Your password is already stolen! #25

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly— my name is Robert Siciliano, I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it. And welcome to the Security Guy and CIA Spy Podcast. I am Robert Siciliano, and the CIA guy is Oh, what's my name today?

Peter Wormka joining from Orlando. How are you doing, Robert?

I'm doing good, Peter. Happy, uh, happy almost end of summer.

Oh my gosh, are we really there? That my, uh, my air conditioning bill doesn't indicate that. It's pretty hot down here. We're in the 90s every day.

Yeah, my water bill doesn't indicate that either. Not— neither does my air conditioning bill. I mean, this is the summer of, uh, expensive.

Uh, that's right.

Every time I gassed up, it was, it was, it was $100. Every time I gassed up the boat, it was $200. Every time I paid a bill, it was $500, $600. Uh, it's, uh, it's, it's expensive.

You know, it is expensive enough, and we don't need to give our money away to, uh, criminals, right? But yet we, we tend to do that. How can we afford to take all this extra money out of our pocket and give it away?

Yeah, it's nuts, right? Uh, we got all kinds of stuff revolving around criminals and digital literacy and security to talk about today. Um, we're gonna go right into it, Peter. Uh, let me actually— yeah, let's talk about how to delete old accounts containing personal information. So McAfee, one of my, um, one of my good clients, uh, has a pretty good post on, you know, what it is that you should be doing to delete your data and why. So your digital footprint grows every time an internet account— within every internet account you make. While your old Tumblr account may be fun for reminiscing, dormant accounts are actually one of the most significant areas or source of use of user data on the internet. These accounts can be used by data brokers or third parties to access your personal information. So this isn't necessarily an immediate, you know, vulnerability as far as crime is concerned. But there's definitely a vulnerability when it comes to your data being slurped up by private investigators, in some cases, uh, definitely by data brokers. Um, and if those accounts are breached, you could have old credit card information up in there, you know, even current credit card information, enough data that, you know, could in effect be used against you in some way. So why you should delete all that old data: deleting unwanted accounts protects your information and prevents the monetization of your data. Right, and then how to permanently delete old accounts by platform. So you can just go to Delete— Just Delete Me— uh, sorry, justdelete.me, which is a site that has access to a number of other sites, and for a fee they will work with you to delete all your data, or they'll provide you instructions. So now down here McAfee provides you instructions on how to delete Facebook, LinkedIn, Twitter, Instagram, Tumblr, Pinterest, and email— various email accounts. Peter, like, what are your concerns here?

No, I mean, I, uh, I, I heard about this some time ago. It was recommended. I would think that you're looking at one— less than 1% of the people that actually do this, because most people are not thinking about it. But I think it's a really wise practice, not only in our own lives, I mean, as individuals who are operating in this digital world, but even companies. You know, we have these breaches of companies, and there's so much data there that, that, uh, is never really cleaned out, and it actually creates more vulnerabilities for a company. Companies need to as well try to trim down their holdings of what information are they keeping in their databases that they no longer use. We need to be much more I guess we need to clean up that amount of information there because you're right, if we just kind of like leave it out there, it is information that can be picked up by a lot of different individuals to include those that might want to use it to target us.

Yeah, this is a form of digital housekeeping, right? And just like, you know, cleaning up files on your devices, you know, optimizing your local device, cleaning up files in your iCloud, in your Google Drive. It's, you know, just keeping things in order. And then ultimately, you know, deleting various accounts that you're no longer using that could be used for nefarious activities and/or by data brokers isn't such a bad idea. It takes a little bit of time, and once you put that time in, it's a good thing if you do it. I've done it, you know, Usually every couple, 3 years, I'll go through my password manager, uh, and delete various accounts on my password manager, like every couple years. Then I've went from, you know, having like 1,000 various accounts in my password manager down to like 300 last time I did it. So I get rid of a lot of stuff. So in a couple of years, I'll do it all over again. And when you do that, you know, going through each of those accounts and, and, uh, destroying them, you know, erasing them from the net, is also, you know, advisable. And that's, that's what—

yeah, because think about two of these old accounts, they might still be active. I mean, it's possible that somebody can hack into that old account and then they got your username and password that you've used in that old account. And many times people are used— unfortunately they shouldn't do this, but they're reusing usernames and passwords. So if they get that, they might be able to get into other accounts that you have if you're using the same user password.

