Your Phone May Soon Replace Your Driver's License #3

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to the Security Guy and CIA Spy Podcast. I am Robert Siciliano, and this is Peter Wormka. How you doing today, Peter?

I'm doing great, thank you very much for asking. Got off a beautiful weekend, a Father's Day weekend, and, uh, now getting back to our jobs. And we realize why we have to make money, right, for our families.

Peter, how many, um, how many kids you got?

4.

You have 4? You weren't satisfied with 1 or 2 or 3, you had 4?

At 4.

How old are they?

No, I, I take it back, 3. I sometimes, I adopt other kids. In the process, but 3, 3 kids that I, uh, whoa, they're like 34, 32, and 27.

That's awesome. So now explain the fourth.

Well, it's a, it's a girl that I've, I've adopted several kids, like, uh, taking care of them through some charity organizations, you know, where you, you provide them with money to help them with their education. I've done that for a lot of years now in countries like Mexico and Brazil. And, uh, you know, so they send me pictures there. I mean, I'm sure some of the listeners also have that— they receive pictures of the child as they grow up, and you're sending— you send money to help pay for their education, and you can also correspond with them. They send you letters, so you can develop some sort of, uh— I mean, they're not your They're really your children, but you're kind of like adopting them and helping them grow, which is kind of— it's nice, it's satisfying.

Yeah, that's awesome. I, I, uh, I, I know somebody else that does that, and they, uh, feel the same way. That's, um, it's a, a very, a very generous, uh, way to, to give back and to, you know, um, uh, provide, uh, assistance to somebody who more than likely needs it. And the fact that you actually consider that you have a fourth child means that you really have your heart into it, which is a really beautiful thing.

And yourself, how many children do you have?

Yeah, so I have, uh, two. My— I have girls. Uh, my girls are, um, uh, 12 and 15, and, uh, they are actually 12 going on 13 and 15 going on 16. You know how people say you got a 12-year-old going on 25? Uh, I've kept my kids young. I've kept them relatively isolated from all the BS out there. Uh, the 15-year-old just got her phone this year, and the 12-year-old does not have a phone. They don't have any social media at all. And yeah, we've kept them relatively, you know, close to the hip and away from all the BS out there. But, you know, my kids do know the seedier side of life from my perspective. So, I keep them fully informed as to what to be aware of, how to have your head on a swivel, and good touches, bad touches, stuff like that. And they know about predators. You know, my 15-year-old, she actually gets on the train to go to school in the Boston area and she rides with a tactical pen and, you know, one of the last things I say to her, you know, before she gets on the train every day is, you know, "Poke him in the eye!" You know, so she really knows what to do in regards to self-defense and both of my kids have taken self-defense training. So, and they continue to take self-defense training and they actually take what's called model or impact model mugging. Which is, which is real-life adrenal stress training. Should they ever get into a situation, they know how to actually physically debilitate somebody should that be necessary.

Yeah, that is awesome. Your story about, uh, being able to keep the iPhone out of your child's hands is, is great. I did try to do this. Now, this is quite a few years ago where I told my oldest daughter, uh, I mean, this goes way back, that you're not going to get a phone until you're, you're older. And so what Actually happened is her friends chipped in and her friends bought her the phone. So I'm like, what can I— yeah, yeah, I think it's, it, you know, it's, it's difficult these days to really keep them, uh, away from, from these iPhones. And I think you even have some stories about that, uh, we're going to talk about today, the, uh, the sort of like the danger of that phone. Uh, it's become entwines so much in our lives and that it's, uh, it offers a lot of benefits, but at the same time it presents, um, you know, some vulnerabilities for, for all of us, whether we're a child or even adults.

