Beware the boo-gus giveaway.
[ Music ]
Dave Bittner: Hello, everyone, and welcome to N2K CyberWire's Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations all over the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague and host of the T-minus Space Daily podcast, Maria Varmazis. Maria.
Maria Varmazis: Hello, hello, and welcome back.
Dave Bittner: We've got some good stories to share this week, but first of all, we have a little bit of follow-up here. So this actually goes back a couple weeks, because I was out last week and this came to me [laughter]. So this is from a listener who goes by the name Randy, who said, "Listening to Hacking Humans with Bittner and the stats given about how low-income households lose more money to scams than do higher-income households. What wasn't mentioned as an explanation is the need for money and the hope that claims of windfalls might be true. Do billionaires buy lottery tickets? Poor people are more likely to pursue these avenues, unfortunately. They may not have anyone around to advise them against gambling and probably don't listen to hacking humans." That's true.
Joe Carrigan: I thought we did, maybe I'm thinking of a different episode, but I thought we did mention that.
Maria Varmazis: I thought so too, but maybe we're both thinking of something else [laughter].
Joe Carrigan: Because I know we've talked about this. And Maria, last week, you and I had a similar story and maybe you talked about it then.
Maria Varmazis: Maybe. The streams are getting crossed in my mind. Because I was listening to you, Dave, and I'm going, I thought we did say that. But in also typical me fashion, maybe I thought it and then didn't say it. But it's a great point and a point well taken.
Dave Bittner: Yeah, absolutely. I think the more desperate you are in your day-to-day, the more likely you are to reach for something that perhaps is unreasonable.
Joe Carrigan: I don't personally know.
Maria Varmazis: It's very expensive to be poor. Yes.
Joe Carrigan: Any billionaires?
Dave Bittner: You don't know any billionaires?
Joe Carrigan: Well, I mean.
Maria Varmazis: Why not, Joe? [laughter]
Joe Carrigan: I've met a couple, at least one.
Maria Varmazis: Are you sure, Joe? Are you sure?
Joe Carrigan: You're never sure. You know me.
Dave Bittner: I do know you.
Joe Carrigan: That's right, billion dollar Dave.
Dave Bittner: Yeah.
Joe Carrigan: Right.
Maria Varmazis: There you go. Billion dollar Bittner.
Joe Carrigan: Billion dollar Bittner.
Dave Bittner: Yes, my Bittner coin.
Joe Carrigan: Bittner coin [laughter]. He's a crypto billionaire.
Dave Bittner: Yeah.
Joe Carrigan: He's got a billion of those.
Maria Varmazis: Of Bitcoins, and by "Bitcoins," I mean "Bittner coins."
Dave Bittner: Yeah.
Joe Carrigan: So I do not buy lottery tickets, even though -- well, I mean, I actually do buy lottery tickets when I do a calculation and the expected value goes over the cost of the lottery ticket. I buy one lottery ticket.
Dave Bittner: Okay.
Joe Carrigan: And I calculate the expected cost, the expected value of the lottery ticket. And yes, mathematicians, I do take into account the number of ticket sales and how likely it is to make -- to split the jackpot with somebody.
Dave Bittner: Okay.
Joe Carrigan: So when that gets above the expected value, I buy one lottery ticket.
Dave Bittner: All right. You pay your tax against math.
Joe Carrigan: Right, my tax against math. But actually, when the expected value is greater than the price of the ticket, it's a tax for math.
Dave Bittner: Okay.
Joe Carrigan: Right? You're dumb if you play before that happens. You're dumb if you don't play after that happens.
Dave Bittner: Really? That's what worked out for you, Joe.
Joe Carrigan: You're not the first person to ask me that question.
Dave Bittner: Smarty pants.
Joe Carrigan: You know I'm still here, Dave. It has not worked out for me.
Dave Bittner: Right, exactly. I don't see you wearing a tuxedo or a top hat right now.
Joe Carrigan: No, no.
Maria Varmazis: Mr. Peanut.
Joe Carrigan: You wouldn't see me at all.
Dave Bittner: Right, exactly.
Joe Carrigan: Call me "the breeze," I'm out of here. But yes, it is true, I think that this is absolutely a real thing. Desperation is, you know, I need the money, I need to see if this pans out.
