The Security Guy and CIA Sy PodBroadcast

And welcome to The Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is My fault.

Peter Wormka coming to you from the warm Orlando, Florida. How you doing, Robert?

I'm cold.

Well, I think a lot of the nation empathizes with you right now because they're going through the same thing, buddy.

It's 9 here.

9. Yeah. Oh well, but you got that, you got a heater, you can put on a sweater, it's not so bad. Oh, I got heat.

Yeah, so next door to me they're putting solar on the roof. Yeah, this guy's up on the roof. Wow, in 9-degree weather putting solar panels in.

No thank you. No, that's not— they should take a day off. I think that's a possibility of having a mishap when you're getting that cold and your joints get frozen up.

And Icy.

Yeah, as well.

Listen, straight up, like, I know what it means to work for a living, okay? So for the first third of my life, I was an HVAC guy. I was a union pipefitter, which meant that I was certified in all-position welding. I got burn marks all over my body from welding. Uh, I, um, you know, was on top of boilers, in ditches, outside all year long. I've been in temperatures working, you know, with hard hat and, you know, overalls and the whole thing in below zero temperatures, both on the ground, on roofs, and in 100-plus degree temperatures, you know, like inside, outside, the whole thing. I know what it means to work for a living, and, um, this is not work. This is beautiful. Uh, this is easy. This is fun. This is engaging, different. And these guys next door to me, like, you know, I feel for them. Like, it's, it's, it's real.

Yeah, well, hopefully, hopefully they can get that installed. I mean, it's usually a day, a full day's work if not more.

I was outside just the other day shoveling just for an hour, you know, maybe an hour and a half, and the, the rest of my day was stunted basically. Like, that hour and a half being outside the shoveling part, the physical labor is not a big deal to me. I mean, I run marathons and stuff, so that's not a big deal to me. But it's— it was that cold temperature, being outside for as long as I was. An hour and a half is nothing, but it took a lot out of me, you know. It'd be different if I was like skiing, you know.

Yeah, it's exhausting.

But it took a lot out of me, which, you know, I mean, I am 56, but that shouldn't mean anything. The point is I'm just not conditioned for it, you know. These guys are more conditioned for it, but it wiped me out for the whole day.

Well, if you had this weather all year round, you'd be probably better conditioned, wouldn't you?

Yeah, yeah. So, so, hey man, uh, 2025, we've got a new administration and, uh, and we get TikTok. So what are your thoughts on this? Like, I have my thoughts. I know lots of people are confused by it. Is it, is it, is it, is it coming back? Is it not coming back? Are there really security implications? Are there really privacy implications? Like, really, like, what's the problem here? What's your summation of it all?

I can address more of the security concerns, I think, because of where I previously worked. And I think the security concerns by the US government are very, very, very valid because if we look at a string of severe hacks conducted by the Chinese government against really significant data, data, uh, you know, uh, databases over the last few years, it can reveal a trend here, a strategy by the Chinese to collect a considerable amount of information. You know, some of your, uh, some of our listeners probably are aware of the OPM breach, Office of Personnel Management, that happened in 2013, 2014, when basically, and this is confirmed, it was actually conducted by the Chinese. They were able to access very sensitive information on I think approximately 22 million individuals who have been granted security clearance, or at least who were investigated, had due diligence conducted on them, and including myself. I mean, I received a notification that my information was breached to include my fingerprints, okay? So that happened. Then shortly, After that, there was the Anthem breach, major healthcare provider. I think over 75 million Americans had their data breached through this healthcare provider. Then there was Equifax, over 150 million individuals had their information breached through that, through that breach. And that was also confirmed to be the Chinese. And then there was also like Marriott International, which impacted a lot of individuals because it also included the travel plans, uh, and passport numbers, etc., of international travelers. Then, I mean, only a few weeks ago was this major breach of the, like, 5 or 6 different telecom companies, and where a lot of information was scooped up, and to include even potential exchange of text messages and phone calls of individuals that the Chinese were interested in. And then now we have this, and I mean, there's a lot of discussion that's been going on for a long time about how TikTok could be used by the Chinese to gather this additional assessment information. Well, let me put this into practice. You know, who— what would the Chinese be concerned about? You know, the vast amount of users of TikTok are young people, right? So why would the Chinese be interested in them? If we put this into an intelligence sort of equation, if they're looking to actually recruit somebody, an American, for intelligence, collection and/or a manipulation in agents of influence, they would be using the information collected from OPM and some of these other breaches that maybe we're not even aware of. And they could be using TikTok because the family members who have TikTok accounts, that's additional, like children of targeted individuals, that's additional information that could be very, very, very valuable. And I asked this question because no one is really talking about it. You know, if in fact the Chinese would be interested in TikTok, and I'm sure they would, they probably have already gained access and collected a lot of the information already. All right, so maybe a little too little too late, I don't know. That's from a security standpoint, it is a concern.

