college in the past couple of weeks, so it's been busy, busy. And, you know, frankly, uh, with her gone, I'm kind of a mess.

No, I can completely understand. It's a bit of a try, you know, but, but being, you know, she also, I'm sure, misses you, even though you might not sense that all the time, but for someone going off to university for the first time, leaving home, it's a big change for them.

It's a big change for them. It's a big change for us. It's a big change for their mom. She doesn't show it, but I think she might be as messy, if not a little bit more than me.

Hey, it's a part of the cycle of life, right? And having a family.

Yeah, yeah, yeah. And, and, and, and, you know, being a security guy right? I'm always thinking, like, of her personal protection. Uh, so, you know, there's, there's, there's, there's, there's a known— a relatively known statistic that as many as 1 out of 4, um, both young men and women, mostly women, are sexually assaulted at college. You know, like, that's—

I heard that statistic. It is very, very high.

Yeah, yeah. It— the stat has been as much as 1 out of 4 Most recent stats are a reported 16%, right? So it's not as much as 1 out of 4, it's like, you know, a little bit less, but that's reported. Um, so I think it could be as much as 1 out of 4. And there's a film that I think that everybody should search out, it's on Plex, P-L-E-X, it's free to watch. It's called, uh, The Hunting Ground, The Hunting Ground. And The Hunting Ground was produced around the time of the MeToo movement, and it's about a, a bunch of young women from college that were all sexually assaulted, and they put together this film and this movement revolving around, you know, uh, rapes at, at college. And, uh, I think that that film itself was instrumental in making some change. However, it's still a huge problem. So it's called The Hunting Ground. I actually sat both of my girls down and made them watch it, and I watched it with them, and, you know, I engaged in some dialogue with them as we were watching it. And it's just a film that I think that everybody should at least at some point watch and/or have your kids sit down and watch, both male and female. You know, there was a particular scene in the film where they were filming a fraternity a bunch of fraternity boys, you know, men, and they were outside of their fraternity chanting. And I'm going to get a little graphic here. They were chanting, um, "No means yes, yes means anal." Chanting that, you know, which goes to, you know, the whole fraternity culture. And I think that that's something that, like, people should be acknowledging, you know. And if you're sending your kid off to school, you, you, you both male or female, that it's something that they should understand going in because the fraternity culture, as which is as many problems as they have, it's not really changing all that much. It's still relatively aggressive.

No, I had not heard of that movie. I will look it up. Uh, I think, you know, I commend you for for sharing that and also, you know, sitting your two daughters down to watch it. And hopefully that does, you know, have an impact on, on how they view this potential problem. Because, you know, this is like a lot of other security issues. People think, well, I would not— I wouldn't fall victim to whatever the threat is, right? That wouldn't happen to me, you know. But I can't see, you know, if they see a movie like that or they begin to, to hear testimonials of what's happened to other people, say, yeah, this could definitely happen to me. Uh, yeah, so that's really important. Yeah, with that news.

Yeah, yeah, thanks for hearing me out. So Peter, uh, what we're going to talk about today, uh, amongst a few— a bunch of scam stuff is the, um, Israel had a hand in manufacturing pagers that exploded in Lebanon. Now, uh, just so everybody knows, Peter and I had a brief conversation about this prior to the broadcast and you know, we kind of battled a little bit with, you know, that this is a relatively old story, you know, a couple weeks old or whatever, but, you know, nonetheless devastating to, uh, the Lebanese. Uh, but, you know, like, I wanted to hear from Peter. Like, Peter is, you know, former retired CIA, and this is a big deal, Peter. Like, when I saw this, uh, story come out, and I, I followed it like from the very, very beginning, I'm I was like, pagers exploding, like hundreds of pagers exploding, thousands of pagers exploding in Lebanon. Like, how? And then, and then radios, ham radios the next day. Like, how does that happen? And it didn't take long to figure it out, you know. I, I kind of figured it out before it actually was figured out by Wall Street Journal, New York Times, and, you know, journalists all over. Um, it goes on to say that, um You know, and I, I can't wait to hear what you have to say. Uh, Israel had a hand in the manufacturing of the pages that exploded on Hezbollah operatives. Uh, this type of supply chain interdiction, supply chain interdiction operation having been planned for at least 15 years. 15 years. Now, US intelligence sources confirmed to ABC News the CIA had long been reluctant to employ this tactic because the risk to innocents was too high, the source said. Planning for the attack involved shell companies with multiple layers of Israeli intelligence officers and their assets fronting a legitimate company that produced the pagers, the source confirmed to ABC News, with at least some of those doing the work unaware who they were actually working for. Peter, wth?