It does, yeah. And uploading naked photos to your phone, all that stuff, that's what we're gonna be talking about today. So yeah, we'll just— so stay tuned. All right, so, um, uh, first, uh, bit of, um, uh, information for our listening audience today, our viewing audience, is right here. All of you at this point have heard about ransomware. Ransomware is software, malicious software, that when installed on your computer, essentially holds your data and device for ransom. And with the Colonial Pipeline hack and the JCB meatpacking hack and so many hospitals and colleges and government agencies and private corporations being victims of ransomware. Some are saying that ransomware is like the new pandemic or the digital pandemic. And, you know, there is some truth to that. And when you have, um, you know, uh, critical infrastructures like, uh, fuel supply companies and, um, water treatment plants where their data is being held for ransom That is significant. And, uh, right here, ransomware cost to grow exponentially to reach $265 billion by 2031. So in the next 10 years, they're saying that ransomware is going to be one of the, the largest, uh, most significant hacks, vulnerabilities, payouts, uh, ever. And you, uh, as a consumer, as a small business, as a large corporation as a company officer, this all falls on all of us. Nobody is immune to this. So this particular story right here, uh, via Security Boulevard, talks about the footprint of ransomware has been growing globally in terms of both impact and payouts for attackers, hackers, and thieves. However, it has also evolved into many dangerous forms nowadays as threat actors are stealing sensitive info through ransomware attacks and threatening to sell it in the dark web.. And we're seeing that all over the place. Um, $265 billion is the cost of ransomware by 2031, and that's just not in, um, payouts. That's actually how much it costs small, medium, large corporations, government agencies, and so on. $265 billion is a huge, huge number. Um, now ZDNet published this prediction made by Cybersecurity Ventures. This estimate includes the cost of disruption of business during and post-attack, harm to the reputation of the organization, and the cost of employee training following such an attack. So here you have this massive, massive number. What is that? Like, that's more than a quarter trillion dollars right there. Now, many organizations can ward off those costs simply by training people right now to prevent it. And most consumers don't know anything about ransomware other than how it affects their ability to get gasoline at the pump. Uh, and most small businesses don't want to think it's going to happen to them, therefore they don't make those necessary investments. Peter, what's your take on this?

Well, first of all, I would say, uh, yeah, that's— that figure, $265 billion, sounds high, but I would say that it is likely to be much higher than that because first of all, they're going by projections of what ransomware is currently costing, the fact of the matter is a lot of ransomware attacks are not publicly disclosed, okay? So there's companies that are being hit with ransomware and not reporting it, not reporting it. And so that, of course, if it's not reported, the figures for the cost of ransomware are under the real true amount that's— that is costing, uh, the U.S. economy, let's say. So I think the problem is a lot worse than most people can even envision by seeing $265,000. Sounds— wow, that's big. But that's still, I think, much smaller than what the real problem is going to roll out to be. Also, I mean, you bring out a very important point. You're seeing some of these ransomware attacks that are being reported. And typically, to meet the media threshold, it's the very large ones, right? The ones that are going to impact you at the gasoline station, or when you go into the grocery store and trying to get something that maybe is not there or very expensive because these large companies have been hit. But the reality is that there's a lot of companies that are being hit that are smaller, that don't seem to have that big of an impact on the economy per se or the individual. But in addition to these companies passing on that cost, let's say, to the consumer, where the consumer should care about. Consumers need to be aware that these ransomware attacks are no— are not only hitting businesses, you know, large businesses, but also small businesses and medium-sized business. They're also hitting individuals. And of course, you don't hear about that in the news. Individuals are also being hit on a regular basis with ransomware. All of a sudden, they'll open up their their laptop and, and they can't get into their information. It's been pretty much locked up. Everything they have is locked up until they paid that ransom. So I posed the question to individuals who are listening to us: what would you do if all of a sudden your, your computer was hit with ransomware? Would you, would you pay it? You know, would you not pay it? Would you just buy another laptop and say, I'm gonna reconstruct everything again. And you can make that decision. Would I pay $500? Would I pay $1,000? In some cases, people might pay that because maybe they don't have their data backed up on another unit. So if they lose that, they lost everything. Or if they decide to pay it, just like in real life with, with the large companies, if they decide to pay it and they get the de-encryption code where they get their information back, is that the extent of the, the breach, okay? Because I can gain access to my information, but it's very possible and very likely that the criminal group that actually installed that ransomware has now taken a copy of all your information that you have. Information that it could be, let's say, proprietary information that may be, um, based on your company or the company you work for. It could be information that could be those very sensitive, let's say, photographs that you thought, well, I only have these on my computer. I didn't even put them up on the cloud. No one's going to really, you know, besides myself, have access to them. All of a sudden, the entity that conducted ransomware has access to all those things. And even if they don't do anything at this moment, they can sell that information to other— or they can come back at a future date. And long story short, open up the individual, the victim, to not only paying for that information, then they think everything is fine, open them up to blackmail and a lot of other problems, uh, later on. So it's—