And that brings us to this article via VentureBeat.

24B? What does that B stand for? Billion?

Billion with a B. 24 billion usernames and passwords available for sale in cybercriminal marketplaces. 24 billion. So on my own device right here that I'm functioning from, I got a file, I had a folder, I have access to 25 million usernames and passcodes for various accounts, uh, a file that I found on the dark web, the deep web. And at any given point in time, I could just grab somebody's username and somebody's passcode and often just log right into their Gmail account if I wanted to.

Was that for sale, or were you able to pick it up without having to pay anything?

I didn't have to pay anything.

How's that? I mean, how's— they were just providing it free?

Yeah, that's what, that's what hackers, criminal hackers like to do. Uh, they like to share that data, they like to sell that data. They're nefarious by nature, some of them, and, uh, this is a game to them. So this particular article via VentureBeat, uh, talks about— hold on one second— um, threat intelligence provider Digital Shadows has published new research that found more than 24 billion usernames and passcode combinations in circulation in various cybercriminal marketplaces running the dark web, the equivalent of nearly 4 for every person on the planet.

Wow.

This number represents— and think about, think, think, and also think too that there are many on the planet that don't actually have access to the internet. This number represents 65% increase from the previous report from 2020. Within this dataset, they say, they found that approximately 6.7 billion credentials had a unique username and password pairing, indicating that the credential combination was not duplicated across other databases. This was 1.7 billion more than digital shadows found in 2020, highlighting the rate of compromise across completely new credential combinations. The most common password, 123456, represented, uh, less than half percent of the total of the 6.7 billion unique credentials. The top 100 most common passwords represented 2.77, almost 3%, of this number.

Yeah, but you see, when you're doing that, you're pretty much— when you're using those passwords that, uh, that are really are not providing you any level of security. It's kind of like leaving the, the, the cut— the doors of your car unlocked, right, with the key inside. Just take it, right? Yeah, you're making it so easy for someone to get into your accounts. Unfortunately, $24 billion is a huge, huge number. And I think, you know, we need to look at this as not something that you got some individual there that's slowly cutting and pasting these usernames or passwords. With AI today being automated, they can go through this information, you know, incredibly fast by automating with automation tools and using this as targeting information. It's really scary.

The automation tools that we are speaking of are called credential stuffing, is the automated injection of stolen username and password pairs, credentials, into website login forms in order to fraudulently gain access to use your accounts. So the software out there specifically for this purpose that does that— so think of, you know, the top 100 of the top 1,000 websites: Expedia, Visa, MasterCard, American Express, uh, you know, the top banks, Bank of America, and then, uh, Gmail, Hotmail, AOL, PayPal, Venmo, right? You name it.

AOL—

I'm sorry, um, what is it, uh, Amazon, eBay, Best Buy, and so on. Some of those accounts you may have two-factor authentication enabled, many of them you may not. So at protectnowllc.com, we have a tool. So here we are right here. You scroll down, check if your email has been breached, email checker. Click on that, right, and, uh, type in email address. We're going to type in Robert Siciliano. @gmail.com. And some of you are saying, oh, I can phish him. No, I'm not going to respond. I'm just not, you know. So your email and possibly a password have been stolen on the following breaches. This could potentially lead to identity theft. So in February of 2018, a massive collection of almost 3,000 data breaches was found online, which included 80 million unique email addresses and associated passcodes. In September of 2014, a large data dump of 5 million usernames in a Bitcoin forum that apparently I'm on. Bitly in 2014, they had, uh, 9.3 million usernames and passcodes. CafeMom, Cove, Dailymotion, Discus, Dropbox. What else? Uh, Epic, Forbes, PhotoLog, GateHub, Gravatar, Last.fm. I mean, look at them all. Right, a lot, a lot, right? So like a good 20, 30 of them, right? And then if you keep scrolling, uh, LinkedIn, which many of you are aware of this particular breach in 2016, 164 million email addresses and associated passcodes for logins for LinkedIn. So I, like everybody else, was a part of that data breach, okay?

Yeah, I think LinkedIn did send a notification to everybody, right?