Dave Bittner: Yeah. And sort of, I mean, Maria mentioned this in passing a minute ago, but it's been my experience with the wealthy people who I have been able to spend time with through, you know, happenstance in my life that the richer you get, the fewer things you have to spend money on.
Maria Varmazis: Yeah, of course.
Dave Bittner: Because people buy you things, like meals and even cars and, like, it's just bonkers, clothing, you know, things get -- when you reach a certain status and certain type of celebrity, you get stuff.
Joe Carrigan: Yeah, like the Kardashians don't buy anything. Everything is handed to them.
Maria Varmazis: They don't need to, it's all gifted to them, because their attention pays.
Joe Carrigan: Right.
Dave Bittner: Yeah, exactly.
Maria Varmazis: Yeah. If you're on the hamster wheel of everything is you have to buy cheap things and then it always breaks and then you're always trying to get it fixed, you're just, it's very hard to get off of that hamster wheel.
Dave Bittner: Right.
Maria Varmazis: And yeah, a lot of these scams are often -- I know we've covered these, but maybe not in this specific case, you know, the kind of part-time job type scams where, you know, you're just trying to earn a few bucks at home to supplement income. I mean, obviously, wealthy people are probably not going to be doing that.
Dave Bittner: Right.
Maria Varmazis: But yeah, it's just taking advantage of people who are already very in need of money, likely.
Dave Bittner: All right, well, our thanks to Randy for sending in that kind note, we do appreciate it. And of course, we would love to hear from you. If there's something you'd like us to consider for the show, you can e-mail us. It's hackinghumans@n2k.com. All right, let's jump into our stories here. Joe, you are up first. What do you got for us?
Joe Carrigan: Dave, my story comes, was actually referred to me by my office mate, Michelle.
Dave Bittner: Oh, Michelle.
Joe Carrigan: Yes.
Maria Varmazis: Hey, Michelle.
Dave Bittner: Hi, Michelle.
Joe Carrigan: And it comes from Medium. And the headline is great: "How a fake AI recruiter delivers five stage malware disguised as a dream job." I might get a little bit into the malware here because it's impressive with what's going on here. I mean, suffice it to say, this malware equates to total pawnership of the target device.
Dave Bittner: All right.
Joe Carrigan: But here's how this works. It starts with a social engineering attack. So it's -- Maria, you remember the Disney opportunity you had, right?
Maria Varmazis: I'm sure I do. Refresh my memory [laughter].
Joe Carrigan: Or was it -- no, it was Spotify. It was Spotify.
Maria Varmazis: Spotify. Well, actually, it was both. Yes, I got a Spotify one first, and then a few weeks later, the exact same e-mail, but it was Disney that time.
Joe Carrigan: Okay. Well, this is a very similar email, but it doesn't target anybody -- it doesn't target somebody who might work at Spotify or Disney. It targets somebody who's looking for an AI engineering role. And it starts with the same sentence: "You've been shortlisted for an AI engineering role." So the question I would ask myself immediately is, did I apply for an AI engineering role? [Laughter] Because one of the big things about, you know, you've won the lottery scams, going back to the lottery, is you won this lottery that you didn't buy a ticket for. That's impossible.
Dave Bittner: Right.
Joe Carrigan: Right? Even if you do buy a ticket, your odds are only slightly better than if you hadn't bought a ticket. But actually, they're also infinitely better because it's not zero. Anyway, the company looks exciting. It's called "DL Mind," and it's called an "AI-driven innovation lab." And the recruiter that contacts you, his name is Tim Morenc, M-O-R-E-N-C. And he has a polished up, nice looking, very professional LinkedIn profile. And if you start doing some looking around, everything will add up. And what they will do is they'll say, "Hey, we want to see how you feel about this or how you want -- are you interested in this position? Great, here's what you need to do. You need to collaborate with us on this GitHub repository. So what's your GitHub username? And then I need you to clone the repo, review the code, run the setup, and share your feedback." Now, where's the.
Dave Bittner: So let me pause you for the few people in our audience who are not developers.
Joe Carrigan: They're probably the vast majority of our audience [laughter].
Dave Bittner: Explain what that all means in normal person English.
Joe Carrigan: So GitHub, now a Microsoft property, is a collaborative -- yeah, I think Microsoft bought them a couple years ago, right?
Dave Bittner: That's true.