yeah, and the fact that you're actually— if you pay the ransom, you're actually paying a criminal organization. You're, you're sustaining their ability to do it again and again and again. And the FBI, you know, often will tell organizations, don't pay the ransom. But when it comes down to it, if the organization has not properly backed up or if they don't have redundant systems in order to get back to operations, uh, sometimes they're forced to have to pay that ransom. And there have been, uh, politicians that have spoke to creating laws preventing organizations from paying that ransom. And so Insider, Business Insider, talks about how the White House is urging private companies to take the threat of cyberattacks seriously as ransomware hacks increase significantly. So the Biden administration is calling on the private sector to do more in the fight against cybercrime. The number and size of ransomware incidents have increased significantly, the administration says. Um, the private sector needs to defend— needs to do more to defend itself in the face of a rising cybersecurity threat, the White House said. The number and size of ransomware incidents have increased significantly. The private sector also has a critical responsibility to protect against these threats. And all of that is absolutely true. And, you know, when it comes down to it, protecting your organization from ransomware is not an enormous undertaking. It's a matter of making the basic investments in your infrastructure. So eliminating legacy systems, which means you're eliminating older, outdated hardware, outdated software, You know, an organization should of course not be functioning on Windows XP at all. They shouldn't even be functioning on Windows 7 at this point. They should be functioning on Windows 10 with whatever latest critical security patches are available, or on Mac Catalina, or other networking, or other operating systems, Linux and so forth, that are updated. And as long as your hardware and your software is properly updated and you're engaged in proper patch management, management, which means the latest version of your operating system, your browser, and all of the various software programs that are on your, on your devices, along with properly backing up all of your hardware and software. And backing up means backing up locally and backing up virtually and having multiple copies of those backups. So it's, in some cases An organization might actually be backing up the encrypted, the, the ransomware encrypted version of their, uh, information. But if you have older, you do days and weeks older, uh, versions of your, uh, information, then generally you should be in pretty good shape. And as long as those organizations are also training their people, uh, frontline employees, managers, supervisors, everybody that has access to the any sensitive information or the operating systems, as long as you're training people on what to look out for, not engaged in clicking links in the body of the email when it could be suspect and so forth, then generally that should keep ransomware at bay.

I agree with you, Robert, and I think that focus really, as you mentioned, should be on that proactive measures to not being a victim— I mean, not being the victim of a successful breach. Because once you have that ransomware on your system, it's not just, you know, what am I going to do now to recover that data? I've lost control of that data. And as I mentioned earlier, there's a lot of other things that can take place. Look at it, even if you have a backup, and there's been companies who've been hit with ransomware and they say, We are not following Paul's advice. We are not going to pay ransom. We have a backup. We can be back online relatively shortly. And we don't have to pay that ransom. What then happens, and I think you've read about, is that those criminal groups will turn it around saying, OK, if you don't pay us for this ransom, the ransom that we are asking for, then we are going to publicly disclose portions of this information, which is going to be extremely embarrassing for the company and detrimental. So it's kind of like they still— there's still other— a lot of other things that can be leveraged by the criminals over, over the victim. You know, it's not just about paying the ransom. There's a lot of other things that, that can be fallout. So what's really important then is not getting yourself into that situation, mitigating the risk of becoming that target. And as you mentioned, the training of the employees, right? Don't click on that link, don't open that attachment. But I'll give you something that most people don't even think about. What, you know, when you receive an email and you keep on getting the same email every day and it gives you that unsubscribe button at the bottom, yep, how easy is it for, for that unsubscribe button to be actually the malicious link? I mean, that is— that can happen. A lot of people think, no, I'm— the safe way out is I'm just going to unsubscribe to this email so I never get it again. But that unsubscribe button is actually in a malicious link that has been in place. So there's a lot of things that the awareness and education piece is huge, and, uh, in order to help people and organizations not to be breached.