It's like, we've, you know, but yeah, and they required, they required you to change your passcode when you logged in after that happened, right?

Mm-hmm.

But like you said, you know, if you're using the same passcode for LinkedIn as you are for any other account, even the passcode that you changed— LinkedIn might be updated, but the passcode that you changed might still be the same passcode that you use for your Gmail account.

And it's easy for a criminal to find out all the different accounts, right? Right. For example, you can use that site that you mentioned earlier, right? Um, that put in that email address and it's going to pull up all the sites or a lot of the sites where you're, where you're using maybe that same username, right? Across different platforms.

Yeah. So right now a criminal could search my username, in this case Gmail, know that if they have a passcode that works or that has been breached, that they could see if it works at Apollo, at bit.ly, at, you know, that Bitcoin forum, at CafeMom, at LinkedIn, and so forth, right? Easy enough. They could do it manually, they could do it automated. But, you know, I mean, as soon as I'm made aware of these things, I just go ahead and I change the passcode. Um, none of these accounts are all that critical to begin with. I never use the same passcode twice. And what facilitates never using the same passcode twice really is using a password manager. So by Googling P-A-S-S-W-O-R-D, uh, automatically, you know, password manager shows up. And do the search yourself, you know, there are tons of password managers out there. I usually like to point people towards the CNET article or this PC Magazine article right here. Click on that and it brings you to, you know, the best password managers of 2022. And it talks about password, uh, Keeper, Zoho, Bitwarden, LastPass, 1Password, LogMeOnce, RoboForm, Password Boss, Dashlane, NordPass, and so on.

Hey Robert, I got a question for— I know the answer, but I think it'd be good to talk about. You know, a lot of these browsers in our computer say, hey, you want to store this, you want to store your password. And I think a lot of people do that thinking that, oh, I'm, I'm being safe here, I'm storing my password, uh, in the browser.

The computer. So there's a couple, there's a couple problems with that. Number one, um, it's not as secure. Uh, it's not completely insecure, but it's not as secure as a third party, right? Uh, the other part of that is you may not—

you—

is the other part of that is the, the, the issue with transferability. So like on any given day I could be on 3, 4, 5 different digital devices between iPad, iPhone, Windows devices, Mac devices, and so on. I could be on a number of different devices in one day, one week, right? And so in order for me to access all those passwords across devices, across operating systems, across browsers, storing those passwords in one browser may not work as effectively if I'm jumping from one digital device to the other, whereas a third party facilitates that process. A third-party password manager allows me to install the password manager as software, as an app on each device, and I can pull up the, the app on each device and access those passwords that are stored in the password manager's cloud and locally on my device.

And a lot of these password managers have a free version and a paid version. So you could start out with the free version and see if you like it and then subscribe to the paid version, which has a few more, more benefits to it, right?

That's exactly what I recommend. And the other part of the paid version is generally, but besides bells and whistles, uh, it allows— it facilitates having a number of different accounts, whereas you might get stopped at 10 on the free version. You know, so using like a Word document or an Excel file for password management, that's something that people do, or they use one password that they remember. That's just, you just can't do that any longer. You can't use keystrokes across the keyboard, you can't use 123456, you can't use password1. You know, if we go back to, um, uh, ProtectNow's, um, a tool, right on the very bottom, you can also check passwords, right? So scrolling down See if your password has been breached. Click check and you'll see right here, I'll type in P-A-S-S-W-O-R-D, password, and the word password has been used like what, 9.5 million times?

That's scary. Yeah, I believe it.

Add a number 1 to that, password1, and that's used 3.2 million times. This is out of about 13 billion records. Still not okay, you know. So, uh, yeah, password manager solves most of those problems. Okay.

Yeah.

And yeah, I also don't allow websites to remember passcodes. Um, I don't, um, I mean, with the exception of like Gmail, which I'm at and in every single day, Amazon, which I'm at way too much, uh, but I still have two-factor authentication set up for all those various accounts. Which would mean that if anybody tried to log in from any other device, I would get a one-time text message with a one-time passcode from, say, Amazon or Gmail that would alert me that somebody might have my credentials and they're trying to log into my Amazon account from another device.

Yeah, we can't recommend that more, you know, more than we are because it's just, uh, It's, it's not that difficult to set that up. It's not much of an inconvenience, and it just increases exponentially your security posture regarding those accounts.