Well, I, you know, It's interesting that a lot of the details regarding this attack has come out, right? Because the majority of such operations, we see supply chain operations like getting involved in that supply chain, whether it's very early from the beginning or somewhere en route where these different, you know, components, let's say, for whatever the case may be. A lot of these operations take place. This is one that is a little bit more spectacular, so everybody is aware of it. I mean, you actually saw the result, right? On TV you saw these different devices exploding, and we have, you know, reports about the injured, the past people that passed away, etc. But a lot of these operations don't come out to the light of the general public, and it could be, uh, a lot of them is going to be revolving along technologies that are being used by, let's say, the Iranians or the Russians when it comes to trying to roll out, you know, advanced military capabilities, nuclear capabilities, trying to get involved in something that's going to sabotage the development, like even say with the nuclear, the Iranian nuclear program, there's been several of these trying to sabotage the development of nuclear weapons by the Iranians, not just the famous Stuxnet breach that took place a number of years ago. There's been a lot of other smaller ones, and the important is to be able to get into the supply chain, and it's not easy because there's going to be the bad people, not only bad people, there's legitimate people that are in that are doing business in the supply chain. You know, you got to be able to get this past them for them not to catch that you're doing this. And some of them are not successful, but a lot of them are. And it could be from even some basic ones, including, you know, being able to get into the munition. And let's say you're importing, you're trying to send arm— you know, like guns and ammunition to a particular group. Somewhere. And maybe it's a terrorist group, and you get involved in that, in that supply chain so that the stuff goes through, but then it's non-functional or blows up in their face, right? And so these stuff— but these don't come out into the public, right? You don't hear about them. This particular one did. 15 years, I think that could be a little— I mean, I don't know, to me it sounds like a little bit of an exaggeration. Potentially 15 years ago could be the concept, oh, it would be cool if we could do the XYZ. But I think more of the planning is probably more in the last 5 to 7 years than 15 years ago. And I think what's really important, and the articles do kind of highlight this, that it, it, it involves a lot of human, you know, human intelligence, a lot of sources along the way, even sources within his, um, within Hezbollah, right, that are going to be able to understand, okay, what, how Hezbollah is using right now, before, you know, years before this, using telephones, and those telephones were easy to track, right? And we've seen some collateral damage. We've seen some damage right now with targeting specific leadership is because of the use of these, of the cell phones, right? That you're able to identify specifically where they are at a particular time. But this bullet, they realize that that is a vulnerability, and so they decided to go back to this old technology not really thinking or realizing when they went back to the old technology of using pagers. I mean, I remember using pagers when I was out in the field, and that was for that reason, basically, because it couldn't be traced. Uh, but how they were able to, to deliver these explosives within that pager and for them to go off, I think the technology itself maybe wasn't so, so that far advanced, really. You know how this was done, it's not that complicated, but I think the operation and the use of a number of human sources within Hezbollah, within the supply chain, etc., that was key because I think they did have this ready and it could have been several years where they had this in place already, just waiting for the right time. And maybe they had to detonate, you know, they had to detonate this operation in advance of what they had planned to, but I think You had it in place, you decided this was the time to do it.

You know, you mentioned human intelligence a bunch of times. It seems to me that there had to have been a number of people on the inside of Hezbollah that were actually operatives. And in order for this to all come together the way it did, they had to actually find the vendor, uh, or the vendor was introduced to them, or the vendor was suggested to them in some way. And then to actually procure the devices, to place the order, and then to get them into the right hands— like, there had to be somebody or a number of people on the inside that knew exactly where to get the devices, who to give them to. And that required probably somebody on the inside that had been on the inside in a specific position to facilitate this process. And I'm thinking, like you said, 5 to 7 years, that person had— those people have had to have been involved for a number of years, and they may still be involved, or they disappeared shortly after this occurred.

