The Security Guy and CIA Spy PodBroadcast

Welcome to The Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Hey Robert, this is Peter Warmka.

I'm wearing my black hat today.

What is that black hat, Peter? What is it?

Well, I just came back from a conference. It was the Convene conference in Tampa, and what I really— this is one of the best conferences for at least me who's involved in trying to create more awareness, you know, security awareness. This encompasses bringing people together who are, who are, you know, providing products as well as people that are coming from the companies that are trying to, you know, generate more security awareness, uh, products, mindset in their companies. And, and there's people that go and share, you know, the different things that they've tried, what works, what doesn't work. And it's, it's truly very, very interesting. At the same time, it's very, I don't know, um, disheartening because you hear from these professionals that working across all these companies of how, you know, most of them are really having a challenge in, you know, getting the attention not only of their leadership but especially getting the attention of the employees regarding this type of training. And, you know, they're trying a lot of different things, but it's just very difficult to get people to, you know, to buy into it.

Yeah, yeah. I saw a stat very recently, worldwide cybercrime and scams and who are the biggest targets, and the The way I read the stat was 65% of all scams and fraud is directed towards the US.

I believe it. Yes. Uh-huh. And this is where most of the money is too. I mean, when you think about it, right? So it's pretty easy pickings. Individuals got money, targets got money. It's easy to get information on them, right? And, uh, they can operate from abroad and they don't worry about becoming, you know, necessarily being arrested and extradited to the United States. That's very rare. It does happen, but it's very rare. So yeah, USA, uh, U.S. citizens are the biggest target out there in the world.

So now, I don't know if this stat corresponds effectively with the fact that 65% of all scammers target the U.S., but I read recently that 60% of those in the U.S., 60% of adults Don't read above a 6th grade level.

That's hard.

I mean, I heard things like this. I think it was 8th, maybe it was like 3 years ago and it was 8th grade level. I don't know, but that is really, really, if that, if that is true, uh, which I'm not doubting that really, uh, that is so, that, that's scary. We have the access to great education. I mean, we should have that access. We should, we should be one amongst the most educated populace, you know, populations in the world, but we, we are way below that.

Yeah, so I kind of believe that stat. I, I don't doubt it because when I look at what's going on in the world, what's going on in the U.S., and I look at how people act towards each other right? Road rage, everything else, the anger that's going on out there. I've always said that, um, you know, and believed that most adults handle adult situations, the world around them, like their 5-year-old emotional selves. Okay, we are like adult children having our hissy fits left and right. Okay. And part of that, you know, being the fact that, like, if you don't spend time to better yourself, educate yourself, be informed, right? Read. I read every single day. I read for hours every day. I mean, I'm reading, like, you know, what's going on in the world. I'm reading research material. I'm reading a little bit of fiction, um, mostly nonfiction. I'm just reading, like, what it means to be on top of what is new and ahead of what is next. Just being better, right, about myself, about my family, about things that I'm passionate about, like just my environment, like just in general, you know, learning about things, how to fix things, whatever it may be, you know. And when I see this, 60% of consumers, Americans, aren't reading above a 6th grade level. And I— and what I also see a lot is that like most people think they're so smart Like, most people that I, that I read on, like, that I see on Facebook, wherever, like, what they write, what they search, what they pontificate on, it's like, did you really do your research there? Like, do you really know what you're saying? Do you understand what it is you're actually communicating? Like, they think they're so smart, but they're really— many of them are just not.

Yeah, exactly.

And, and when they think that, like, they're so smart, I think that that also— what the point of all this is that it leads to them getting scammed because they think they're so smart. But really, like, I learned a long, long time ago in my early 20s, and I think it was a significant lesson. And I, I believe, like many kids do at that age, because you're still a kid at like 22, 23. And by the way, I was talking to a therapist recently, and like, I wanted to understand because my, my daughter's primary care physician said to my 19-year-old daughter, you do understand, and she said to my daughter, that your brain doesn't really fully develop until you're like 25, 26. Now when we were growing up, that wasn't a thing.

