TikTok ban, $6 fake identity, and causes of mass shootings. #33

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it. And good day and welcome to the Security Guy and CIA Spy pod broadcast.

I am Robert Siciliano and this is Peter Worm, uh, Robert, how are you today?

Hey buddy, I'm doing good. It has been way too long, uh, since you've been live.

We've been both busy on the road and it's just like we need to get— yeah, that's why we wanted to do this even though it's a little bit earlier than normal. We definitely wanted to do this today.

And you've been where?

Oh, where? I mean, if I gotta look at my calendar to see where I was. Well, I just came back from Turkey. I was in Turkey for almost 2 weeks, mostly pleasure, but you know, there's a little bit of business as well. And really, if you haven't been to Turkey, it's a fascinating place, especially if you're into history, right? Classical history. It's just amazing. I mean, here we talk about things being, you know, 100 or 200 years old as being old. We're talking about things being 6,000 years old, right? It's just amazing.

Yeah, my dad's been, and he has said equally, it is that good. Uh, that's awesome, man. So, um, I am actually, uh, the family and I are heading off to Mexico.

Oh wow, that'd be nice.

Yeah, yeah.

And yeah, how was the preparation for all of that?

So I do my research on, you know, travel.gov, and, um, obviously, you know, there's, there's been some kidnappings, there's been some murders, uh, and, uh, like any, you know, high-risk travel destination of course, there's pros and cons. And certain parts of the country are more or less, you know, vulnerable. And so where we're going, from the research that I've done, is there's not a whole lot of risk, at least compared to the other parts of the country. So going with the family, of course, you know, I have my concerns. And I would not be going to parts of the country where I was concerned.

Yeah, I mean, you know, as we know, I mean, you, you can make the decisions and try try to stay at the safer places. Uh, as we see here, even the United States, where is the safe place? And over the weekend, there was a shooting in front of the Regal Theater, right, you know, within a few miles of my house. Fortunately, nobody was fatally injured, but it was like 3 teens that had to go to the hospital.

Yeah. So risk is everywhere, you know. Part of what we do is, you know, to help you to manage that risk, right? Yeah. Oh, one other thing, um, in preparation for this trip, you know, we renewed our passports. Right? We renewed our passports back in December. And they're not— they don't expire until actually April, which is, you know, 4 to 5 months ahead of time. And what we learned was that when Biden opened up, you know, the travel to everybody and basically said COVID's over, everybody and their mother looked at their passport and said, "Ooh, my passport's expired." Right. And a glut of people went ahead and renewed their passports me being a responsible adult, just figuring I'd renew my passport 4 to 5 months ahead of time. I ended up getting in the middle of all that. And where it was supposed to be 6 to 9 weeks of my passport being renewed, it ended up being 12 to 14, which would have meant I would have missed my trip if I didn't.

Wow.

Yes. So the urgent passport thing, you can actually get an urgent passport. Here's the problem. Appointments for urgent passports are very sparse. When I was looking, there were appointments available in Seattle, Hawaii, and Puerto Rico.

And you had to physically, you had to physically go there?

Yes. So I would call every day at 8:00 AM up till 10:00 PM. And basically, you call every 15 minutes, And if in fact you get through to a human being, they transfer you to another person. And then from there, you end up waiting on hold for up to 3 hours. And once you get in touch with somebody, if there's ever actually anybody on the phone, they— if you don't get disconnected, usually there's no appointments available. And you just keep making those calls until somebody cancels an appointment. And I ended up finding an appointment in uh, Vermont, which is almost 5 hours up from where I live. So my wife and I rented a hotel room, went 5 hours up, and we actually— and they call that hitting the urgent passport lottery because most people don't actually get there.

And it's probably a lot more expensive too, right?

It ended up costing like an extra $120 plus a few other fees plus driving plus hotel. It's a whole thing. I would suggest to anybody, if you don't have any travel plans anytime soon, that you try to get your passport renewed 6 months ahead of time.

For Mexico, it used to be you could go with your birth certificate, and that would be enough.

Used to be. That's not the case now. You can't go anywhere with just a birth certificate these days. Keeping in mind that there are also 14,000 variations of the birth certificate, which are easily forgeable, which is one of the reasons why.

Yeah, absolutely.

Yeah. So Peter, we got lots of stuff to talk about today. Okay. It is just as messy out there today as it's ever been. First and foremost, we're going to hit everybody up regarding the LastPass breach. LastPass breach. Well, essentially here Gizmodo talks about top LastPass engineers' home PC got owned or pawned by a hacker's keylogger. The embattled password manager has revealed yet more security troubles that resulted from a data breach last summer. So for months, the company had been periodically providing updates about a nasty data breach that occurred last August. At the time, LastPass revealed that a cybercriminal had managed to worm their way into the company's development environment and steal some source code, but claimed there was no evidence that any user data had been compromised as a result. Then in December, the company made an update revealing that, well, actually, yeah, certain user information had been compromised. But couldn't share what exactly had been impacted. Several weeks later, it did reveal that what had been impacted— users' vault data, which under the right circumstances could lead to account compromise. Now, my understanding, my understanding, Razaad, regarding that vault data is that it was still encrypted. So passwords of the user would still need to be compromised, is my understanding. So my understanding is that to this date, no actual user data in its raw form has been compromised.

