The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka.

And in case you haven't figured it out, Yet I am the spy and this other guy is the security guy.

So I am the security guy. I, uh, have been in my, uh, professional life a private eye, which isn't necessarily a CIA, but it definitely is a spy. Uh, I worked, um, you know, undercover, uh, which, uh, means I spent time basically following around people that were engaged in, you know, um insurance, uh, where they had some type of a workers' comp claim. My job was to follow them around and make sure that they weren't, um, you know, siding their house, right?

Getting pictures of them, getting video of them, right, as evidence.

Yeah. And so I would, you know, have a video camera and I'd sit out— I'd sit on them. I'd sit on their houses. I'd sit on their— on their place of work. I'd sit on their coffee shop. I'd follow them around and, you know, Um, I, I learned how to tail people and I got, you know, good video people. I, I'm sure I caught a bunch of people that were scamming the system because, you know, they were definitely doing more than what their, you know, um, insurance or their, their, I guess what their, their, uh, uh, illness or ailment or disability, um, suggested. So yeah, uh, I did that for a long time and then I did a lot of, you know, private, private stuff for individuals that do— wanted me to do the same thing, whether it might have been like divorce situations, you know, corporate stuff. And, you know, it's a— it's a— it's— it's— it's— it's fun, but, um, you know, it could be grueling too. And, you know, sit in your car, and I— and I've had like— I've been caught by people, neighborhood people, neighborhood watchers and all that stuff. And, you know, they don't like you being in the neighborhood doing that stuff.

No, absolutely. I'm actually— anybody who needs that kind of services in the state of Florida, I still retain my, my, my, uh, State of Florida private eye, uh, license. Anyway, regarding this, you know, the checking on people, the surveillance on people, as you can imagine, Robert, as you know, I had a long extensive career in surveillance, basically not surveilling people but making sure as an intelligence officer that I wasn't being followed. And we run what we call a, a surveillance detection route, okay? And then determine, you know, we go out, but it might look like a series of errands that we're running or meetings that we're holding. And we might be out there for 45 minutes, an hour, 2 hours, just to ensure that we have absolutely nobody tailing us, especially, you know, the opposition's security service before we go out and do the dirty deed or whatever the case may be.

I will say that when you do PI work and you do learn to tail people, whether you're one car or two car lengths behind them, whatever it might be, um, you definitely, uh, do learn how to watch your rearview mirror to determine whether or not anybody is following you. Uh, so I've become an expert at, you know, if anybody's paying any unwanted attention to me.

Yeah, well, it's actually a great example of situational awareness. You know, whether you're worried about somebody actually following you to, you know, just being aware of all your surroundings, rearview mirror, the sideview mirrors, not just focusing on what's ahead of you, but all around you, 360.

360. Yeah, head on a swivel. No question about it. All right, so Peter, um, we've got, you know, all kinds of interesting stuff to talk about today. Today, via Security Boulevard, one of our, um, uh, favorite publications, they talk about 7 ways to improve your personal security right now. And interestingly, the way that they are referring to personal security quite a bit is digitally. And I will say that not many in the security industry, when we talk about digital security, cybersecurity, internet security, do many refer to it as being personal security. Generally, from, from most security professionals' standpoint, security is referred to physical security as personal security and cybersecurity as, you know, cybersecurity. Um, but I actually refer to all security as being personal security.

I agree with you 100%. I had a conversation with someone the other day is that I think it's a misname, a mis— and, um, a misname of using cyber. Cyber is less tangible and people think, oh, that's not— it's nothing to do with me. But it's so much to do with these things that we can do within the realm of personal security that includes how we utilize the internet, how we utilize our computer, our iPhones that a lot of people say it's cyber, but really it's within the realm of personal security. You're absolutely right.

I totally agree. It's like we are brothers from another mother, Peter.

I want to meet your mother. I'll see.

Okay, password reuse. Okay, so, uh, look at it plain and simple. Most people should know at this point, especially if you, um, are a subscriber to our pod broadcast. And by the way, hit that subscription button. You know, Dominica keeps telling me, tell people to subscribe. Please subscribe. Subscribe it, share it, forward it, whatever you got to do. Um, so password reuse, right? So never use the same passcode twice. Use a password manager. Don't use the same passcode across multiple accounts ever, ever, ever. Don't use password as a password. Don't use 123456 as a password. Use a password manager.

Yeah, and I think that is one of the— that should be probably my recommendation, because I kind of know what's going to happen during this show. We've got a number of issues, but I would think this is the number one takeaway for today, using that password manager. I know a lot of people are using it. Some people might have it, they might use it off and on, but if you use a good password manager, That will resolve probably 90-95% of any password issues that you would have.