Maria Varmazis: I just love that you had to mention that.
Joe Carrigan: No, I just, yeah. GitHub is a place where you can store code that you write. So it's called -- it's based on a code management system called Git, which was written by Linus Torvalds so he could develop Linux. In the process of developing Git, he came up with this really great idea for dispersed code version control system. Git is designed for dispersed teams all over the world, as opposed to something in your local area, but everybody uses it now. It's the de facto code repository.
Dave Bittner: Okay.
Joe Carrigan: But GitHub is a website that you can go to, sign up for, and put a code repository up there, and you can put source code up there. You can also store executables up there. So you can compile the source code and have executables.
Dave Bittner: And this is to share with the world?
Joe Carrigan: This is to share with the world, exactly, or to share with a limited group of people. You can actually make it private and share it with just people who you want to share it with.
Dave Bittner: Right.
Joe Carrigan: So the code actually runs in something called "Node.js," Node.js, which is a JavaScript runtime environment. Which means this code will run on anything that has a Node.js environment. So if you go out and you download Node.js for Apple, for Linux, for Windows, what have you, once you download this code and start running it, it's going to execute no matter what the environment is. Now, that's good for the developers, right? The developers of this malware. Because you don't want to maintain like three different spaces of malicious code. You only want to maintain one. So that's what they've done here. I'm being facetious.
Dave Bittner: Because JavaScript is kind of universally installed, no matter if you're a Mac person or a Windows person or a Linux person.
Joe Carrigan: Yeah, right.
Dave Bittner: Chances are, you have a JavaScript runtime on your machine as a result of having a browser.
Joe Carrigan: I think it has to be Node.js, the Node.js environment.
Dave Bittner: Oh, is that right?
Joe Carrigan: Yeah.
Dave Bittner: Okay.
Joe Carrigan: In my reading of this. But you might be right, I don't know. I think it's Node.js, though.
Dave Bittner: Yeah. Probably doesn't matter.
Joe Carrigan: Right, probably doesn't matter. The developers probably have this installed.
Dave Bittner: Yeah.
Joe Carrigan: So, again, the guy says, "Clone the repo," which just means make a copy of it on your local machine, right? "Review the code," which means look at the code. "Run the setup and share your feedback." So what's the problem in that sort of four operations? It's "run the setup."
Dave Bittner: Oh, okay.
Joe Carrigan: "Share your feedback is irrelevant." They don't care about that.
Dave Bittner: Right.
Joe Carrigan: So once they get you to run the setup, the code goes through and essentially steals all your browser logins and cookies, hijacks your clipboard, installs like five different kinds of malware, including Node.js. malware, JavaScript malware, this runs in Node.js. It installs a Python, a piece of Python malware that is like obfuscate. All this code is obfuscated, which means that it's not really -- like if you were to look at the code and you could read JavaScript or Python, you wouldn't be able to do it. You'd have to de-obfuscate it first. And one of these de-obfuscation tactics -- I was impressed with it -- is it's a 64-stage process of reversing the code, encoding it with base 91, which is like base 60, which is just another way of representing digits with text, and then zipping it with something called "zlib", and then doing that 64 times, right? And then in order to get the code to run, they have to do that backward 64 times.
Dave Bittner: Right.
Joe Carrigan: You know, you don't have to have an encryption key. So it's not really encryption. So that's why it's just obfuscation. But I'll bet the output is indistinguishable from anything real.
Dave Bittner: The idea being that a human is going to get -- is going to run out of patience before the 64 times.
Joe Carrigan: Right, exactly. So if you start reverse engineering this thing, you're like, what is this? What's going on? First off, you have to know. So you have to find some piece -- you have to reverse engineer the code that unpacks this thing, right? Which means you have to go through and say, what's this thing going to do? Oh, it's going to do this three-step operation 64 times, just to get to the code. Again, I'm not going to go deep into the weeds about the technical details. The most important part.
Dave Bittner: Too late.
Joe Carrigan: Too late, yeah, sorry [laughter]. I have only scratched the surface on this article.
Maria Varmazis: I wasn't going to say it, but.
Joe Carrigan: If you want to read the technical details, the article is very long, has all kinds of cool things. But essentially, it's got like remote administration tools in it. It's got crypto key stealers. It's got session stealers, everything. You know, if you get hit with this malware, just throw your entire online identity away and that computer, just light it on fire and walk away. You're done, essentially.