But it's still kind of scary when you see this is at least been at least the second time, maybe more we're not aware of. But the second time that one of these major password managers has been, you know, hacked into. So I think a lot of people are beginning to say, well, maybe I need to shift over to another, another provider. I don't know.

Yeah. So there is 1Password, there is Bitwarden. There is RoboForm. There's a few others out there.

Yeah, I'm gonna have to seriously look at an alternative because I use LastPass.

So if you do a quick search for password manager, right, you'll see a sponsored ad for Dashlane. You see more ads for cybernews.com. And then you scroll down and you CNET has the best password managers for 2023, and PC Magazine has the best password managers for 2023. I usually refer people to that article right there, right? And it goes over Dashlane, Keeper, Zoho Bitwarden, 1Password, and so on. And you can check the price, features and benefits, and so forth. That's a really good research tool to find out what your options are.

But Robert and I highly recommend that you use a password manager. They're very, very, very important.

There's really no other way to manage all the various passwords that you need in order to not have the same password across multiple accounts other than using a password manager.

And some of them offer a free version. And some offer, you know, a premium version as well that you would pay for.

But I usually download or recommend that people download the free version. Play with it, see if you like it, and then buy it because you're not going to get the functionality out of the free version that you really need.

And it's not a lot of money. It's really, you know, pennies on the dollar.

I spend $20 a year for a license. And that gets me access to a password manager on 18 different devices that I possess, including those for the family. And that's one master password that often includes a biometric or second factor.. And if anything happens to me, my entire family has access to my passwords, which I'm perfectly okay with. Yeah. All right, so Reuters talks about US House panel to vote next month on possible TikTok ban. So I've been asked to comment on this a number of different times in the media as to what this is all about and how it impacts everyday users and how it impacts, of course, you know, our critical infrastructures. So right Here, McCaul, who is the Republican, uh, uh, uh, panel, foreign House of Foreign Affairs Committee, said that the concern is that the app gives Chinese government backdoor access to our phones.

Correct me if I'm wrong, but the government has already banned U.S. government employees from using any devices that have been issued to them by the government, correct?

So I believe it has taken place on the Fed level. I'm not exactly sure, but I believe it has. And then it's up to the states in individual municipalities to require that ban locally and regionally, right?

This is going to be— this is going to be very, very hard, I think, to ban it across the table for all, you know, all citizens. Americans. I mean, well, I mean, you have a lot better understanding of the VPNs than I do. But it seems to me that you could potentially, if it becomes banned in the United States, is it possible to use a VPN to gain access to it?

So the short answer is yes, depending on the VPN, depending on how, or how that VPN works. The way a VPN essentially works is you can, or it should work, is you can choose the actual IP address of where you want to say your device is currently in the world. So if it's banned in the US, then you would set your VPN, say, to South America, Brazil, you know, or China for that matter. And then if, if TikTok was banned in the US, and you set your VPN for Brazil, and it's not banned in Brazil,, then you'd be able to access TikTok. Yeah. So, so to understand basically how this works, Peter, and I know you know this, is that like if you look at companies like Huawei, right, Huawei provides like the, the grid for 5G and other mobile hardware and software, right? Huawei is like H-A-W-E-I-I, Huawei. I think that's how you pronounce it. And that's essentially a technology that's, I think, banned in the US as well, right?

Yes.

And this is a Chinese-owned technology. And the reason for the ban regarding this particular technology and its hardware and software is that it's believed that the Chinese have a backdoor access into the hardware, which would mean that they'd have a backdoor access into all the devices that are on that network or on that using that hardware or using that software. Okay. And TikTok is a Chinese company. It's a privately owned company. But it's believed that Chinese have backdoor access into that software into their servers, which would give the Chinese backdoor access into the hardware, mobile phones, software of US government employees, or really any citizen.

Wouldn't surprise me at all.

And it's hard, really hard to detect if there is in fact backdoor access via hardware. Like, it has not conclusively been proven that either Huawei or TikTok, which is owned by a company called ByteDance, does actually provide Chinese government officials backdoor access. To my understanding, it hasn't been proven. However, what they're thinking is, you know, better be safe than sorry. Do we really need this? And is it worth the risk?

Right. So, this is something they're going to try to push through next month. I think it's going to be difficult, very difficult for it to pass.