And even if you were to click that unsubscribe button and it be malicious, your device generally would need to be out of date, meaning your software would need to be out of date, your browser, your operating system, the various, uh, software programs like Adobe or whatever you might have would need to be out of date in order for that unsubscribe link to actually wreak havoc on your machine. Unless of course there is what's called a zero-day attack, which is a brand new, virus out in the wild where there is no patch for. But as long as your antivirus and everything else is generally up to date, even clicking that link, generally you should be safe. So that is basic cybersecurity hygiene, uh, again, making sure that your— all of your hardware and software is properly updated at all times, because even clicking that link, you should be okay in general. But I agree, that being said, you still have to have ongoing training.

Right, but I mean, look at some of these really large companies that don't have their software up to date. They don't have the patches put in place. And I think the consumers tend to be a little bit even less, you know, up to date when it comes to cybersecurity than the large companies they work for.

Yep. So Peter, check this out. Uh, I love this. This is great. This is, uh, via Gizmodo. It's about to really, really suck to lose your iPhone.

Okay.

Yeah, I thought that was a pretty catchy title myself. So what they're saying is, is that, uh, we are moving towards our driver's license being digital. Now, I love this actually. Uh, I, uh, carry, uh, I don't carry a wallet any longer. My wallet basically is the back of my phone where I have a couple of credit cards and my driver's license. So I am a Costco member And I've been waiting for years for Costco to get rid of the Costco card, right? Because it's just one more thing I have to carry. But now Costco has digitized, or at least made and provided an option via their app so that you don't actually have to show your Costco card. You can show the app, which has a barcode and/or a— what is the other code? The square one, what is that called? I forget what that, what that is.

Oh yeah, I know what you mean.

Yeah, so, um, I forget, uh, 53, that's what happens. So I don't actually have to show, uh, my card, I can just show my, my phone, my, the app. And eventually it's looking like your driver's license will be accepted in a variety of states. And in that regard, you know, the fact that you can pay wirelessly with your credit card but can't necessarily use a, um, driver's license yet. Uh, you know, uh, I think it's just a matter of time. But that being said, if you did lose your phone and it had the ability to, uh, charge a credit card, uh, be a driver's license, unlock a door, as what this article is talking about, that could be a problem for some people. So the evolution of the iPhone or at the phone in general as a do-everything device edged forward this week with Apple's announcement of iOS 15. And while some of the news features seems handy, the real-world implications could create a world of hurt.

Could.

And usually articles like this come out at the beginning of a technology as it evolves, uh, to kind of freak people out, because if it bleeds, it leads. But I am optimistic here. The main thing I'm worried about is the journalist says Is the growing capabilities within Apple's Wallet is that which is quickly becoming a little too useful. I don't agree with that. In addition to being able to upload your debit card and credit card, um, iOS 15 expands the ability to use Wallet as your car key, which is pretty cool, by adding support for ultra-wideband tech in addition to NFC, which is near-field communications. Lets you open up compatible smart locks for your home and allows you to store your driver's license and other government-issued ID. I think that is fantastic. So all that being said, uh, will your state eventually provide you with the ability to use your driver's license as the de facto ID? What they're saying is first is your driver's license will be available to be used electronically at the airport, which is more than likely the TSA will accept that as one of the first government-issued IDs electronically. Peter, what do you think about that?

No, I think all these things are cool. We talk about, uh, I mean, the convenience of this little, this little computer now that we carry with us everywhere that has everything on there, where the— even the telephone number has sort of replaced our Social Security number as being our most important personal identifier, right?

That's true.