No, no one talked about that, really.

It wasn't even discovered. It wasn't learned. As part of science, as part of the— in the medical community, that wasn't a thing. And I asked this therapist, like, how long has the medical community essentially known that the human brain doesn't fully develop until 25, 26 years old? And she said, about 15 years ago. Think about that for a second. So it's, it's, it's not more than like 15 years ago 2010 that we figured out that an 18-year-old who is actually a legal adult in the U.S., that 18-year-old's brain doesn't really fully develop until they're like 25, 26 years old. They still have 6, 7 years to go until that child, that, that American adult who is really a child doesn't fully develop into an adult until 25, 26 years old. Like, that means something and it matters. And it— like, how that 18-year-old navigates the world as an adult who's really actually a child matters and has impact in that child's life and everybody around them and how they see the world. And I—

and when I—

the point that I was making is at the age of like 22, 23, I was pretty sure I knew it all. And I learned through hitting a couple of bottoms that the moment that you think you know everything, you know nothing.

Ain't that a fact, right? Yeah, yeah.

And you only really truly learn that with maturity, if you learn that at all. Fortunately for me, I learned it at a young age, and I learned that like, shit, I don't know shit. You know, but most people, I think, walking around right now today think that they know everything and they got it all wrapped up and they got it all figured out and they know. It's like, well, do you really? And when you have 60% of adults in America read on a 6th grade level, it says an awful lot.

That's why I mean this, this culture thrives on entertainment, entertainment, new, you know, entertainment news. Where it's not, you know, it's, it's got to be fun, it's got to be silly, it's got to be ridiculous, uh, but it's not really news. And so what, what, you know, what are, what are people consuming, especially the younger, younger adults, right?

And not only fun or ridiculous, it's got to make you angry to keep paying attention, I suppose, right? Yeah, for, for, for some specific news outlets, like if they're, if they're spouting anger issues all day long that make you incensed It keeps you watching, you know, they, they, as, as a media personality, because I've done hundreds of television shows, I'm the guy on the 6 o'clock news that talks about, you know, your baby monitor being hacked and, you know, bad guys or whatever, pranksters talking to your baby from, you know, remote whatever, some part of the world, that, or, or, or, or violent home invasion or, or shooting in downtown or whatever. Or a data breach. And, and the, the motto is, if it bleeds, it leads. So if it's like, you know, sensational, yeah, it's the top of the, the story of the top of the hour. So, so that's what grips people. We, we, that, that's, that, that's our, our emotional selves, our reptilian brain versus like our, you know, conscious selves.

Yeah, it's a challenge for us, right?

It is, because this all boils down to, like, you know, these companies are struggling to provide security awareness because we're reading at a 6th grade level. We think we know everything, we think we're so smart, and in the end we keep getting scammed. Why? Because we're not really listening, we're not reading, we're not paying attention, we're not consuming the information that we should be.

Smart. You're absolutely right. And there's a lot of information out there, a lot of information. There's a lot of, you know, reporting regarding people and companies that have been, you know, hacked. They've gone through, you know, great losses. But that doesn't even seem to, to resonate with people that much. It probably could— same reason you're mentioning, it doesn't— they're not interested in this material.

It doesn't move the needle like it should. Mm-hmm.

Yeah.

So Peter, uh, I queued up a video that I hope plays as it should with video and audio for our pod broadcast attendees. Uh, set this up for me.

Sure. This is, you know, we've talked in the past, and I'm sure everybody that's attending, uh, is listening in has heard at one point or another the problem with, you know, voice cloning, especially here about the grandparents scams. So this is just a simulation of what that might look like, and I think that will help individuals visualize. And also, you know, here, kind of like the language that's utilized in a typical sort of scam like this, whether it's, you know, with grandparents or some, you know, fraudster calling anybody who might be compelled based on the message that's conveyed to them to take immediate action to try to resolve the problem for their loved one.