Yeah, with hindsight, it's kind of like you'd say, well, isn't it strange that Hezbollah didn't have anything in place to be able to sort of check these devices or a sampling of these devices to see whether or not, you know, any traces of explosive would show up or anything, you know, unusual would show up when they x-ray these. You know, maybe even a simple x-ray wouldn't, wouldn't even show anything. I don't know. But you would think there would be some sort of procedure coming in place when they're getting supplies, whether it's pagers or something else, to ensure that there's nothing within that shipment that could pose a danger. But I don't know. Once again, it could be somebody that's in that process that just said, hey, you know, we don't need to do this, uh, or then raise that particular, you know, requirement.

Prior to this occurring, would you have even thought that, that would even be a thing? Like, is that— is there any precedent here? Because you mentioned, like, you know, they should have x-rayed them, or maybe why didn't they actually— like, is that even something that anybody would even consider?

I mean, not— I mean, not really, but I mean, over these last few years, there's, you know Haven't a lot of the airlines been x-raying our laptops and stuff before explosives, you know?

Are they—

this is just another mobile device.

Yeah, yeah, yeah. Are they, are they actually capable of seeking out explosives via the x-ray? I mean, are they actually able to see like a C4, like a plastic explosive?

Oh yeah, I believe so. Yes, I believe so.

Yeah, got it. Okay. Yeah, nuts, man.

No, it's nuts. I mean, it's, it's, it's, uh, and I know some other people that right away they started, they put their, their, their cell phone, their iPhone away, you know, like a safe distance. They were just like freaking out, like, this is gonna, you know, these things could blow up on us. Um, wow. I said, don't even need to worry about this now. But I mean, it's amazing, you know, it's amazing, the risk, logical, you know, the cycle, not just the physical you know, damage caused, but the psychological damage, you know, as well as being able to really sever what was a secure communication channel for his border.

Now, I've been asked by others, like, what is the risk to the supply chain for consumers, you know? And what do you think is the risk to the supply chain for consumers? I mean, this was a specific, coordinated, long-term, well-thought-out strategic attack. What's the capability of the supply chain being interdicted, I guess, and then consumers being targeted?

I think it's very low. First of all, I don't— I'm not— I mean, I think the use of pagers today is very minimal. I mean, they must still manufacture them for some customers, but I think, you know, do you know anybody today that has a pager? I don't know if even if doctors use pagers. They used to be. You know. Well, I'm not, I'm not aware of anybody that's using the pagers, so I think it's very, very low that something like this specifically can be a threat to common civilians.

And then getting, uh, plastic explosive in a mobile phone, I think, would be very difficult due to the fact that there's just no room in there, right?

Right. You know, and maybe there will be, and there could— maybe there will be some sort of, uh, let's say, quality control check when they're in, you know, you're importing iPhones from overseas to ensure that there's, you know, they haven't been tampered with. Maybe there's something that, that can, or maybe there's something already being done, but I'm not aware of it.

Yeah, that's— man, well, thank you.

You're welcome.

I'm sure everybody thanks you too. All right, so, uh, cryptocurrency scams duped Americans out of $5.6 billion in 2023. The FBI received 69,000 cryptocurrency scam complaints. About half were related to investment fraud. Consumers lost a whopping $5.6 billion in cryptocurrency scams. By far the most prominent was investment fraud, which accounted for $3.9 billion. Uh, these investment frauds involve criminals building rapport with their target over time and convincing them to invest in low-risk investment opportunities using made-up profits and websites. Made-up profits and websites. The websites are made-up websites, all done with AI, look— have the look and feel of like a legitimate website. I mean, it is, it is a legitimate website, but it's fake numbers, uh, and that it shows the profits being made. And, and the, the crypto scams try to lure you in by sending you unbelievable digital currency deals that you can invest in. The FBI says that these criminals will never meet you in person and, and instead rely on text messages, video chats, phone calls, and emails. Once you invest in a cryptocurrency venture, it's very difficult to get your money back. So, Peter, this is awful.