Dave Bittner: Go live in a different country.
Joe Carrigan: Right.
Dave Bittner: Go live on the moon.
Joe Carrigan: I mean, you can of course recover from it, but it's really, really, really bad.
Dave Bittner: Yeah. So what are your recommendations here?
Joe Carrigan: Well, first off, when you hear that you've been shortlisted for a job, you got to think to yourself, did you apply for a job at this company?
Dave Bittner: Right.
Joe Carrigan: Right? That's number one. And if you haven't applied, you need to, you know, start thinking about, well, tell me more about the company. What do you guys do? Where are you located? Can I come see you? Can I, can you, know, that kind of stuff. I don't know. The job offer is for a remote position. So, you know, they're probably going to tell you, "Oh, I'm over in -- far away from you, just need to trust me on this."
Dave Bittner: Yeah.
Joe Carrigan: So certainly don't install random things from GitHub. Now, I took Maria's advice and clicked on the link for the GitHub repository [laughter].
Maria Varmazis: That's what I'm going to be known for forever. Just click the link. Just click it, it's fine.
Joe Carrigan: But, you know, because I'm familiar with GitHub -- I do some work in GitHub. So I went, I clicked on -- the repository is gone now. So GitHub has cleaned it up.
Dave Bittner: Okay. We need to have T-shirts made that just have Maria's picture smiling on the front and it just says.
Maria Varmazis: Just click it.
Dave Bittner: Maria says.
Maria Varmazis: What's the worst that could happen?
Dave Bittner: Click the link.
Maria Varmazis: It's fine, just click it.
Dave Bittner: Yeah.
Maria Varmazis: I am single-handedly undoing decades of user education.
Dave Bittner: That's right.
Maria Varmazis: With my blase attitude. Yes.
Dave Bittner: Right. All these.
Maria Varmazis: You're welcome, everyone.
Dave Bittner: All these IT people who are called in to clean up the mess are like, "Who the heck is Maria?"
Maria Varmazis: I'm keeping you employed, okay? I'm giving you job security. So you're welcome.
Dave Bittner: People are saying, "Maria said, click the link. I don't understand."
Maria Varmazis: Just click it.
Dave Bittner: Just click it. All right, well, we will have a link to that story in the Show Notes. Maria, you are up next. What you got for us?
Maria Varmazis: So speaking of just clicking things, I'm actually covering a phishing campaign today, which is a newish one from our friends at Malwarebytes. And the phishing campaign itself is a pretty classic phishing campaign. Just the flavor of it is a little interesting. For me, it feels very seasonal because it is a purported email, obviously fake, from none other than everyone's favorite hardware store, the Home Depot.
Dave Bittner: It's not my favorite hardware store.
Maria Varmazis: Well, true.
Dave Bittner: Let me just add, let me just -- I'm sorry to interrupt you, Maria, but I am currently in a stalking relationship with the Home Depot in my neighborhood.
Maria Varmazis: A stalking relationship?
Dave Bittner: Yes.
Maria Varmazis: They're stalking you?
Dave Bittner: No, no, I'm stalking them.
Maria Varmazis: Okay.
Dave Bittner: Because I desperately want to buy one of the new full-size R2D2s that they're selling for the Christmas season.
Maria Varmazis: Oh, gotcha. Well.
Dave Bittner: They're in short supply.
Maria Varmazis: I wonder why?
Dave Bittner: Yeah. So I'm like checking online and dropping by and.
Joe Carrigan: When you say, "full size," you mean like?
Dave Bittner: Did I stutter?
Joe Carrigan: Well, I mean, okay [laughter]. Do you mean like a three foot tall R2D2?
Dave Bittner: Yes.
Joe Carrigan: But not like a 20 foot tall R2D2?
Maria Varmazis: Not a 12 foot tall skeleton R2D2, no. That would be amazing, though.
Dave Bittner: So the real R2D2 makers out there of the world who make screen accurate R2D2s are quick to point out that the Home Depot R2D2 is actually a seven-eighth size R2D2.
Maria Varmazis: That one-eighth will always get you.
Dave Bittner: He's big enough for me.
Joe Carrigan: Right.
Dave Bittner: So, anyway, proceed, Maria, proceed.
