The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Warmka.

Hi Robert, what's up buddy? No, another day in paradise.

Yeah, so if you look at me, I'm somewhat pale and I'm wearing a hooded sweatshirt because it's like 10 degrees where I'm at. And if you look at you, you're all like tan. And what's that? What's that?

I'm always ready, you know. It's like being in the Caribbean sometimes. Not quite that warm right now, but I mean, we have the air conditioning on, I think, uh, and yeah, I can get tan just going out for a morning walk, 8:30 in the morning.

So that's what that tan's all about, is just from your morning walk?

Yeah, I don't use these, what do you call, where the people go to the sun, to the tanning salons and things like that. No, no, no, no, no, no, it's all natural.

That is awesome, and I am jealous as all heck. So there is something to living, uh, down south, and in your case, Florida. I mean, I don't know if I'd ever want to live in Florida, but I mean, no offense to anybody in Florida, um, but like, I'm like a New England guy, and, uh, but you like it?

Well, I mean, it's okay. I mean, I've been I've moved 15 times in my life, and I think my wife wouldn't, wouldn't be happy if I suggested moving again. We got our kids here, so, and our grandkids, so that makes a big difference, right?

15 times is a lot. Oh yeah, yeah, yeah. Well, being a CIA spy, I would imagine like you got to go where you got to go.

We gotta go where you're gonna go. And I mean, even before that, I was moving around quite a bit. But yeah, most of those moves were when I was was working for the agency.

Yeah, got it. Okay. Oh, oh, very cool. Uh, all right, so, uh, today, uh, everyone, um, we got a few topics to discuss, uh, one being these young men were tricked into sending nude photos, then blackmailed. The nightmare of sextortion, says USA Today. So Peter, this is a problem that's been around for quite some time. Um, it hasn't always been sextortion. It's always been extortion, and sextortion is, uh, in the digital age. Okay, so there was a website that, uh, was born at this point probably 10, 12 years ago called Is Anyone Up? And Is Anyone Up is now banned. I'm pretty sure it's banned. And the guy that, uh, ran it, I think he got arrested or persecuted or something happened to him at one point. At one point he was one of the most hated men on the internet. And, uh, that site was basically like women who were— in some cases men who were engaged in a relationship and that relationship broke up, uh, the, uh, the significant other that felt slandered or whatever posted all of their ex SOs' nudes on Is Anyone Up? Okay. And so from that, and that like became like a real viral site. And from that, sextortion was born. Because shortly after that, you started to see criminal hackers gaining access to people's Facebook pages and Instagram or anywhere else where they had private pages that they would post their own nudes. And eventually, like, those nudes will be exposed and then held for sextortion by someone who gained access to their site by compromising their username and passcode.

Okay.

And now today, sextortion is, is at a different level where Individuals are solicited by someone who they think is a potential, you know, mate or whatever, and eventually, um, they get that person to expose themselves, you know, like, send me a nude, and they do. And when they do, almost instantly there's a response with, hey, I'm not who you think I am, um, and if, uh, if you don't pay me so many dollars in Bitcoin, I'm going to expose this nude you just sent to me to all your friends and family because I've compromised all your various accounts. Whether they have or they haven't, they usually get access to your various accounts by friending you or whatever, following you, you follow them back, and then they know who your mother is, who your sister is, who your brother is, who your father is, who your friends are, who who your employer is and so forth. And they rattle off all those names, and unless you pay them, they're going to take this nude that you just sent to them and, you know, expose you.

Yeah, it's got to be terrifying because my understanding is the largest segment, you know, of the population that's really targeted and, uh, with this are young men, maybe from between 13 and 17 years of age. So that, that, and, and I think this is a much bigger problem than what we realize because vast majority of these things are, I don't think, are reported to law enforcement. The, the young men are probably so embarrassed that very few of them even tell their parents, and, uh, and they definitely probably embarrassed to tell their other friends or in the school. So it's kind of like there's like silent sufferers, uh, and there's a lot of trauma. It's not just the money that they may pay, but it also— can you imagine that torment? Because you don't even know. I mean, you feel like you've been violated, and now you don't know, are they going to come back at you even if you pay this money? They're probably asking for small, you know, a couple hundred here, a couple hundred there. What's something that they know that the young man is going to be able to— you know, maybe they got some money, they're using their parents' credit card, they're going to come up with that money, most likely.