So let me break this down for everybody a little bit, right? So Peter definitely surmised it, right? Think of it like this. So it's a Chinese company and the data is being served up from Chinese servers, right? And China doesn't screw around. I mean, they're a communist country and they have, without a doubt, backdoor access, or front door access for that matter, to pretty much every website that is hosted via Chinese computers. And I'm sure Russia, it's the same deal. And frankly, I wouldn't doubt if the US is the same. And that's a pretty bold statement. But, you know, it's entirely possible. You know, it's not too difficult to copy a website and its contents. It's not too difficult to get backdoor access to a website and its contents, especially if you are granted direct permission to do it. The technology is out there to create those backdoors, and companies sell access to that information as well. So depending on, you know, who is interested in what type of information, It's likely that the US has access to all of it, and so does China and Russia. The problem here for, like, say, a government official, like Peter mentioned, like high target individuals and their family members, is that, like, you know, many of us are using the same passcode across multiple accounts. And so if you have a username, which might be an email address, and a passcode to your TikTok account, which is the exact same credentials that you might use to access your Gmail account, well then the bad guy's in.

Very valid point. Mm-hmm. Yeah, there you go.

And so that's a big part of the problem, is that we are generally lax in our own security. And so if you're using the same passcode across multiple accounts and not using two-factor authentication for your most critical accounts, then if you have a TikTok account and again you're lax in your security, it's likely that China has access to whatever other accounts you possess that use the same credentials when you log into TikTok.

So yeah, the danger is not only when we travel— the danger is not only when we travel to China, right? Because I think I talked about this before, the danger here— you might never travel outside the US, but you're using the platform that, you know, Chinese can, can access. Uh, I, I think, I think I mentioned to you a few years ago, I traveled to China with my spouse. It was a leisure trip, it was a group trip, and I told her we're not taking any of our devices to China. We're not taking our, our phones, we're not taking the laptop, uh, or ebook or anything. And the only way we're going to communicate in the case of emergency, we're going to set up, you know, we're going to set up a burner email in case we have to communicate in an emergency back to our family. And we had no issues, we had no problems. But other people in the group, every evening they were uploading pictures from the tour to Facebook, and a number of them had their systems hacked within a few days of being there. So I mean, this is serious.

So can you just repeat like a very short part of what you just said to everybody so that they understand what, what precautions you took when you went to China? I mean, you basically went digitally dark in China.

I did. I mean, and some people maybe can't do that entirely. Uh, I, I went digitally dark because I took none of my devices and I did not log into any of my accounts, social media accounts or emails or anything while I was in China. I established a throwaway email address in case I needed to communicate with my family in an emergency situation, But fortunately, I didn't need it. But that was the emergency way of contacting if we had to. And because of leaving the devices behind and not logging into my accounts, I did not experience any sort of issues. I don't think I was hacked. I mean, I wasn't hacked at all. Meanwhile, other people in the group were. A number of them were hacked in a matter of a few days. They were saying something strange going on, my system seems to be hacked. And so, but what about business people, people that travel to China for reasons that need to be in contact, you know, maybe with the home office and things. What I highly recommend is still you do not take your normal phone or your normal laptop into China. You would take a clean one. We can almost consider it burner, at least. I mean, you might be able to use it multiple times, but only when you travel to China. And never use that to log into your own personal accounts. Only use that if you have to for you know, sending and receiving information that's pertinent to your business. Because especially, you know, business people are high-value targets for the Chinese. So you're gonna have to assume when you go travel on business, you are going to be a target.