Maria Varmazis: It's okay. I somewhat -- I actually kind of picked this story partially because I love the Home Depot theme. I really hope that our audio team will just insert some audio from that story, because I really, I just, I feel like it just adds so much. [ Home Depot Theme Music ] So the phishing campaign that is supposedly from Home Depot is offering people, purportedly, a free Gorilla Cart dump cart. Which is, for folks who don't know, instead of a wheelbarrow -- which is a two-wheeled thingama, or one-wheel thing, I should say -- this is a four-wheeled, pull along thing that you can put all your yard detritus in, and instead of having to.
Dave Bittner: Oh, okay.
Maria Varmazis: Yeah. I have one, not a Gorilla one but a similar one. They're actually quite handy for pulling my then toddler around the yard. That was what I mainly used it for. But it's also good for.
Joe Carrigan: You attach it to a lawnmower.
Maria Varmazis: Joe, one can do anything one puts one's mind to. I mean, I'm not going to tell you what to do with your life. So I mean, I want video, though, if you do that.
Dave Bittner: If you're brave enough.
Maria Varmazis: Yeah. You can do anything with a zip tie, I mean, just go on ahead.
Dave Bittner: A little Duct tape.
Maria Varmazis: Yeah, slap it on there. So the phishing campaign is interesting to me because it uses some marketing best practices. It has a tracking pixel in it. So the scammers can actually track who is opening the email, who is clicking through, and what actions they're taking. So it's like somebody worked in a marketing department who worked on this campaign.
Dave Bittner: Yeah.
Maria Varmazis: And the URLs involved in the phishing campaign are a whole smorgasbord of abandoned and compromised legitimate URLs. So the first URL, if you were to click this phishy email, sends you to a compromised Los Angeles high school website [laughter]. And then if you keep going through the attack chain, or I guess in this case, the phish chain -- I'm sure there's a proper term for this. If you keep going through it, takes you through some other websites. Like one's a supply website that's been compromised. Another one, I'm trying to find the name of it, it's buried in here. It's a guide website. It's like a compromised WordPress instant, and it's in the UK. So I don't know why Home Depot US would be sending you to a UK website for any legitimate reason. Spoiler alert, they wouldn't. So you just keep going through all these compromised websites through this fake giveaway path. So the path is basically you click the phishing email saying you could win a Gorilla Cart. And the moment you click to the website, it says, actually, you did win a Gorilla Cart, even though we know nothing about you, stranger. We're giving it to you with a little fine print. There may be a teeny, weensy, weensy, weensy processing fee. Just a tiny one. It's really no big deal. But you won this cart. And those carts go for 40, $60, if I remember correctly, somewhere in there. So, you know.
Joe Carrigan: When I saw them -- I just looked them up -- they're like $150 or something.
Maria Varmazis: Well, that's inflation for you, because last time I bought one was like 10 years ago. So the times we're living in. And also my brain is Swiss cheese, so I could also just be wrong. But yeah, it's -- compared 150 bucks to, I don't know, like a $11.97 processing fee. That seems like a steal. You're going to use that much money just burning gas to go to Home Depot. So you might as well just pay the fee, right?
Joe Carrigan: Right.
Maria Varmazis: So if you actually put in your shipping details and your payment details for this free cart, well, what do you know? You get this error. "Oh, something went wrong with the request. Just please try again." Oh, what a shame. Maybe you won't get that Gorilla Cart after all, because something went wrong with the website. Well, of course, on the back end, the scammers now have all your info and your payment info and your shipping address, which is, I can't imagine that's something that you want to give away either.
Joe Carrigan: No, but they use it for confirmation on the orders.
Maria Varmazis: Absolutely. So you've given away a lot of information unbeknownst to you, and you thought, oh, it just didn't work because all those darn websites just sometimes break sometimes, but actually you've been compromised, unfortunately. And it felt timely, this is the time of year for me that I'm doing a lot of yard work, and I could absolutely see a lot of people going, I could really use a Gorilla Cart. And to me, insult to injury is that they have a tracking pixel that's tracking you as you go through all these steps. So they can probably optimize, like a real marketer would. Oh, people are actually, we're losing people on this part of the process. Maybe we can optimize, do some AB testing on this, figure out how we can get people to go through. Yeah, that's kind of horrifying, but makes sense that they would do it. So yeah, don't believe a free Gorilla Cart scam if you get it from the Home Depot because it ain't real.