This has been going on for quite a while. I think I, I mentioned earlier, one of our earlier shows, that it was reported— so it's public, public information— back in 2019, I believe it came out that, uh, there were 50 1,500 profiles on LinkedIn of individuals who, according to the profile, uh, worked for SpaceX, okay? And they were set up by, by, you know, whether it's Chinese intel service or scammers, and all these profiles, and a lot of them were very, very similar. So it's probably, it's kind of almost like a cookie cutter, a, for the most part, young, you know, attractive Asian women who got, you know, her, their first degree in China, worked for a Chinese company and relocated to the United States, got their master's degree in one of 6, you know, prestigious universities, and ended up as senior program managers for SpaceX. And they were like all pretty much the same. And what was the purpose? Basically, they would go out and reach, reach out to people on LinkedIn and, you know, requesting a connection. And of course, the individual, they see, first of all, very attractive lady, you know, appear to be very well educated, right?. And you sort of develop this, you know, uh, relationship, maybe more, you know, professional, social. They would talk about a lot of different things. This is, this is a slow process, right? It's not like these really quick things, uh, like, like sexual extortion, which can be a matter of minutes or hours. Uh, here, you know, they're cultivating them to the point of then eventually saying, listen, you know, I've been making a lot of money on, on, uh, some cryptocurrency investments I'm making, you know. And then they try to pull them in and they get that individual, the, you know, the target, to all of a sudden invest a lot of money. Now, these particular— I don't know if it was SpaceX or it was LinkedIn or somebody else reported it, and he took down these 1,500 profiles. But then a few months later, you could start seeing— and I saw several hundred of them already, already online again doing the same old thing. So there's a lot of different twists and turns, but at the end of the day, it's offering something via cryptocurrency that, you know, tends to pull on an individual's, you know, sense of wanting to make money, right?

Kind of wanting to make money. And they're also targeting people who are lonely. Uh, they target them via online dating sites, you know. Uh, and the scam— oh, the overall scams, the investment scams, are often called pig butchering. And pig butchering refers to, like, prior to butchering a pig, you slowly fatten it up. And over time, as you fatten it up, um, then you butcher it, you know, for its meat. Uh, and that's what it— like a pig butchering scam in regards to cryptocurrency investment scams is they slowly fatten you up, uh, and then eventually, you know, you've invested so much money and then it's gone. You never see it again.

Well, that's the thing. I think you should look at this: can I afford to lose everything that I'm willing to invest in whatever fun, right? If I can afford that, okay. But if I can't afford it, I mean, you got to see how this would be so devastating for me. And maybe what should I be thinking about, right?

And so the investments are made as a result of the relationship that's being built with the victim. So the perpetrator will contact them via an online dating site, via— you know how— I mean, I don't know about what your phone looks like, but I'm getting a text message almost every day, sometimes 2 and 3 a day, that are like, hey, sorry I missed yesterday's appointment, let me know if you want to get together today. Oh yeah. Or I found your— this phone number, it— I lost my phone, uh, I found this phone number, I don't have a name connected to it, can you remind me of who you are? You know, like, like all these like various text messages that look like they're coming from somebody who I'm supposed to know. And, and I'm supposed to respond going, hey, who's this? Or I'm supposed to react. But the reality of it is they want you to react because they want to get into some type of dialogue with you, anything at all, just to get contact. And once they get contact, that's when they build a relationship with you, right?

You know, between text messages and emails that are basically phishing, uh, I probably get at least 30 of them a day. It's just, it's getting annoying. It's really getting annoying. It's just like But, you know, and— but it must work. I mean, there's a squad— there's a percentage of people that are falling victim to these things. That's why it's continuing, because it works. Unfortunately, it works, man. I think, you know, one of the things, you know, not everybody— not— I mean, where they're really targeting people are typically going to be the— probably, you know, people in their 30s, 40s, 50s, and especially 60s. Those are the people that have the most money, right? And so they're targeting these individuals And I would— not everybody, but a lot of people do have investment advisors. They— and this is not, you know, don't— you know, if you are interested in doing some sort of investment that's being proposed to you, why not call your investment advisor and lay it out? This is what, you know, was— this is what has been, uh, you know, um, offered to me.