It's a no-brainer. So occasionally, right, I'll get a text message from Amazon, eBay, Gmail, Netflix, whoever, and with a one-time passcode. And what I do is I have a, uh, you know, I have iMessage and I have, um, you know, uh, uh, whatever, what's Apple's— is it iMessage? Is it iMessage? Is it iMessage? I'll respond to a group text on iMessage to my family, my daughters, my wife, saying, hey, is this for anybody? And usually like I'll get a response from my wife or another daughter saying, yeah, that's me. And you know, now they've got that one-time text. So I'm responsible for managing the two-factor authentication for a lot of our critical family-related accounts. And it's easy enough to do, and I'm happy to do it. I'd rather have that than, um, and they access it, than not have it at all. Or, you know, that, that, that mere inconvenience of me having to respond with that one-time passcode to my daughter who's logging into Amazon for the first time in a while is like a no-brainer for me.

Yeah, it's well worth it.

Yeah. All right, all right. Next on the chopping block, FBI says fraud on LinkedIn a significant threat to platform and consumers.

Consumers.

CNBC reports that the FBI says that it's a significant threat. Users around the country tell CNBC they lost small fortunes after connecting with someone on LinkedIn they believe was going to give them sound financial advice. The company acknowledged a recent increase in fraud and says that they removed 32 million fake accounts last year, Peter.

Yeah, and I think they put in there in that article— I don't see it right there, but They say 32 million, which they say is 96% of all fake accounts. But I don't know how— they don't— they really don't know the percentage, the whole number of fake accounts. All we can say is they took down 32 million, but is that 96% of them? Is that 50% of them? There's still— all I know is there's still a lot of fake accounts out there because I run into them all the time. This is really, you know, they have like 860 accounts today, or like LinkedIn profiles. And, and, uh, so, you know, whether it's 10 or 20 or 30 or 40 million fake accounts out there, I mean, this is a huge problem of people that can be out there for targeting us, right?

And the bots are continually creating new accounts, so it's a constant battle for LinkedIn. So this particular scheme that they're speaking of revolves around crypto. So the scheme works like this: a fraudster posing as a professional like a financial advisor, creates a fake profile and reaches out to a LinkedIn user. The scammer starts with small talk over LinkedIn message and eventually offers to help the victim make money through a crypto investment. Victims interviewed by CNBC say, uh, since LinkedIn is a trusted platform for business networking, they tend to believe the investments are legitimate. That is just so not the case. I mean, would you, Robert?

I don't know. I don't think I would ever trust someone who I never met to try to provide me advice or to give them control over my money. I would never do that. I mean, so the fact that individuals are doing that, I, I know that kind of concerns me that individuals are that trusting of individuals who they've never met before. And I guess maybe they're thinking it's coming through LinkedIn is— LinkedIn is not really a brand. It's not like Amazon and like another company. It's not like an investment brokerage firm where maybe you haven't met the— your personal advisor, but they represent a trusted brand. Here is LinkedIn is just a medium for communication, right? And you don't really know who's on the other side of that, uh, that screen.

The problem, as you know, Peter, is that the platform itself is generally considered trustworthy. Like, Facebook itself is generally considered trustworthy. Like, Amazon itself is generally considered trustworthy because, you know, we're on it, we do business with it, we have our information there. And then on top of that, people in general are generally trustworthy. Okay, so from my own research, all the years of just studying people and, uh, and just in, in, in research periodicals and so forth, I've come up with— it's about 1.5, it's guaranteed 1.5 of all human beings on the planet are sociopaths, psychopaths, some form of antisocial personality disorder. They don't have any form of empathy, sympathy, remorse, or sense of guilt. Okay, 1.5 guaranteed come out of their mama. Not trustworthy at all to about 3%. So between 1.5 to 3% of all human beings are just not trustworthy at all, at all, from their mama. They're just bad seeds. That means that 97% of people, right, on the, on the low end, and 98.5% of people on the high end are just trustworthy. Okay, keeping in mind that most people at some level have lied at one point in their life for one reason or the other. Okay, to save face, to hurt somebody, to avoid, you know, detection that they cheated on a spouse or whoever, right? So most people lie. Lying is a normal thing that is obviously frowned upon, but we do it. But those people that are just looking at LinkedIn and saying, oh, that person who's offering some type of financial advice, I generally should trust them— there's usually some type of a ruse behind it that makes them even more trustworthy. And that could be that they are friends or connected to other colleagues of yours. It could be that they offered you something of monetary value that you consumed from them, like a free percentage of a Bitcoin, that you're like, well, if they're going to give me like free— a free Ethereum or whatever, or a percentage of Ethereum, they must be trustworthy. And they might have got that free coin from stealing it from somebody else. And that makes the ruse all that much more enticing, or the victim that much more vulnerable or gullible to that particular scam?