Today, the majority of data breaches that occur on a high level down to your small mom-and-pops and your individual users is as a result of people using the same passcode across multiple accounts and then bad guys, bad actors using a technology called credential stuffing, which essentially is when they get your credentials, usernames and passcodes from a variety of different sources because it's all over the web. They will stuff your credentials into a software program that then goes in tries to log in, attempts to log in at hundreds of top, you know, 100, 1,000 different websites. Once that software gets access and gets in, then the bad guys basically have access to your email, your bank account, whatever it might be, and they function as you, being able to either email people as you and/or move money out of an account, uh, as you.

So Robert, Robert, a question: why do we talk about passwords and the importance of changing those passwords, but we don't talk about changing usernames. You never hardly ever hear about that, but it's similar, right?

It is similar, but like account numbers, you know, like account numbers, like whatever, whether it's like a, a bank account number or a username or whatever the case might be, like that is a, is a relative known. For example, like human beings, like your relative known is your name, it's your address, it's your phone number, it's your email address. Like those are relative knowns. It's relatively public information. Some account numbers are a bit more sensitive than others. Like, of course, a credit card number is an account number. So that's a little bit more sensitive than other numbers. And then a Social Security number really is an account number. But we treat it as a password, which is why the Social Security number is vulnerable, because we treat it as a password. But all account numbers generally You really can't do much with the actual account number, with the exception of a credit card, with the exception of a Social Security number. But even with a credit card number, you have the 4-digit code, right, the CVV number, which essentially is a pseudo-PIN, right? But, you know, the relatively public front-facing information requires that passcode in order for the actual account to be accessed and manipulated and, uh, used without authorization.

Okay, makes sense.

That's how I see it. Um, yeah, so I mean, I have no problem giving out most of my information, including a Social Security number, as long as I have systems in place that basically make that data useless to the thief. So in my life, for example, and Peter, I'm sure you do this, is we've talked about this before is if you want to make your Social Security number relatively useless to a thief, then you want to have a credit freeze. And a credit freeze locks down your credit report, essentially making your credit— your Social Security number, uh, useless to a thief if they have it, because they can't open up any new lines of credit under your name, because that credit report is, you know, the key to the kingdom in regards to lenders who want to check your credit scores to find out if you're a good risk or not. And, um, you know, uh, Credit Freeze protects me from identity theft if they have my social. As far as credit card fraud, uh, I have push alerts or push notifications, so every single time there's a charge made to any of my accounts, I get a notification regarding that charge, uh, whether it's a dollar or more or less, it's a card present, card not present, international charge, whatever the case might be. So even if they have my account number and they make a charge, I can immediately refute that charge because I get notified in real time of all my charges, whether or not the credit card company recognizes that charge as being fraud or not. I get notified on every charge through push notifications, and I can refute it, basically, you know, pissing off the bad guy and getting control over my accounts.

And these tools are free.

Free. Like, why wouldn't you do that stuff?

Exactly.

And regular listeners or viewers of this Pod Broad, um, should be doing that stuff by now. All right, so, uh, password managers are cool. I agree. As long as you have one and you train it to recognize a new passcode across every single account, and you train it over time. Because if you don't have one now, it could be a little overwhelming for people. You could do it in a day or a week or a month, whatever you want to do. But even if you did it over the course of a year, you're prob— you're 90% ahead of the rest of the planet. Because right now, statistically, only about 10% of the population uses a password manager. And for all the different accounts that you need to have, you really should have a password manager to manage all of them.

Absolutely.

You know, and then like, think of it like this, and I say this in my seminars, like, I have a mobile phone, you got a mobile phone, I don't even know my mother's phone number. I don't even know my father's phone number because I never committed it to memory. My mobile phone number knows what it is. And so if I want to call my mother, I just go to Bob— oh, I'm sorry, Mom, because she's Mom. And if I want to go to my father, I go to Bob because he's Bob.

I call him Bob.

Um, so yeah, you know, and the point is, is you don't need to remember a phone number the same way a mobile phone number. Your mobile phone remembers your phone number. A password manager remembers your passwords. All right, good point. Multi-factor authentication, that's just like, duh, you know. As long as you have it, your phone is that second factor. You get that one-time passcode. Peter, do you use multi-factor authentication for like every website that offers it?

I do, but there's sometimes that maybe they offer it and, and, and, uh, I'm not even You know, what I need to do, incorporate in practice, is to look on those websites to see that they may already have it. Maybe I missed it, you know.