They're gonna—

so they're gonna pay that, but there's no guarantee that these predators, scammers, are not going to come back at them again.

Yeah, I, I don't know that if what I'm about to say is correct, but I consider this a form of sexual assault.

Oh yeah, I really do believe it is.

Okay, so I was contacted by a friend of mine whose son, you know, Instagram connects with this young hot girl, and, um, over so many days, uh, they developed this relationship. This is what the mom's telling me. And then eventually, um, that girl turns out to not be a girl, or at least not who he thought she was. And, and, and he sent her a full frontal, like, you know, he took a picture of his face with his stuff hanging out and sent the picture. And then she, she says to me, you know, like, what do I do? Like, how do I find out who did it? Like, how do I get the money back? And what do I do? And I'm like, first of all, as far as getting the money back, that's done. You're not going to get the money back.

Yeah.

As far as finding out who did it, forget about that. That's a lost cause. Whoever did it's probably in Nigeria. I said, your biggest concern right now is, is not like what happened and, and, and where the money is and who did it. Your biggest concern right now is your boy and his mental health, his well-being, because right now he's suffering. Right now he's, he's experiencing what we would consider shame and embarrassment, and he feels violated, and that shame and embarrassment and violation has resulted in— and I said it as gently as I possibly could, you know, uh, suicide.

For some, there have been a number of cases.

Yeah, that's a real thing. Like, that happens. I thought that's an unfortunate effect of sex extortion. And so I said, reset the clock, get with your son, and just like make him feel whole. Laugh it off, but, but learn from it. Both of you learn from it. And parents who don't know what's going on in their children's digital lives are at risk of this happening. Not having these uncomfortable conversations ahead of time and explaining, this is what's going on, and this is the reality of the world that we live in right now, and you could be targeted and as a result of it, and there's no shame in it, but come to me first type of dialogue is what parents need to engage in before something bad happens.

Absolutely, because afterwards it's much more difficult. My— I had a situation in my family as well, a— about a year ago, my nephew apparently was approached by one of these online predators and track, you know, she appeared to be an attractive young lady, uh, but then again, you don't know what's behind that, right? So there was an exchange, I guess, of some photographs, and then it turned it around on him saying that he had to pay this money or this— these photographs were going to be released to family and friends and contacts. And, and it even went to the point, uh, my understanding is that he received the telephone call from what he believed was the local police department. I mean, they were— they went so far to, to pretty much impersonate law enforcement that they were going to come and, and, you know, pick him up if he didn't comply with what was being requested. It was— and so he was just terrified. And he, you know, he was trying to scramble and get some money, and then his, his, uh, mother, okay, is detected that something was a little bit off, and she finally just approached and said, what's going on here? Something is bothering you, tell me. And then he told her, and she just said, wait, wait, wait, wait, wait, wait, this is a scam. Do not take any action. Just drop the contact and, and, uh, don't comply. Uh, this is something that's happening way too much. And so, you know, she basically protected him from going, you know, going further into whatever, you know, whatever he was going to pay or feel, feeling traumatized. And you're right, you're absolutely right, because If these conversations happen, it's usually after the fact. If they do happen, if they were to be— parents be able to be more proactive. And maybe, you know, I don't know how much the schools also talk about this, right?

No, they don't.

They should though. I mean, oh, between the parents and the schools, I mean, those are the two biggest areas that could to actually reach out with that message.