Yeah, the Chinese are without a doubt like the most effective world pirates that have ever existed. They could care less about copyright, they could care less about patents. As far as they're concerned, it's all you know, open source, and they do whatever they want with anybody's intellectual property. They don't care.

Yeah. So I think regarding TikTok, we're going to see— the latest is that, uh, the new administration wants to give, I think, 60 days or 90 days before, you know, they would try to shut it down. And ultimately, they want to be able to have a U.S. company purchase it, or the latest thing was maybe a— I was gonna call it a joint venture, but the U.S. government actually, uh, obtaining part of it so that they can effectively monitor it. So who knows? I mean, there's a lot of politics also behind all of this, I'm sure. But as I mentioned earlier, I think some of the damage has already been done. Yeah.

So when you do a quick search on AI for what are the security vulnerabilities of TikTok, it says the primary security concerns regarding TikTok are centered around its extensive data collection practices, the potential for Chinese government access to user data due to its parent company location in China, and vulnerabilities that could allow attackers to gain access to sensitive user information, usernames and passcodes, including personal details, user viewing habits, and location data, raising concerns about privacy and potential misuse of this information. So yeah, you know, privacy issues, certainly. I think ultimately, because of, you know, where you and I come from, it's security issues. How can that— how can Chinese access to my information harm me? And generally, that's usernames and passcodes, any, any information that— look at the app itself, depending on its level of sophistication,, could potentially, you know, give back our access to your device in some cases. You know, I would imagine that Apple makes that very difficult to do, uh, and Android would— Google make that very difficult to do, but it's not entirely impossible, you know.

Another factor you haven't mentioned it there, but it's not, you know, it's, it's not necessarily security in a sense of our personal security, but for national security The Chinese could easily, I don't know, maybe some cases they already have, but they could easily use it as a platform for not only misinformation, but disinformation and manipulation of US persons, right? Or toward policies, procedures, I mean, policies that could be in interest of the Chinese government.

So in a similar vein, um, Peter, you know what— who, who Huawei is? Oh yeah, yeah. So Huawei is, uh, for, for, for all you who don't, is a Chinese multinational technology company that provides telecommunications equipment, smartphones, and other smart devices. Huawei is the world's largest supplier of telecommunications equipment and the second largest smartphone maker. So they provide essentially the backbone of the internet in certain parts of the world, similar to what Cisco does here in the US and abroad. But that being said, the fact that they are a Chinese multinational company, you do a quick search for is Huawei banned in the US, there are lots of Huawei-restricted products products in the name of national security here in the US. Because to have a phone that's produced or manufactured by Huawei means that there very well could be technology built into the chips and software installed on the devices themselves that would also provide backdoor access to anybody in China, overseas, in Europe, here in the US, and so on. There is such a significant degree of mistrust or lack of trust due to the fact that China just does what they want when they want. And it's not just China. Here, Kaspersky in the US, it's a Russian-developed technology. Built by, um, a, a small Russian company that did very well in the US for quite some time. And the US banned Kaspersky Lab Inc., a Russian-based cybersecurity company, from selling and updating its software in the US in September of 2024. The ban was issued by the Department of Commerce's Bureau of Industry and Security. You know, like too bad for Kaspersky. Um, I, you know, I thought that they were always a pretty good company, but, um, the fact that, um, they're Russian-based, um, was kind of, you know, doomed from the start because we don't have a— we don't have a good relationship with China or Russia at this point, you know.

I'm really glad though that the U.S. government has taken a closer look at this because it seemed like they had a blind eye to the— this this type of threat, you know, in the supply chain of, uh, using component, you know, using even components that might be provided by the Chinese and, and other types of products that, uh, you know, the U.S. consumer or the U.S. government actually is using. So it's good, it's really good that they take a closer look at these things. Yeah.

All right, so you know who this guy is right here?

Well, I recognize the name and the picture, but he seems like he's younger than that picture. What's going on?

Yeah, so Brad Pitt, like, you know, like, I, I think he's a pretty good actor. I enjoy Tom Cruise stuff, Brad Pitt stuff. Like, you know, I am of that age, kind of grew up with these guys, and, um, you know, they— I, I love all their films. Brad Pitt, he's always done a great job. Fight Club, you know, some of his films are pretty amazing. Uh, oh, oh, and AI Brad Pitt cons woman out of $800,000, uh, which, you know, we, we've seen this coming. Something like this had, had to have happened. Um, it's unclear whether she get any of her money back or her husband. Uh, it's not every day that Brad Pitt falls in love with a random woman on the internet and asks for financial support while enduring kidney cancer treatment.