Thank you. And then, because I'm just curious myself, and maybe somebody else who's viewing is too, give me a little bit of background. Like, how did this video come about? Like, the production aspect?

Oh, well, we better say that afterwards. But anyways, the, uh, there's a few videos that I like to, to actually produce using friends and family. So In this video, there are two young ladies who are my daughters. There is a— the threat actor who is my son-in-law, and there's a couple that are actually the ones that are getting scammed. There are some, some good friends of the family. So yeah, it's family and friends.

Oh, I didn't even know that. Okay, fun. Uh, and then, um, the production aspect of things, uh, who produced it?

Uh, I have a friend here locally that does a really Great job. He's done videos for me in the past here in Orlando. He went to, uh, university, Flag— uh, Full Sail University. And so he, you know, you can get some great products produced by just tapping the resources of these individuals who are currently, you know, studying film arts or maybe have just graduated. You don't necessarily have to go to a big company, which is going to be much more expensive. Uh, gives these opportunities to the, to the young people also to cut their teeth on this stuff.

Love it. So everything about this is grassroots. I love it. Okay, cool.

I hope it plays well.

Yeah, I'm gonna hit play.

Oh my gosh, you totally should have seen him. It was so funny. Oh wait, hold on. Hello? Hi, this is Emily. Hello?

Hello?

Who is that? I don't know.

No, whatever.

Telemarketers, I guess. Spam.

So he just recorded her voice.

Yes. Hello. Hi, this is Emily.

Now he's producing a clone of the voice, which he's going to use when he calls Emily's grandparents.

Hello, is this Mrs. Sandoval?

Yes, it is. Who's calling?

Listen to me very carefully. I've kidnapped your granddaughter Emily. If you ever want to see her alive again, you're gonna do what I say.

This cannot be true. Who are you?

Believe me, it is true. She's right here.

Grandma, please help me. I'm so scared. They might kill me. Please do what they say.

Who is this? What do you want?

I've already explained it to your wife. I have Emily, and I'll kill her within 3 hours if you don't follow my instructions.

What do you want us to do?

Go to the nearby Bitcoin ATM on the corner of East Colonial Drive and Dean Road. You're going to use the Crypto ATM to purchase and send me $1,500 worth of Bitcoin. I'll text to this same telephone the Bitcoin wallet number to which you're going to transfer the money.

I don't know how to do that.

Just go there and you'll find easy instructions. Once I receive confirmation of the transfer, I'll release Emily without harm. However, if the money isn't received, You'll be responsible for Emily's demise.

Okay, okay, please don't hurt her.

Don't waste any time. Don't contact the police. The clock is ticking and time's running out on Emily.

Okay, I'm going right now. Please don't hurt her. Okay, you can cut it there.

All right, that was pretty cool. That was well done.

Thanks. I mean, we initially heard about some of these when they first came out in the press, uh, but they continued to happen, uh, and you know, it's not necessarily breaking news anymore, right? The press has gone on to other, other topics, but these scams continue to be targeting, uh, you know, the parents, the, uh, the grandparents of, of kids. And usually, you know, they've been in a serious car accident, uh, or, you know, or they're kidnapped or whatever, to send, you know, an amount like $1,500 is not a big amount. And it's likely you're more likely to get that than if you were to say $20,000, you know, or $30,000. So a lot of these, you know, hit and runs real quick and that are very effective. And as we know, the companies are also, you know, have been big-time hit for millions and millions of dollars by, you know, threat actor, you know, using the clone of the voice of the CEO or CFO to give instructions about making wire transfers. So these are very common. I think that the thing to really note though is that a couple of years ago, it would take several minutes of voice clone, you know, of sampling to produce a clone voice. Now it's like between 3 to 5 seconds, and you can get a sampling practically of anybody's voice in 3 to 5 seconds. This was just a simple case of calling the individual, you know, they're saying, hello, hello, who's there, you know, and that's enough. And if their call goes to voicemail, and like many people actually use their voice, their own voice in their voicemail greeting, that's enough. So it's very simple, very simple to get the sample. And so many different products now that will that, you know, that are available for, for, for next to nothing that will produce real high-quality clones.