Yeah. Um, So this particular article from USA Today, you know, just so parents have a better understanding, and, you know, potential victims of this too. So this, it starts off with, it was like around 10 PM on a Friday night in Indiana when one young man began messaging with a pretty girl from Indianapolis on a dating app, lying in bed and feeling lonely and bored, which is lonely, bored, and horny. He was exhilarated when she suggested they exchange nude photos. Hello. Minutes later, he started violently shaking after the conversation took a turn. The woman was really a cybercriminal in Nigeria and threatened to expose the nude photographs to his family and friends if he didn't pay $1,000. The scammers located his Facebook profile and compiled a photo collage of their sex, nudes, and portraits from his college graduation and a screenshot of his full name and phone number. He caved to the threats and sent $300. But a month later, his fears manifested into reality. A A childhood friend told him that she had received the nude photos in her Facebook spam inbox.

Wow.

I just felt my blood get hot and my heart went down the center of the earth, he said, the 24-year-old. It's not just teens who requested that his name be withheld, citing concerns that cybercriminals may track him down again and further extort him. I can't even begin to describe how embarrassing and humiliating it was.

So it makes me wonder if some of these guys, you know, these scammers that are also like— maybe there's a secondary market for those images. Maybe they sell them to somebody, right, for them to, you know, put on other websites or whatever they want to do with these images. It's possible.

Yeah, you know, this one bad decision could last a life, could, could cause a lifetime of harm. Look, there's nothing wrong with sexuality. There's nothing wrong with, with, with the, the, the, you know, a nude body. There's nothing wrong with taking a picture that you might share with a significant other, other than the fact that digital is forever. And once that naked picture is shared outside of your immediate circle either on purpose or because of bad security, it's it, you know. You just don't know where that's gonna go. And, uh, if it's shared with someone who you think you can trust but has malicious intentions, it's, it's over, Johnny. It's game over, you know. That's gonna be held on over your head for the rest of your life.

We're going to see a significant— I mean, this is already huge, but we're going to see a significant increase of these incidences because of AI. Because first of all, you have, you know, you have, uh, these scammers that have access to something like, like ChatGPT taking off the guardrails where, like, that, you know, whether it's FraudGPT or some other platform that has this, these capabilities with the, with with the guardrails being removed, it can collect a considerable amount of information on individuals in a matter of a few minutes, you know. So first of all, they're gaining all that information that you mentioned earlier that they can use, but it's, it's, it's amazing how quickly they can get this information. And then they can also, of course, create images. They don't necessarily have to be images that someone has freely shared with them, but they could actually even create an image that could be quite, appear to be quite compromising for the individual. And that might have the same impact as, you know, even though I didn't send, even though I didn't send that picture, I want that to go away, right? Because that could be terrible.

Yeah. In 2022, the FBI, the FBI issued a public safety alert about an explosion of sextortion schemes that targeted more than 3,000 minors that year that were reported. From 2021 to 2023, tips received by the National Center of Missing and Exploited Children's CyberTip line increased more than 300%. The recently tabulated 2024 numbers reached an all-time high, the organization says. So financial sextortion is the fastest growing cybercrime targeting children in America, according to the report from the network Contagion Research Institute. It probably has been around for decades, like we said, but in years past, people that didn't have the terminology or resources to report it in large numbers. Yeah, uh, since— in the years since the pandemic, reports of the black of blackmail surged. Kids were online more. Cybercriminals became more effective, and their operations grew in scale and organization. So, you know, I hear people say all the time, like, you know, cybercriminals are just so sophisticated. And I don't necessarily disagree with that, but I think that what they really are more than anything, more than just sophisticated, because, you know, I think what they are more than anything is they're organized.

Oh, I agree with you. This is not these like one-off person that's, that's just sitting in their house doing this. I mean, these are organized, these are syndicates, uh, that are doing these type of things. A lot of them are coming from Nigeria, but not only in Nigeria. I mean, some of these are coming from, from Asia. And we're, what we're talking about, big organizations, maybe, you know, of dozens of people or hundreds of people that are, that are, are actually running these. And some of them actually are individuals who have been The people behind the screen that are doing these sometimes have been individuals who have been human trafficked, and then they're controlled by people above them to do these type of things. I mean, it's— it's— this is a big business.