Give me an example.

Well, I mean, there's a lot of, uh, there's a lot, a lot of the bank, uh, some of them will require you to incorporate multi-factor authentication, especially the insurance companies, the banks. But there's other, you know, there's other ones that might not. For example, Expedia. Does Expedia require it?

All right, let's ask. So I just did a quick search right here for PayPal two-factor, and on the top of search shows PayPal— what is two-step factor, two-step verification, and how do I turn it on/off? So if you want to turn on/off PayPal two-step verification, Google it. So Expedia, let's check it out. Let's see if they offer it, right? That's how we do this. Expedia two-factor authentication. All right, top of search, uh Uh, does Expedia have strong website? Expedia has been hacked. Uh, yes, Expedia maintains web security. One login. Uh, I don't see—

I don't think so.

I don't see it either, because if they had it, it would be up there. You would see it. So one login, right, is, uh, secure access to Expedia with one login. So, uh, your free trial is waiting. So look, this looks like a site a tool that works with companies that may not have that, uh, and, uh, will facilitate that process for you. So I would consider starting here, you know, uh, whether this right here is for individual use or corporate use, I'm not really sure. But, you know, hey, you know, if there's an opportunity there, I would say check it out. If it's more security, go for it, right?

Absolutely.

And then, uh, next on our chopping block is antivirus. Have it. Uh, I'm fine with pretty much all of them. You know, they all do pretty much the same thing— blacklists, whitelists, whatever the case might be. And then, um, that's usually how they work. You know, they, they blacklist and whitelist like ports in firewalls. That's basically what they do. And then from there, um, you know, uh, they all either have like a premium product with, uh, paid versus free. Uh, the paid has multiple layers like antivirus, anti-spyware, anti-phishing, and a firewall. And then free is just, you know, antivirus. I tell people pay for it. And the reason why you pay for it is all those layers of protection are necessary. I think you may have those other layers elsewhere, but I think with antivirus you really should pay for it.

But caution as well, though, because some of these— I've been seeing these phishing emails advising that your, you know, your antivirus software is expiring and you need to renew it. And click this link, right? So as we always say, go to the source, go to the website of the service provider. Do not rely on those notifications for anything that you receive via email.

Yeah, in the past few weeks I've received a specific email that looking like what's coming from McAfee.

Oh, I get a lot of those. Yeah.

And it said, and it gave me account numbers and it said, hey customer, your McAfee antivirus is expired and it needs to be updated. Please call our toll-free number or respond to this email with credit card information, which I'm doing neither. And, uh, and you can see it's plain as day that it's fraud, obviously. And the reason why you could see that it's plain as day is because I can see it. You know, there's multiple things, like they space out, you know, the phone number, they space out certain words, they change certain things so that spam filters won't pick up certain things. Like there's a number of things that they do to manipulate the content of the email primarily so that the spam filters won't see stuff. And I'll give you a quick example and you might try this in the future. So like I receive an email saying that's coming from McAfee and obviously like the return address in the email is definitely not McAfee. It's like some dude in Romania. But then if you go into the actual email and it shows a phone number, it's like in green. You can actually like highlight that whole phone number and then paste that phone number, say, into a text file. And what you'll see in the text file is a lot more numbers that didn't show up in the email, meaning that in between the green numbers were white numbers that you couldn't see because the background of the email is white, right? And the reason why they do that is because what the spam filters do is they pick up on characteristics inside of the actual email. And if they see a phone number inside the email, then they will in the future flag that phone number as spam. So what the bad guys do is they insert digits in the phone number and they wipe them out.

Interesting.

Yeah, bad guys, man. Love them. Predator. They're smart, you know, they're creative.

Yes, they are, you know.

All right, secure browsing. Uh, there's a few tools here, um, ScriptSafe, Ghostery, uBlock Origin, uh, NoScript and so forth. And, you know, secure browsing is, is, is, is tools you could download, the plugins you have that will work with Chrome and others that, you know, will look at all the various websites that pull up in the first page of search to determine if they're vulnerable. That's easy. All right. And then PGP, which is Pretty Good Privacy, basically is an encryption method that provides privacy and authentication through the signing of encryption and decryption of text, emails, and so forth. What I would suggest you do for a deeper dive is between PGP and disk encryption and everything else we've talked about is just, you know, check out this article. There's some homework here for you to do.

Yeah, this article will be— it's on the show notes, right? So anybody can go up and look at it and print it out or whatever.