Real high-quality clones. Who is the, um, who are the grandparents?

Wait, in this particular case, the couple that was on the couch?

Yeah, the, the video.

Yeah, they were just friends, friends of the fam, friends of my wife.

They were adorable.

Actually, I have a separate video of interview of the gentleman in, in real life, he did receive a call, and it was somebody— it was not like his daughter's voice, saying that she was kidnapped. But then it was just a term that, that she, you know, this was in Spanish, and it was a term that she used, like, uh, uh, papi. And he said she never, she never uses that word. I've never heard that before. And here in this— and that was like the first thing, bang. I, I'm very suspicious of this because It was a term, a word that's used that she's not like her. But with the technology, with the products that are being developed, not only are they collecting voice clone, but they're also collecting sort of like your, your manner of speech, the type of words you're using, the phrases that you use. That's all being collected as well in some of these more sophisticated products. So yeah, it's getting more and more difficult.

So CNET talks about, did a family member call you asking for money or in this case, you know, ransom kidnapping. It may be an AI voice scam. Scammers can clone voices to trick you into thinking your loved one is in trouble. How to protect your money and identity. This is via CNET and Jeff Williams. Jeff has interviewed me a bunch of times. Uh, like something out of a science fiction movie, and it's not at this point, it's real. Criminals are using AI to create voice clones of your family, friends, and co-workers, all to scam you. In 2023 survey The antivirus company McAfee found that a quarter of adults across 7 countries had experienced some form of AI voice scam. The survey also found that 77% of scams lost money due to the interaction. The rise in AI-enabled voice clones has taken identity theft to an entirely new level. So it really has. You know, like my wife's voice is pretty distinct. I talk to her on the phone all the time. My daughters, uh, my dad, you know, you for that matter, and mine, you know. And our, and our voice, you and I, I mean, we're all over the web, right? My dad not so much, my wife not so much, but it doesn't matter because all they have to do is call you, uh, wrong number type of deal. Not even, you know, just, just say hello, and you say, hello, who's this? Hello, hello, is anybody, anybody there? That's enough, 2, 3 seconds. Now they've got your tonality, your pitch. They've got the clone, the necessary cloning, the DNA essentially of your voice in order to make a complete reproduction using every word in the dictionary.

It just makes it much more realistic. It's that trust factor, right? If you see the image or you see the video that's been cloned of someone you know, or if you hear their voice and that's their voice, you automatically believe, hey, that is definitely real.

Yeah, so at this point, like, depending on your profession, they're saying, you know, loved ones like you and I are vulnerable to our family members being compromised. Uh, your boss— if your boss calls you and you're told to transfer money from one corporate account to another, you know, like, you might do it, right? Real estate agents— scammers are creating AI voices to pose as real estate agents according to the National Association of Realtors. That's kind of a big deal, right? I work with realtors all the time. Lawyers have been fretting over the idea of criminals using AI to impersonate them to their clients or in a closing process. Your accountant or financial advisor, right? All of these professionals— like, look at it. If you're a bad guy reading this article alone, it's giving you all kinds of ideas, right? So how do you spot a voice scam? Maybe the conversation is brief. Maybe they're using words that you're not familiar with. Are they using terminology that's unlike them, right? I think that the most important thing is whenever you are receiving a call, if there's some immediacy to it, that right there should be a red flag. If it's revolving an ongoing transaction that you're engaged in, Uh, fine, maybe they're not getting your blood pressure up, but stop and think and say, okay, so if I do what they're asking me to do, which might involve completing a financial transaction, let me just stop what I'm doing, pick up the phone, and call a number that I trust to my real estate agent, my lawyer, my accountant, whoever it is that I might be engaging to make sure that the request that's being made of me is legit?