Keep the same number our entire life. It's amazing how this has transformed our, our lives as well as our security and our security vulnerability. It kind of scares me, honestly, to think that all this information is on our phone and how easily exploitable today is to get to this phone versus getting into our file cabinets in our house. Now that sounds like old school, right? But if you have all that information that you want to carefully guard and you have that now on your on your phone, and a lot of that stuff will even go up to the cloud. I think it opens us up to a lot of vulnerabilities. And as you mentioned, if you happen to lose it, just think about how crazy people go if they're— if they lose a signal when they're out, you know, driving, and they can't get, you know, they can't get a call in, they can't get a call out, their battery runs down, and they feel like they're, you know, they're not connected. They feel like the world, the world stops, right? The world completely stops. And then if you lose your phone, you know, everything you have to do to get that phone back and get all the data back on there— people, people have seen become so reliant, so dependent on this, uh, phone that I think we're getting to a situation where, uh, we gotta do everything we can to make sure that we don't leave that phone anywhere, right?

Yep. So that being said, like, like anything else, right, you should have backup. So for one, uh, as we become and are more and more dependent on our digital devices and our digital lives, it's obviously really important to have backup for your backup. So I think that there'll always be hardware, like there'll always be cards, there'll be credit cards, there'll be driver's licenses, there's still a Costco card. I think that there'll always be cards. And so you have your backup cards, you have your backup keys, all in a safe place at home, generally in a fireproof safe, a fire retardant filing cabinet that's locked, obviously. So you have your backup, you know, physical, uh, forms of identify— identification along with credit cards and so forth. And then on top of that, you have your phone itself backed up. So if you're on an iPhone, you, you should have your phone backed up in iCloud.. So if your phone is ever lost or stolen, you shouldn't have a difficult time getting another phone and then backing up— that phone should be automatically backed up and you restore the newer phone, uh, from your digital backup. Now you should also, and I think, have a backup iPhone as well. So an older iPhone, or an Android for that matter, that you have sitting around that will accept um, the latest version of an operating system. So if you were to lose that device, you could restore the older one from backup, allowing you to make phone calls if necessary, obviously. And then in, in the case of driver's licenses or credit cards or whatever the case is, you have a digital backup of that as well. So as long as you're backing up and then of course password protecting the device itself from the get-go and keeping the operating system updated should the device be compromised. Um, as long as you do all these things, then generally you should be in pretty good shape. I mean, I have not had a digital disaster in such a way where not having access to my phone wreaked havoc on my life. As long as you have backup and properly protect that device, you should be in pretty good shape.

Well, I agree with you, but there's another aspect of these phones that, uh, people don't people don't think about. We talk about security and privacy and how these phones can easily be utilized to track us, okay, wherever we go. These phones can also be used to pick up on our conversations. I mean, this phone can actually be exploited so that I can listen to your conversation that you're having, confidential conversation that you're having with somebody in a restaurant, all right? It can be done. And it's done. So I mean, there's a lot— this thing is, to me, I don't know, I, I mean, I, like everybody else, I use the iPhone some, but I get more and more concerned about a— if someone would really want to monitor me for whatever reason, that that phone becomes really a vulnerability regarding to maintaining my privacy.

So as a former CIA spy Have you been involved in situations where you were able to monitor someone's compromised digital device in that regard, a phone?

Yeah, I have been able to do that and also be able to detect if— we actually have a product where we can be able to determine if someone's phone is actually being intercepted, okay, and be able to determine where that's coming from. You know, if you have somebody that's put out some equipment out there to try to intercept someone's iPhone and to be able to be privy to a confidential conversation, we can deploy a system to be able to detect where that is, where that is coming from, to try to locate who is behind it, right? So there's also those counterintelligence kind of tools. In my world, what we would do when we're out and about conducting operations is leave the phone behind. We do not carry that phone with us ever when we're out. Ever, ever. Is there too many compromises? It may sound crazy, but it's true. Uh, that phone is, uh, it's a kiss of death.

No kidding. So, so when you're out in the field, you would not carry your own mobile device for that reason?

Exactly.

Because you don't want to be spied on yourself.

Correct.

Because that type of a breach would compromise you and potentially the operation.