Always. Okay, so next on the chopping block, and we spent a lot of time on that, so we're gonna probably talk about this particular article and then probably, you know, go go from there. All right, so Peter, uh, this is from Dark Reading: Long Con Impersonates Financial Advisors to Target Victims. Okay, so this is an important one because, you know, if your financial advisor is attacked, uh, or you are attacked, the relationship that you have between the two of you could be compromised. And so I'll give you a couple of examples right off the bat before we get into the article itself. Years ago, a former financial advisor that I had sent me a request on LinkedIn to connect. Now I called him and I said, hey man, did you just send me a connection on LinkedIn? He says, yes, that was me. I go, okay, so that's fine, but I'm going to tell you that I'm not going to connect with you. And the reason why I'm not going to connect with you is because I don't want anybody to know that you're my financial advisor on the internet. Because if anyone is to decipher that all of your connections, financial advisor, are your clients, then the next best thing for the bad guy is to hack you and then pose as you, obviously through your account, and then reach out to all of your clients via LinkedIn and socially engineer all of your clients and say, hey, It's, you know, Jim, your financial advisor. Um, you know, uh, this is, uh, there's a, you know, crypto coin is a new, uh, you know, investment that my team has been spending a lot of time on, and we suggest that you make this investment here. And, uh, you are going back and forth with your financial advisor on LinkedIn thinking, okay, it's my financial advisor on LinkedIn who's communicating with me on LinkedIn, and why wouldn't I just do what he says because he's my financial advisor and I know him and I like him and I trust him? And I explained this to my financial advisor. He's like, okay, and that was the end of that. Whether he connected with any of his clients, I don't know. He's not my financial advisor any longer. Um, and, uh, that said, you know, it's those relationships you have that could get you in trouble someday. So here, long con impersonates financial advisors to target victims. Cyber criminals are co-opting the identities of legitimate U.S. financial advisors to use them as fodder for relationship scams, also known as pig butchering. Where the hell do they get these names, Peter?

Well, they do draw our attention, right? What the heck is that? And we look into it.

It's pig butchering, man. Um, which end with the theft of investments. Okay, so fraudsters have donned the identities of legitimate financial advisors in an effort to gain trust of victims. It's all about trust before recommending fraudulent financial investments. According to Threat Intelligence Service Domain Tools, the con artists, most of whom appear to be located in West Africa— of course they are— have advertised on popular social media platforms including TikTok using the information of actual financial advisors, copying personal biographical information and work details. Very easy to do. Yeah, because if you put it out there, their goal is to gain the confidence confidence, to gain the confidence of their victims using message applications and email, and then convincing, convincing, love it, the individuals to invest in fraudulent cryptocurrency schemes. There you go. To date, the fraudsters have successfully stolen millions of dollars according to Domain Tools research notes. In the end, there are two types of victims in this fraud campaign. Uh, there is the, you know, victim who lost money in cryptocurrency And then of course there is the financial advisor whose identity was compromised and destroyed online.

You know, I don't want to slam financial advisors. A lot of excellent financial advisors out there, but I think sometimes there's more of a— the financial advisors are focusing on wealth generation and not enough on wealth preservation. Someone can spend their entire life working and saving up, you know, their money in their 401 for, for, and And that's great. The wealth advisor is helping them, you know, grow that. But then they're not really advising, in my opinion. A lot of them aren't advising them on how to safeguard this wealth, how to protect themselves from these types of cons. And so I put a challenge out there to any financial advisors who are listening and/or individuals who do have financial advisors to say whether or not are— have they provided any information? Can they provide some information? Regarding how to, to protect themselves. So I think it goes hand in hand, really.

So I agree with you 1,000%. I will say that I do have a significant client base that is in fact financial advisors, and I should have a much larger client base that are financial advisors. And I've spoken to a lot of their clients as well because they hire me to do security awareness presentations for their, you know, peeps. That said, you know, one of the things that I, you know, I start off with when I was speaking to the clients of financial advisors is, you know, your financial advisor provides you— this is what I said like right off the bat— your financial advisor provides you financial security. And today we are here to discuss a different form of financial security. Basically the security of your finances. And that's really what financial advisors should be doing, is that they should be providing a fully comprehensive and holistic version of the term financial security. Because if something goes wrong, one of the first individuals who they're going to respond to is their actual financial advisor. What happened? Or their bank, for that matter. So financial security should encompass not only, you know, keeping your finances secure so that you retire and live happily ever after, but keeping your finance— your finances secure so that you can retire and live happily ever after because your money wasn't stolen.

Yeah, I think it can take decades to build up your nest egg, and it can take minutes or seconds to lose it all.