Yeah. Now, for average citizens, and I've been asked this a number of different times, like, what do moms and dads, you know, what do we do? You know, how do we manage risk here? You know, what are our options? And I say essentially, there, from my point of view, I don't really think there is much risk here for most consumers in regards to your security, maybe privacy issues. Could that software get access to usernames and passcodes? I guess it's possible. But that hasn't been proven. And I think that if it was possible, I think that that would have been proven so far. Because having access, full remote access to a device's operating system, that would be a pretty obvious vulnerability. And I would imagine that forensics experts would have already determined that. I mean, every, every white hat hacker you know, in their brother would want to expose that. And if they haven't exposed it, it's because I don't think it exists. It is what it is. All right, next in line. This is interesting, Peter. So interesting and awful. Nearly all— NPR talks about nearly all U.S. mass attackers were male and faced major life stressor reports. Fine. So this is in regards to mass shootings, Peter, right?

I've heard, I mean, I've heard this before, that it's predominantly males that are, I mean, that are, that are the ones that are involved in these versus females. And it's, it's kind of interesting to analyze why might that be the case. One thing that kind of popped into my mind when I saw this article this morning is a lot of the individuals, males, have had guns I mean, for a period of time, even if they're younger, maybe they started shooting, maybe their parents took them out and they started to take, you know, practice using a handgun, uh, as a sport, when maybe a lot of, a lot of the females or young ladies maybe don't do that compared to, you know, young men. So is that— we all have stressors, and maybe we all kind of like want to reach out and explode and do something, but maybe part of the issue is that these males have that gun readily available versus some of the females that maybe would— would, I don't know, uh, do the same action. They don't necessarily have that weapon.

I don't know. I, I would imagine that that's part of it. I think that what it boils down to, from, you know, 30 years of studying the human condition and, uh, recognizing risk and understanding that I mean, you know, we know that human beings by our nature are predators, right? Humans are predators. Humans kill, right? So that chicken you eat, that's, you know, a killed chicken and killed by a human. Humans kill. And the only thing that separates human beings from other predators is empathy and sympathy.

Right?

Guilt and remorse. Whereas when you think of a lion or a wolf, they don't possess empathy, sympathy, guilt, or remorse. And so they kill indiscriminately. Whereas, you know, humans, we have a choice, or we understand choice. And we understand that choice based on, you know, need and want, and also empathy and sympathy. Human beings don't kill Many, most of us, because we see that as being wrong, or at least killing other humans. Whereas when you have disaffected, you know, 18 to 22-year-olds that haven't fully evolved to understand and embrace empathy and sympathy, they might have come out of their mama bad to begin with, with a lack of those characteristics., and they might be considered, you know, antisocial personalities, sociopaths, psychopaths, hardcore narcissists, and so on. And I think that that contributes to their, I guess, acting out, believing that a mass shooting will solve their problems.

You know what's kind of interesting though? A lot of these cases, they're already going out knowing that they're going to commit suicide. So why wouldn't they just commit suicide and not take down all everybody else in the process? I don't know what's the reasoning behind that.

I think it's from experience seeing what others have done and going out in a blaze of glory, and they look at that as being attractive, right? So U.S. Secret Service released a first-of-its-kind report, analyzes 173 mass shootings that took place between '16 and 2020. Basically, um, 73% involved, uh, the use of one or more firearm. Nearly a quarter of the attacks involving firearms, at least one of the firearms was acquired illegally by the attacker. Demographics: 96% were male, 57% were white, 34% were Black. 64% had a prior criminal history, not including minor traffic violation. 41% of the attackers were found to have a history of domestic violence. Online presence: majority of the attackers had identified presence online. Nearly one quarter were found to to have conveyed concerning communication such as threats and posts about suicide. Stressors— nearly all of the attackers experienced at least one significant stressor within the past 5 years. Listen, I've had a significant stressor in the past 5 years. You know, like you say, everybody, right? Like, everybody has stressors, you know, family illness, family death, um, a neighbor who sucks, you know, everybody has something. But that doesn't necessarily mean you're going to, you know, bust out an AR and take down 20 people in the process. I think it boils down to, you know, a person's emotional development and whether or not, you know, they have the perspective necessary to get through those stressors in such a way where they're not going to act out and look at killing other people as part of solving their problem.

Yeah, we really lack a lot of communication. I mean, a lot of these people, I mean, some of them are not communicating, so maybe some people are not aware what they are going through. People would tend to communicate by looking at their telephone and not communicating with people around them. Others do communicate or at least leave some signals and people are, you know, are not picking up on them or they do not realize the importance of what, you know, they may have to do if they become suspicious of somebody. You just cannot ignore, you just cannot turn your head and ignore the problem.