It's damn insidious, isn't it?

Yeah, it is.

Yeah. So I worked with McAfee, uh, antivirus, uh, when they were owned by Intel for a number of years, and, um, we did a study at one point called the Digital Divide, and and the study went out to like, you know, 2,000 kids and 2,000 parents, uh, and the, the questions revolved around, you know, what kids know about the internet and what parents know about the internet and what parents think they know that their kids don't know and what kids think that their parents don't know and all this, these questions, the digital divide. And what it boiled down to is like more than 25% of kids, uh, were essentially confessed up that they've not only communicated with complete strangers on the internet but met them in public.

Like, they—

yeah, you know, um, and parents throw their hands up in the air saying, like, I, you know, my My 15-year-old knows more about technology than I do and about the internet, and they— I give up. And it's like, well, I say to parents all the time, this is not a technology problem, this is a parenting problem, you know. And the more parents understand about their kids' digital lives, the more connected they are to the kids' digital lives, the more connected to, to their phones they are, the better they will be as parents, I think.

No, I agree with you. It's, uh, and it's also, I mean, it's the realization that, hey, there's bad people out there, and bad people can do, you know, a lot of bad things to you, whether it's, uh, over the, over the line, or especially in person, right, when you meet them face to face. I, I just think there needs to be more, you know, we always talk about how important testimonials are regarding what whatever type of scam or fraud, people that share testimonies, testimonials, so that people will understand, wow, this can happen, this could happen to me. It just happened to somebody that was just like me, right? And I think even, you know, for these young, young men hearing more and more of these real stories about what has happened to kids their age, and to the point of, you know, some of them even taking their lives, unfortunately. I mean, I think it's like, well, it would not happen to me, you know. A lot of the same attitude that a lot of people have when it comes to security— it wouldn't happen to me.

Yeah, that's just silly. That whole 'it can't happen to me' thing, you and I are in the process of squashing that.

Yeah.

All right, so we get time for one more. So right here, uh, arrests in luxury home burglaries targeting NFL, NBA players. Are the tip of the iceberg. It's not just, uh, NFL, NBA, uh, sports figures. It's also celebrities, politicians. Um, I've seen, you know, uh, uh, you know, more, uh, you know, if you think of the Bling Ring, if that rings a bell, um, was back in, I think, 10, 15 years ago. Uh, celebrities in LA were being, you know, ransacked, uh, left and right. And it's like, well, don't they have home security systems? Don't they have, you know, security personnel managing their property and so forth? And, uh, it's, it's— the answer is yes and no. So right here, uh, via the AP: For months, daring bands of thieves linked to South American gangs have been making off with piles of jewelry, cash, and some of the biggest superstars in sports, targeting like Patrick Mahomes, Travis Kelce. Sophisticated pillagers have deployed drones and signal jamming devices, sometimes posing as delivery drivers and maintenance workers to gain access to gated neighborhoods and thwart home security systems warnings issued by the NFL and NBA. But in recent weeks, investigators across the U.S. have made a handful of arrests. So basically, it was Chilean men, uh, who, uh, were busted, uh, stealing $300,000 in jewelry, uh, from Cincinnati Bengals quarterback Joe Burrow's house. It's that, um, posing as delivery drivers, Amazon drivers, as— and then, and then using drones and signal jamming devices to, uh, jam up Wi-Fi and jam up cellular networks. That's defeating the actual burglary systems. That, that's the problem right there. So that technology is being defeated by technology designed to do so. I, I think at this point that if you are a moneyed individual making 7 figures a year, that it is in your best interest to hire, uh, security guards to watch your property.