Yeah. So I mean, we're— I'm very, very cognizant of the threats of the, uh, of this vulnerability of carrying the phone. I mean, put it this way, if you have nothing to hide, no problem. But if you want to keep— if you, if you have things to hide, if you want things that you definitely don't want, you know, anyone to know about, you, you know, you're putting yourself into, into a potentially precarious situation, uh, with that phone being on you. Yeah, I don't want anybody to go crazy, but it's just something to think about. Uh, there are, you know, when it comes to these iPhones, great tool, great convenience, but it does open us up to certain vulnerabilities and loss of privacy.

It does. But for the layperson, for the everyday person, generally, like you said, if you have nothing to hide, you have nothing to be concerned about. There is definitely, um, a concern regarding, uh people who are victims of domestic violence and the various spyware programs that are available for sale over the counter out there, that, um, uh, there's a whole movement against all these various products that if they were to be installed on a, in this case, say, a woman who, um, is being stalked by her, uh, significant other or abuser, uh, that I know at domestic violence shelters that they make them shut the phone off and in many situations, uh, take the battery out of the phone, uh, to prevent them from being found in those cases. Yeah, so that is a real threat for certain people. So you may not have anything to hide except for, of course, yourself in some situations, right?

Right.

That, that is a real concern among certain parts of the population due to, you know, those extraneous, uh, issues. So yeah, I mean, the digital devices we have are being tracked by the various carriers and by various government agencies for a number of different reasons. We allow and facilitate all of that tracking for a number of reasons in order for, you know, like in my own life, you know, Find My iPhone or Find My Phone, like, you know, my daughter, my wife, like they're being tracked by me and I'm being tracked by them and the carrier. Is tracking them as well, and so is Apple for that matter. And I'm, I'm allowing that to occur because of the convenience of that tracking allows what allows me to know where they are and, you know, allows me to find them or the phone should it be lost or stolen. So there's a lot of considerations there. I don't want people to, to worry about that, but you definitely should be aware of it and the implications of it and how that could affect you down the road Uh, but for most people it shouldn't be an issue. Uh, but again, you know, it's definitely something to take into consideration.

No, you're absolutely right. But I'm always, as you know, my background, I'm always kind of like looking at a little bit deeper into, uh, if someone wanted to target me or target somebody else, kind of like what's available out there. And doesn't mean that it has to be legal, right? The technology is technology. Technology doesn't have legal— I mean, there's no, there's no right and left as far as legal. I mean, technology is used Uh, depends on who's behind how they use technology, but yeah, there's no guarantee that that technology can't be used illegally for these purposes as well.

So thank you, Peter. Uh, I think this concludes, uh, another successful, uh, The Security Guy and CIA Spy Podcast. I am Robert Siciliano, and this is Peter Wormka, Counterintelligence Institute. Yes. Uh, So, Peter, tell them more about what you offer and what you do.

Okay, the Counterintelligence Institute, we're based in Orlando, but we break down, we break down security mainly for organizations. I know you focus more on individuals, we focus on organizations to help organizations identify the potential threat actors who are out there, what those threat actors might be after in conducting a security breach, and more importantly, And most importantly, understanding the methodologies that are utilized by threat actors and targeting insiders in these organizations, how to identify these incoming threats, how to mitigate them, and how to protect themselves. Most— a lot of it through education.

Peter is the real deal. Uh, and, uh, my company is protectnowllc.com. We provide security awareness training for both business-to-business and business-to-consumer. We have the CSI Protect Now certification, which is a designation for service professionals such as real estate agents, attorneys, accountants, uh, often for continuing education. And we provide cybersecurity insurance and identity theft protection services. You can freeze your kids' credit and a number of other products and services available at protectnowllc.com. Uh, and thank you so much for subscribing. You can find us at Apple Podcasts and now on Spotify. And again, I am Robert Siciliano. Thank you so much. And Peter, why don't you sign off?

Yes, thank you very much. And look, keep safe, be aware of your situational awareness at all times, and we look forward to being with you again in a couple weeks.

Talk to you later.