I thought he was pretty healthy. And I thought he's physically and financially, so $800,000 is a good sum of money.

So unfortunately, one French woman believed the scammer who pretended to be the famous heartthrob actor via various AI images of Pitt in a hospital bed. She even divorced her husband and dished out €830,000 to help with his cancer treatment. The 53-year-old interior designer originally received a message from whom she thought was Pitt's mom via Instagram, and then she got another message the next day from none other than Brad Pitt himself, or so she thought. Thus began a digital affair with the two exchanging endless heartfelt messages and poems. Mind you, the interior designer was married, but apparently not happy. In fact, she said that she and her rich husband had been going through a difficult time, which is perhaps why she latched on to the alleged actor. I mean, who better to save you from a failing marriage than Brad Pitt, says Vice.

He doesn't have a good track record. Are those— are there pictures, uh, showing him, uh, in the, uh— they're just pictures, right? Showing him in the hospital bed and things like that.

Yeah, so, uh, let me see further down.

I think I took a glance at it earlier. Further down than that.

Pit hospital bed AI, uh, images. Yeah, I guess, right? Yeah, you know, it doesn't take much.

No, it doesn't. I mean, this is really, this is really a serious problem because, you know, it sounds like a lot of— it sounds like, you know, poor unfortunate victim. And yes, she is a victim, and it's been a lot of victims. And, and whether, whether it's for $10,000 or a million, you know, if people— a lot of times they end up giving everything, whatever they have. And they might even take out loans, they might take out second mortgages on their property., and, you know, their life is in shambles after this. And it's happening way too frequently. These people that are behind it, a lot of them are based in Nigeria, not exclusively Nigeria, but a lot of them are. And, uh, they will typically cultivate, you know, during a typical day they might have, you know, cultivating, you know, a good 5 to 10 people. And along the way they do this for a living. They're very good at it. They understand human psychology. And, uh, they, you know, the, the system that they use is, is very well thought out, and it has a lot of what you call contingencies. If, if a person, you know, all of a sudden says this thing, you know, like, they will, they will find a way to get back to them and, and, and change their opinion on something or to help them. I mean, there's always— they always— they're used to doing this. They're very successful.

Yeah. And, you know, people look at this and they go, how could she have been so stupid? Right. And Psychology 101 basically is, when you think about it, all of us, we have an innate desire to be wanted, to be loved. You know, we are an interdependent species. We require each other for our survival, for procreation, for that matter. And, you know, everybody at all ages just wants to be loved. We all do. And the problem with that emotion, that desire, is that it often can cloud our perspective and we engage in irrational decision-making as a result, to put it mildly.

Yeah, but there's— go ahead. Sorry.

No, you go ahead.

Um, well, not quite the same. There's another level of, uh, of of these criminals that are using, you know, the internet and, you know, getting, getting, uh, you know, maybe approaching people through some of these apps or even on Facebook or maybe even on LinkedIn. There's a lot of these investment scammers that are using platforms such as LinkedIn to eventually approach somebody, and of course the individual usually is relatively attract— professionally attractive right? And they will get this person in a conversation, and it might not be a romance scam, but there's some aspect of, you know, the individual, the target, the victim, is kind of like enjoys conversing with this, you know, conversing by text with this person. It's an attractive person, uh, that seems to be very intelligent. And so they are cultivating that individual as well to create that, you know, like, uh, they're very likable, uh, and they're cultivating them to trust them 100%, you know, and what they're doing, what eventually could be a crypto scam or some other type of investment scam. So there's a lot of different nuances to how these individuals will approach and build up their story and build up this relationship. But typically they won't— typically they won't use a— what we want to call video platforms. It's pretty much, you know, text messaging, maybe phone calls, and photographs.