Oh, I agree. I mean, I have a— I have an interesting perspective on this. You know, I've spent a lot— many, many years overseas, and many of those years in Latin America. I mean, I'm very familiar with with Peru, Argentina, Brazil, and we all are kind of familiar with Venezuela based on what we hear. But in all those places, this has been happening for years and years and years and years. So it's like people in those countries have street smarts where we many times here really don't have them, right? And whether it's on the street or whether it's protecting our home, for so long here, people have been oblivious to any such thing like this happening. Then we have this surge of individuals coming in from some gangs, from some of these countries that have been doing this for a living and now find easy pickings here. So it's a— what my fear is, it's not going to be only these gangs from South America that are coming in and do this. There's going to be a lot of other, you know, criminals, uh, here in the United States. They're going to catch on that, wow, this is easy, you know, and they're gonna— they're gonna get on that bang wagon as well. So I agree with you 100%. Then, you know, uh, anybody that has a bit of money, it should be thinking about how am I going to prevent somebody from— am I a potential target? It's my profile, you know, my, my own profile, you know, as an individual. What's the profile of my house? You know, someone would look at it, whoa, there must be a lot of good things in there. So this is— I think this is the beginning. It's kind of a wake-up call. Really is.

Yeah, if you're a high-value target, uh, you need to make additional investments in your security. Um, I know that, uh, in parts of the country like LA, that, um, I know part of the Asian population has been a big target in LA because my understanding is they're a culture that doesn't necessarily trust banks. And I could be wrong about this, but that's something that I read, and that they store a lot of money, cash, in their houses. And so rings have been targeting this segment of the population, this demographic, for that one reason, using very similar tactics.

You know, the, uh, I mentioned some of these countries to you, and in all those countries I had neighbors who had their house— almost everybody, really. I mean, the vast majority of them had their houses broken into. Most of them when they were gone, some of them when they were there. And I never, you know, knock on wood, I never had that happen to me. And one of the reasons I think that played into that is I had a big dog and people were afraid of him.

Yeah, yeah, what is that? Yeah. Yeah, it's all about layers of protection. Home security systems, signage, this house is alarmed, um, beware of dog, uh, member National Rifle Association. You know, they think you're sitting in there with a shotgun ready to go. And then have your— all your lights on timers and give your house that lived-in look. And have somebody collect your mail, have a car in the driveway, and so forth, you know. And, and like, hey, I'm going on vacation with my family, right? And I'm going someplace nice and warm, but I'm not telling anybody when or where. You know, I, I don't, I don't put that out there on social media. I, I don't let the world know that I'm home or not home, for that matter. I'm not posting my whereabouts. I'm just not doing that because I, I'm not going to provide a ne'er-do-well with the necessary intelligence for them to be more effective. I'm just not going to do that.

You post those pictures after you come back if you, if you want to, right?

Yeah, yeah, exactly. You know, there's just no need to let the world know that I'm not home. So Peter, tell everybody where you at, what do you got going on, what do you promote here in Orlando?

But I mean, a lot of things coming up, both virtually and on the road, and, uh, in combination of it speaking at at conferences as well as even getting involved with some organizations that are interested in me coming in to give workshops, to, you know, to the workshops, especially talking about counterintelligence. And maybe a future episode we can talk a little bit about that misunderstood term, counterintelligence. But yeah, and so you can find me on my LinkedIn page or my website counterintelligence-institute.com. My books are still out there. You can get them on Amazon. And, uh, yeah, everything's going pretty well.

Well, you deserve it because you're a rock star. Uh, you guys can check me out at protectnowllc.com. protectnowllc.com. Uh, first two— the first two months of 2025 have been the best two months I've had in five years, Peter.

That's great.

Yeah, phishing simulation training is necessary and corporations have it in place. It's check-the-box compliance and they're realizing that check-the-box compliance doesn't necessarily mean security, that it's not enough. And live in-person or even virtual training, but live, is necessary to connect with the employees to get their questions asked and answered and get them on the same page as to what security is and what security isn't. It's not about paranoia. It's about putting systems in place to reduce risk. And phishing simulation doesn't really address that as well as it could or should.

Mm-hmm. Totally agree. Yeah.

All right, Matt, last words.

Be safe. Take care of each other. Hey, let's get through that cold weather, right?

Oh man, you're all tan, you look great. All right, bro, you be cool.

Take care.