And some people say, well, I have insurance for that. Yeah, but do you, do you really have insurance for all of it?

No.

You know, because FDIC only covers like up to a quarter million, and in some cases people will fight for the rest of their lives to get that money back. You're not necessarily covered, is my point.

So I guess maybe another point of, uh, advice would be these individuals, when they're creating these personas, I mean, that they're actually taking over the identity of a, of a known reputable financial advisor. That is, someone were to go on Google to see, oh yeah, that information is the same information I see on this other website. So they're building up that confidence. If you are approached by somebody, a, via social media especially, or telephone, that claims to be this financial advisor, look for ways to confirm it, right? Look for ways to verify it. Go to the website of that institution. To be able to verify that that actually— that person is there, because it's easy for someone to fabricate this information and impersonate someone else that is legitimate.

Yeah. And generally these days, you should be doing— I suggest you should be doing like, like, like, like for the past 1,000 years, you should be doing business with those who you know, who you like, and who you trust, right? And even those who you know, who you like, and who you trust, you don't give them 100% of your trust. You still have to check and balance. You still have to make sure that what they're doing is in fact legit. You still have to make sure that they're not pulling Bernie Madoff on you. You know, when you give— when you give up control over your finances, that means that that individual has a certain level of access to your money. But you want to prevent them from having such access that would essentially facilitate them the ability to wire all of your money out of your accounts without you knowing it. You know, you want to make sure that it's housed at like the larger Fidelities and Kestras and, and JP Morgan Chases of the world, opposed to in some, you know, bank or whatever that you— or financial institution that you don't even know who it is. All right, so Peter, talk to me. What's going on in your, uh, personal and professional lives these days?

I can't share personal information over the line here. We know we got You don't know who's listening. No, everything's going well and business is starting to pick up. I'm like, I'm beginning to see more and more opportunities, more and more invitations for workshops regarding security awareness training. Also the opportunity to speak at major conferences, being able to travel and do these things in person, of course, as you can appreciate, is so much more rewarding than doing it exclusively virtual. So doing more and more of those events and, and, uh, I wanna— I will put up on the show notes actually some information regarding the presentations that I do provide. So if any of you are interested in maybe, uh, what, what could be useful for your organization, either as a, as a keynote presentation or a, a, uh, 4 or, or 8-hour workshop, please take a look there and, uh, feel free to, to reach out. I continue to push my book Confessions of a CIA Spy: The Art of Human Hacking, available on Amazon. And I may be getting to hit the keyboard, and I'm writing a few other books, and I won't tell you what they're going to be yet, but later this year I'm hoping that, um, I'll come up with something that could be very, very useful. I'm excited about it.

Peter has, uh, 90-ish 5-ish star ratings on his, uh, book on Amazon, which is pretty impressive. And the reason why he doesn't have all 5-star ratings is because you cannot please everybody.

Oh, I mean, I got like even a, uh, uh, 1-star rating. And sometimes it feels like it's almost like someone that wants to make sure you're bringing the ratings down a bit. I don't know, because they put the— they put the star, but they don't put an explanation why did they give me only 1 star, right?

Probably because you wrote a book better than them.

I don't know, but it's part of the business, right? As you mentioned, you're always going to get some people that have various opinions. I'm happy with overall, uh, how things are going Great.

And your web address?

CondorIntelligence-Institute.com.

Lovely. All right, and see us, uh, Protect Now, me, Robert Siciliano, at ProtectNowLLC.com. And, uh, yeah, we're doing plenty of, uh, uh, virtual and live in person. Peter, I got a call, uh, last night from— I think it's the largest energy company the country. Yeah, and, uh, I booked a gig today from, um, another large cybersecurity company, uh, a managed security service provider that, um, has 270, uh, clients across the country. And, uh, I mean, they're an MSSP and they provide security awareness training in addition to, you know, all of their MSSP-type services. And not only do they provide security awareness training, they actually are a KnowBe4 affiliate and they provide phishing simulation training. However, at their conference, they want me to speak. Why? Because I bridge the gap between what security is and isn't, right? Dispelling all the "it can't happen to me" myths. Making sure that when everybody leaves that room, that not only do they understand security for what it is and isn't, they want it, it matters to them, and they appreciate it not only as what they need to do in their jobs but how they live their lives.

Absolutely. And not just to the job, it's their— right.

And security awareness training today doesn't really do that. No, but we do.

That's fantastic. Let me carry your briefcase, depending on what the location is.

All right, bye.

I might want to carry your briefcases.

Hey, uh, till the next time. All right, everybody be good out there. Be nice to each other.

Take care. All right.