And on top of wanting and needing to be loved, we trust by default. We, we, we want to and need to trust others. And, you know, when people say, well, I don't trust anybody, well, you kind of do. You know, as an interdependent species, trust is our norm. Trust is natural. Trust— we— it is more normal and more natural to trust others than it is to not trust others. You know, we pretty much give the benefit of the doubt all day, every day. It's what we do. You know, we pretty much walk into the supermarket trusting that people are going to be good, that people are going to be behaved, and they're going to be civilized. That we walk into school trusting that someone's not going to walk in with a firearm and shoot the place up. You know, we trust that when we get in a car driving 60 miles an hour down a road, that the only thing separating us from the people on the other side of the street is a double yellow painted line on the road. We trust that everybody's going to be responsible today, you know. So we pretty much trust all day, every day, some more than others, certainly. And when, um, we're in a situation like an unhappy marriage or, uh, a bad divorce or a death of a spouse or whatever, we go into a situation where like that longing and need to be loved is exasperated at a much higher level, and we begin to seek, uh, comfort. And, um, trust is kind of like We just want to trust, especially if we're contacted by somebody who, uh, we feel are fulfilling our needs, whatever that might be. So romance scams are a billion dollar a year problem, you know. Yeah, here's one-tenth of that problem.

And even if, you know, a lot— if loved ones find out about it, you know, like, like the children, um, and try to convince mom or dad, you know, this is not a good idea, this just appears to be fraudulent, they'll tend to believe the fraudster over their own children. I mean, it's—

yeah, yeah.

And then they get to a point probably where they don't even want to tell their children because they think if they tell their children, the children are going to try to, you know, cut this, you know, romance off. I mean, it's really—

they're embarrassed. Yep. Yeah, they're embarrassed. All right, so Peter, uh, do me a solid, tell everybody, uh, what you're up to, where you're at, what you got going on, what you want to promote.

Well, this, uh, you know The end of the years are like— December is always kind of slow and you're like wondering what's going to happen, you know, how the next year is going to be. But, uh, after we turn the page on the calendar, January is turning out to be a really good month as far as a lot of interested individuals, companies regarding, uh, being able to present on my topics as well as provide, uh, 2-day workshops. I even got to— probably, probably something going to be happening in Brazil. We're going to Brazil, going to be going to Singapore. As well as a number of locations here in the United States. So it's really picking up. I think for both of our cases, myself or Robert Siciliano, if you're interested in, in potentially booking us to give a presentation, whether it's in person or, or virtual, you know, the sooner you think about doing that, the better, because as we go further in the year, it gets very, very difficult.

And yeah, yeah, I've had a bang. I've had a bang in January. My January is the best expense since 2000, 2020.

Yeah, that's fantastic. Yeah, yeah, thank you very much. Promote these books: Confessions of a CIA Spy, The Art of Human Hacking, and Why Are You Messing with Me? A Senior Survival Guide on Fraud, Security, and Privacy, available on Amazon. More information can be available on my website, counterintelligence-institute.com, or in LinkedIn. My, uh, also my profile on LinkedIn has a lot of information, so please, you know, feel free to reach out to me. What about you, Robert?

Uh, y'all can see me at, uh, protectnowllc.com. Like I said, January's been banging, it's been great. Keep it coming in. I think what's happening is that, like, even though phishing simulation training is really important for these big companies and it's, like, integrated in, like, a good 60% of most of them, still 40% don't have phishing simulation training. But on top of that, I think what they're realizing is, is that, like, that training just isn't enough. That they need people like you and I to come in and just kind of like rattle their cages a little bit and kind of like connect with them, you know, like connect like one-on-one-ish, you know what I mean, to kind of walk them through what security is and what security isn't. Now most people think that like security is like fear and paranoia and it can't happen to me, like they function in denial and they don't want to think about these things. And that's all like kind of the reality of where we're at because we don't want to think that like bad guys are going to choose me because we trust by our nature. And so like our training is designed to like affect people in such a way where like security is easy, security is interesting, security is fun. Like security is something that you want and security is something that you need. The way that Peter and I present it, like people get it, like it makes more sense to them. It's beyond just, you know, robotic phishing simulation training, do this, don't do that, or else. It's like Hey, you know, like, security is like a good thing. Let's talk about like what it is and what it isn't. You know, it's different. What we do is different. Yeah. All right, so, um, that's it. Anything else, Peter?

Well, keep safe, keep warm, and I'm looking forward to seeing you next time.

Awesome. Everyone.