I mean, many people maybe think that LinkedIn, you know, like other platforms, will do a lot— they'll do vetting of an individual before they allow them to establish an account. But LinkedIn is very, very limited on what they do. They're going to see with their algorithms if you are, uh, logging in from the location where you say you are established. I mean, but that you can easily circumvent those things. And once you establish an account, you're pretty much good to go unless someone reports you. I mean, uh, just because someone has an account set up on LinkedIn, it does not mean that they've been vetted. Just because they say that they work for a particular firm, those firms are not out there vetting whether or not people that put their names on LinkedIn as being employees, they're not vetting that either. So pretty much someone who's very skillful in deception can easily establish their profile and, you know, have a great story, right? And, and, and they may talk a good talk, and we just— even as you mentioned, Robert, they might have in their network people that belong to your network, but that doesn't mean anything either, because so many people will accept a connection request even if they don't know the person. So don't go by how many connections you have in common. That really doesn't— I mean, if you have a doubt, call one of those connections in common and say, listen, Yeah, how well do you know this person?

Yeah, all right, so right now I could set up a profile right now on LinkedIn saying that I'm an employee of Fidelity Investments right now. Yeah, yeah, and Fidelity Investments doesn't police that. LinkedIn doesn't police that. And as soon as I set up a, a profile that says I am an employee of Fidelity Investments, LinkedIn turns around and offers up all of these Fidelity Investment employees that I should connect with.

Yeah, they, they make it easy, right?

They do make it easy. And then from there, I just start connecting with Fidelity Investment employees to legitimize my presence on LinkedIn as a scammer or as a Fidelity Investment employee.

It's that easy.

So Peter, before I forget, um, I've been told by, um, one of our, uh, admins that I need to tell people at the beginning and towards the end of the, um pod broadcast to tell people to subscribe. So wherever it is, down here or up there or over there, wherever, can you please hit that subscribe button? Audience members, please do that like right now so that Dominica will stop yelling at me to tell you to subscribe. Could you just subscribe, please? Like right now. Thank you very much. I appreciate you doing that. Whatever platform you're on— YouTube, Anchor, Apple Podcasts— whatever you're on, please hit that subscribe button so that, you know, we can increase our numbers. And I think we're at like 25, um, 25 podcast— pod broadcasts, Peter. I think we're at 25.

Oh yeah, it's moving along quite well. I'm enjoying this, and hopefully the audience also is getting some good tips out of what we we discuss and we can entertain at the same time, right? Yeah.

So Peter, uh, what are you up to these days? What, what do you want people to be aware of?

Well, I'm actually working on some, um, quite intense projects, training, training, uh, programs. And I'm going to be starting next month on the road, giving quite a few, uh, presentations, keynote presentations at conferences. And a new— I mean, an extension of what I have already spoken about, where I do speak about, but a new to mention, I'm going to talk a lot about deepfake technology, and especially how deepfake technology can be used for deception in social engineering attacks. So we'll probably— yeah, we can maybe dedicate a future podcast on deepfakes. I think it'd be quite interesting, Robert.

So check out Peter's website at counterintelligence-institute.com. Check out his bestselling book. And check out his security awareness training. You could see, of course, me and my team at protectnowllc.com. We are, you know, providing e-learning and on-site. Just like you, Peter, September and October are really busy months for me, which I'm grateful for. I'm on the road probably about 3/4, if not more, of September and about 2/3 of October, and then things will calm down a little bit around Thanksgiving. So yeah. Last words, Peter?

Well, be safe, look out for each other, and subscribe.

Thank you so much, Peter.

Of course.