What do you think?

And if you trust your investment advisor, you, you know, listen, you know, hear them out. They're going to maybe bring some— raise some things that you maybe haven't thought about. So I think you should, before making any significant investment, call your investment advisor. That's what they're there for.

And beyond all that, don't respond to any weird text messages from anybody. Just block it.

Yep.

Yeah. All right, so Lifehacker talks about how to spot and avoid these utility scams. So how utility scams work— there are a number of ways scammers target utility customers, almost all of which involve a threat of your utilities being shut off unless you pay up. I see this happening a lot with small businesses, like if the lights go off, the computers go down, and they can't function, right? The FTC is alerting consumers of a scam in which you receive a barcode via text or email supposedly from your utility company to make a payment towards your bill at a retailer like Walgreens, CVS, or Walmart, which is so dumb. Um, customers of Pacific Gas, for example, and electric PG&E in California have been warned of phone scams in which callers threaten to disconnect utilities unless you send an immediate payment with a prepaid debit card, a gift card, cryptocurrency, or an instant digital platform like Zelle or Venmo, right? Anything that they can— any way they can get money from you. Texas-based Austin Energy has received reports of scammers knowing specific details of customers' bills when calling, stating that their payment didn't go through, and then directing the victims to fake— to a fake site to enter the payment information again with Venmo, PayPal, gift cards, whatever. So the threat that your electricity is going to get turned off, your water is going to get turned off, your heat's going to get turned off is a threat. It's You know, and people want—

need—

they need their, you know, utilities. You need heat, you need electric, you need gas, you need electric for your food. Like, it could be scary, you know. You need clean running water, right? And so these scams, like every other investment scam, phishing scam, whatever it is, the threat involved in it is really what gets people freaked out.

Yeah, it's the fear, fear, right? Emotional. That's what they're using here is fear. And, uh, think about it, it's quite easy because with the utilities, typically, you know, you can pretty much with a 95% certainty know what specific utility company somebody is using because it's the geographic region, right? A utility company is going to have that geographic reason. So it's pretty easy to pick out people to target, uh, you know, using that name of the utility company. I actually had one thing I would really recommend is set up autopay for your utilities. This way you avoid these types of scams of people saying, oh, you're going to be cut off because we haven't received payment. Plus you avoid, you know, actually having a legitimate shutoff because you, for whatever reason, you failed to pay. Uh, and you can avoid, you know, having your credit maybe hurt if all of a sudden you fall way behind in utility payments. So I recommend that. I actually received an email this morning from my utility company, and I have mine on self-pay, autopay, which is great. But I received the same— my credit card was, um, you know, expiring, and I needed to set up, you know, update the information. And I had a link there to do it, and I thought it looked— I mean, it looked legitimate, but I said no. Let me go back to old school, how we do this, like how Robert Siciliano and I do this. We don't click on those links. We'll go on to the website of the utility provider, and if it's true, there's going to be a notification. And sure enough, It was true. There was a notification there on the website when I logged in and I took care of it.

I'm so glad you didn't click on that link.

I mean, it might have been this case, it probably was fine in this case, but it was probably fine.

But you didn't because it might not be fine. And how great would it be for the bad guy to pull the wool over a retired CIA guy, you know?

Oh yeah, yeah, gotta try to prevent that from happening.