Never again, right? Concerning behaviors and mental health symptoms among the attackers, the report says 180 attackers that examined the report, 58% experienced mental health symptoms prior to or at the time of their attack, some of which included depression, suicidal thoughts, psychotic symptoms such as paranoia and delusions. It is that suicidal thoughts, psychotic symptoms, and paranoia of the 58%, that is obviously the most alarming and concerning. I've seen studies that show as many as 50% of all people suffer some form of mental health issues, right?

All of you— yeah, I believe it.

Yeah, yeah. And, you know, so, you know, that statistic is not unusual to me. Um, but I think it's, you know, that hardcore psychotic symptoms such as paranoia that leads to, uh, significant fear and uncertainty and thinking that people are out to get you. And when you are kind of backed in the corner in that regard, uh, feeling fear and uncertainty in that way, like people are out to get you, then acting out violently makes sense. Yeah, you know, uh, although obviously being wrong Mental illness is not a barometer for dangerousness, and it is not a correlation for mass attacks, it says. The vast majority of individuals with mental illnesses in this country will never be violent, which is like pretty much what I just said. In fact, often they are victims of violence themselves. So I guess it's for all of us who see somebody acting out aggressively, acting out in a paranoid way, and then on top of it all Um, you know, somebody who has access to firearms or mentions that they're going to use firearms to do something, that's really where people need to drop a dime.

Mm-hmm.

You know, Peter, check this out. Dark Reading talks about how $6 can buy hacked social media and streaming accounts from the dark web. This is incredible.

This is really, really interesting stuff.

The report unearthed a flourishing marketplace on the dark web for hacked entertainment services. You can buy LinkedIn access for $45, Facebook for $14, Instagram for $12, Discord for $12, Snapchat for $12, TikTok for $6. You can find the full research at wizcase.com. Most of these are obtained from social engineering phishing campaigns after hackers have compromised users' email addresses used at registration.

I found that— I was kind of curious when I saw, um, that LinkedIn was like on top of the list, like $45. Is that like someone actually taking over someone else's account, impersonating them, and using that account for various things?

That's logging in and getting full access. Yeah, because their credentials, their username, which is an email address, and their passcode has either been phished or it's been exposed in another data breach. Reach.

So then with that account, you know, they have a lot of people that they can phish from, from that new account that people are already trusting that individual because they believe that individual is, you know, actually in contact with them when it's actually the fraudster that's taken over the account and now is beginning to phish, spearfish, uh, a lot of people, I suppose.

Yeah, so with LinkedIn, uh, I think the reason why it's $45, why it's a high-value target right, or high-value access, is that being that it is a, um, business-related platform, connecting as a known individual, right, you know, like either you or me or somebody else who has hundreds of thousands of contacts, that might give access to company systems.

Right, right.

And you talk a lot about this, Peter, impersonating somebody on LinkedIn, either like usually setting up a brand new account impersonating somebody, but like what, what damage could be done if they are actually logged into somebody's LinkedIn account?

Oh, much more. And this is quicker. I mean, it takes a while to actually set up an account and, you know, uh, mature that account. It takes time. So $45 is a real bargain. I mean, Yeah.

I mean, like, once you're in, like, literally the damage that can be done, right? Like, you can pose as somebody, get access to find out who's in accounts receivable, who's in accounts payable, who's in manufacturing, like, gather the necessary intelligence on your target company. Based on, you know, you, you know, the bad guy is, is compromised a a known profile, somebody who's known, liked, and trusted, asking basic one-on-one questions about, you know, who do I contact to send an invoice to, who do I contact for this and that. And you've got somebody on the ground you're connected to that's going to give you all that legit information and even maybe introduce you to them.

Yeah, and there's 800 million LinkedIn accounts out there, so if there's There's a big pool potential.

Peter, tell everybody, uh, what you are up to these days, what you have going on.

Well, right now, I mean, I came back from Turkey and I'm up in the Washington area delivering a training program, uh, be going back home in short order, doing a lot of writing. I'll be coming out with a couple of books later this year. I got conferences coming up, uh, that I'm going to be speaking at, keynote speeches Anyway, I see you highlighted my book. Yeah, book's doing very, very well. And anybody interested in, uh, The Art of Human Hacking or social engineering, this book is a very easy read and provides a lot of insight. And it's available on Amazon in soft copy— in, um, I mean, sorry, in paperback and Kindle version, as well as audio.

Awesome. But you— and, uh, you can check out my team at protectnowllc.com. For those of you who want to check to see if your email has been compromised, you can go to our email checker, click on that, type your email address in here. We can search 12 billion compromised records to find out if your email is part of any particular data breach. And then from there, go to each of those accounts to tighten things up and change up your passcodes.

Awesome. I'm going to check that out, Robert Siciliano.

So Peter, last words.

Well, I know you're having a trip coming up. Safe travels, and it'll be interesting to hear your observations after you return.

Thank you, buddy. Take care, everybody. Be nice to each other out there.

Yeah, till next time.