Absolutely. We need to verify. We need to verify. That's what it comes down to. It's relatively simple concept, right? It's just, uh, regarding that, you know, if that— if you have that incoming call and you recognize that caller ID number, right, it comes up as somebody you have registered in your phone, you cannot, you know, use that and say, hey, I know it's coming from that person because We've all heard of call spoofing, caller ID spoofing. Yes. So it's very easy for someone to use that, and that technology has been around for ages now. It's continued to be used, but that, that should not increase the trust factor, uh, when it comes to these things. To the contrary.

Yeah, that's a big one. Uh, Federal Trade Commission talks about caller ID spoofing, and there are products and services out there right now that you can consume that— I mean, there's apps that you can download that, um, will allow you to, you know, change up— like right here, SpoofCard, protect your privacy, you know, change up your phone number. I mean, it's right there for sale. And again, apps on, you know, Google's Play and Apple's iTunes or whatever that allow you to change up caller ID. Look at, you know, most of us have a general clue as to what's going on. And most of us are smart enough to navigate the world around us, but are we savvy enough to be able to recognize risk in such a way where the phone rings, you think it's your loved one, you think it's your real estate agent, you think it's your accountant, you think it's your lawyer, they're making a request of you that may be legit or in some cases extreme, and your response is to do it? Or to question it? Are you going to act or you're going to react? Are you going to do a little bit of research to find out, make a phone call? Hey, is this really legit?

Is—

do you really need me to do this? Like, I just wanted to clarify and make sure before I engage, before I pull the trigger on this and wire that money, pay that bill, pay that ransom, whatever it might be.

And your management I mean, they should, you know, they should definitely support, you know, your desire to, uh, to verify something, because that, that to me is, is being good stewards of, of the company, company's assets and everything. And I think, you know, we can always— you probably heard this before, but within our lease families, we should consider adapting a code word or code phrase that's going to be used in the case of an emergency. Just say that word and family members already know this is a true emergency and it's not a you know, scam.

Well, that's it. Uh, these companies need to educate their employees on what to look out for. The, the, the representatives who work with the general public need to inform their clients as to what to look for. Like, I think that the AI addition to fraud and scams is absolutely, positively 1,000% changing the game right now as we speak. And it's facilitating fraud to levels that we didn't think of 10, 15 years ago at all. The artificial intelligence is highly intelligent. It's better than the scammer. It's providing them the tools, the wherewithal, the technology to eliminate scammer grammar, right? And to just come off as that much more effective. And our brains aren't wired to deal with that.

No. And the thing is that we're, we're so accelerated all day with so many different things and distractions and getting this done, that done, that we're distracted. You know, we're distracted from being able many times to take that time and just really read it and think about it, unfortunately.

And we think we're so flipping smart.

Yeah.

Peter, tell everybody where you're at.

Well, I'm home right now, but I will be traveling. I mean, things are picking up and starting to travel quite a bit to, uh, provide workshops and training regarding, you know, security awareness training. And, uh, uh, both here domestically as well as I'm going to be going overseas. But of course I'm not going to televise that in advance because that's bad OPSEC, right? But anybody interested, or your companies might be interested in having me come out, please, please reach out to me. We can—

and your website?

Hey, counterintelligence-institute.com. And you can always find me on LinkedIn.

And your books?

Yeah, Confessions of a CIA Spy: The Art of Human Hacking, and Why Are You Messing with Me? Senior Survival Guide on Fraud, Privacy, and Security, both available on Amazon.

All right, and, uh, for all y'all that might be seeking me out, I am at protectnowllc.com. Again, that's protectnowllc.com, or just Google Robert Siciliano. I pretty much own the first 3 pages of search, with the exception of a DC-based HIV researcher who's a pretty heavy hitter. Other than that, it's just pretty much me. So, um, yeah, security awareness training. Uh, that's it. Uh, Peter, last words.

Hey, take care, be safe, and be a little bit, uh, skeptical when, you know, with some of the information that you happen to get incoming, right? A little bit of healthy paranoia is going to really serve you well.

Healthy paranoia. Awesome, Peter. Take care, bro.

Well, take care.