So, so, you know, you, you get any request that you to pay utility bill, whatever the case is, either go through your password manager to log into your account, which you should all have a password manager if you listen— if you go to this pod broadcast, you should be— you should have a password manager. I know I do, and tell all my clients the same. So log into your utility. For us, it's like National Grid, right, for electric and gas for that matter. And then you log in for your password manager, and any notification in regards to paying a bill or a shutoff, whatever the case is, will be within your account. And so don't like make a phone call via the phone number that shows up in the email or click a link that's in the email. Go either search it via Google or go through your password manager or type in, you know, the actual URL into your browser, and generally you should be fine, you know. Yeah. And so Peter, like, to kind of finish off here, uh, Time magazine, which, you know, I'm a fan, always have been, I've been in it actually, has a 13-minute read. It's a huge article. Welcome to the Golden Age of Scams. This article is just like, you know, September. And I'm not going to go through the whole thing because it's massive, but it talks about how we are living in the golden age of scams. US consumers lost $10 billion to fraud in 2023, according to the FTC. That's a 14% increase over 2022. And I'm betting that the majority of that has to do with cryptocurrency. That, that tally is almost certainly an undercount. More than 3— right. And more than 3/4 of the victims, including one that they talked about in the article, don't report to authorities, authorities, that they've been defrauded. We are constantly baited by scammers by text, email, and phone. The average smartphone owner in the US gets an estimated 42 spam texts and 28 spam calls per month. And Peter's getting even more, according to RoboKiller, an app for screening calls. So this particular article is a, is a really deep read, and I would just recommend it to people. We'll provide it in the show notes. But it really just brings to light, like, that it may— you may not be the type of person that's going to fall for a scam like this. Like, Peter and I have a clue, you know. We're not going to click a link in the body of an email. We're not going to react and respond to a phone call or a text message, right? We have a clue. Right? Um, we are essentially, you know, experts, so we should have a clue. But then, like, everyday regular people that aren't so focused or really like we are obsessed about this stuff may get hoodwinked a little bit easier. And so for you, the audience, like, obviously you're smart enough to be paying attention to this pod broadcast, and so you want to know, okay? But then, as savvy as you might be, there is your parents or siblings or aunts and uncles that may be less savvy and so on, others in your life, even kids for that matter, that just might not be as plugged in, so to speak. And so I just think it's really important that you, who are, I guess, a thought leader, look kind of like we are, because if you're, if you're watching this or listening to this, I would consider you a thought leader when it comes to preventing fraud, right? Because you're thinking about it. Therefore, you should lead the charge to inform others as to what they need to look out for, and at a minimum, send this article to them and sit down with them, and in some cases, and go through it, because it's awful out there.

I highly echo Robert Siciliano's comments here because he pointed this article out to me, and to be honest with you, when I read it, I thought it was one of the best articles that I've, that I've read regarding, you know, scams and this issue that, you know, So I highly recommend reading it, taking the time to read it thoroughly, and also sharing it with, you know, anybody and everybody you think who can benefit from it.

Awesome. Thank you, Peter. So, uh, Peter, uh, where can people find you? What do you got going on? Where should we direct everybody?

Well, always best to probably look me up on LinkedIn. Um, my name on LinkedIn is a lot of information there. And always, uh, my— the website, counterintelligence-institute.com. I got 2 books on Amazon that are there doing very well. And Why Are You Messing With Me, specifically for individuals who are seniors, and then Confessions of a CIA Spy: The Art of Human Hacking. That can be the benefit of anybody really, to understand, uh, human hacking, and to include how fraudsters, uh, will use it. Pretty busy month this month. October is crazy for both Robert Siciliano and myself because it's Cybersecurity Month. But I plead with you Don't only think about cybersecurity in October. It should be 12 months a year, right? But at least, at least once a year, companies are focusing on it. That's what we're still doing.

Yeah, every month of the year should be Cybersecurity Month. Like every month, like every day, right? And then as far as me, uh, I am at, um, protectnowllc.com. Again, protectnowllc.com. Yeah, September, October, really, really busy months, uh, but, uh, you know, I have a bunch of stuff going on all year long. We have e-learning, we have live presentations via Zoom or whatever platform, and obviously, you know, on a platform live in front of your audience. My presentations are fully interactive. It's not just me, you know, droning on for an hour or two. It's me having a dialogue with the audience. It's a conversational keynote where I elicit responses and I challenge my audiences to kind of think differently based on, you know, their life experience and what they believe security is and isn't. So, you know, by all means, reach out. I'm here. Peter, last words.

Stay safe, take care of each other, and let's defeat the bad guys. Let's defeat the fraudsters.

Yes, and as my dad says, you know, be good, behave, and be careful. Talk to you soon, everybody.