Dave Bittner: Yeah.
Joe Carrigan: Now I want a Gorilla Cart, or something similar.
Maria Varmazis: Well, I mean, I like them. Yeah, they have not paid me to say that. I had one until recently. So, you know, they're good.
Dave Bittner: So I guess, you know, obvious red flags to look out for here.
Maria Varmazis: Anything free.
Joe Carrigan: You didn't win a free Gorilla Cart.
Maria Varmazis: You didn't, yeah.
Joe Carrigan: Right.
Maria Varmazis: You know, the phishing email has a lot of the urgency language that you should always watch out for. You know, the offer is only valid for a few minutes, so you got to click now to see if you won. And then they don't know who you are, but they tell you, "Oh, you totally won, just believe us, you won." And then of course, you got to take a survey and there's a fee. And just in general, if you get an email with a huge clickable image with really no other text in there, that's a big old red flag. And a lot of email providers do filter stuff like that. But usually an image like that is trying to mask the intent to phish you. So be very, very wary of just a big clickable image with no other text. That would be what I would watch out for.
Dave Bittner: Yeah. Just a side note, the mail client that I, the email client that I use, has the option to block tracking pixels.
Maria Varmazis: Oh, that is nice.
Dave Bittner: Which I think many -- yeah, I think that's not an unusual feature for email clients to have. But if you have one, you may want to look in your email client and see if you have the ability to block tracking pixels, because it's a small thing you can do, but it can help these folks -- it'll make it a little harder for these folks to track you around.
Maria Varmazis: Yeah. Don't let them A/B test on your watch.
Dave Bittner: Right, right, exactly.
Maria Varmazis: What is the client that you use, Dave?
Dave Bittner: It is called Mimestream.
Maria Varmazis: Okay.
Dave Bittner: And it's for the Mac. It's specifically a standalone client that works with Gmail.
Maria Varmazis: Nice. Okay, good to know.
Dave Bittner: So it kind of gives me the best of both worlds between Apple's Mail app, but still using the Gmail environment, but it has some things about it that I prefer over Apple's app.
Maria Varmazis: That's awesome.
Joe Carrigan: So I went to the Tractor Supply website, and now I'm looking at these carts, and they're like $400 for just.
Maria Varmazis: Well, that's because you went to Tractor Supply, and that's like more serious business than Home Depot for this stuff.
Joe Carrigan: A big bucket on a pair of wheels. Like I could build something like that for like a tenth of that price.
Maria Varmazis: Well, then, do it, Joe. Then you should build it.
Dave Bittner: Right, like your chicken coop.
Joe Carrigan: I'm going to need something to get rid of all the chicken poop.
Maria Varmazis: Yeah. It's like, do you go to art fairs and go, "I could paint that," when you're walking around?
Joe Carrigan: No, I don't. That's a different thing.
Maria Varmazis: I could build that. I could paint that. Well, then just do it [laughter].
Dave Bittner: Yeah, let me see you.
Joe Carrigan: But we do, whenever we do go to the quilting show, my wife goes, "I could do that." And I'm like, I know you could do that, you could do that better.
Maria Varmazis: And she has done it.
Joe Carrigan: She has done it.
Maria Varmazis: Yeah, she has.
Joe Carrigan: She's probably doing it right now, in fact.
Dave Bittner: I'm looking at these Gorilla Carts. First of all, they have quite a wide array of different carts.
Joe Carrigan: Right.
Maria Varmazis: We have not been paid by Gorilla Cart. This is not like subliminal marketing or, you know, anything like that.
Dave Bittner: No. But when I was a teenager, I worked at a local retail nursery, like garden center kind of place. And we had these kind of carts for hauling plants around the place. So yeah, I'm familiar with these. They're nice.
Maria Varmazis: Yeah, for things that you can't -- so a wheelbarrow is awesome for certain things. And other times you need to keep whatever you're carrying flat. And -- but the cart had.
Dave Bittner: Like your child?
Maria Varmazis: Like my child, yeah. Like she -- we would just carry her around either in a wheelbarrow or in the Gorilla Cart. And, you know, and other times it was compost. I'm sure it was good for her immune system, so it's fine.
Joe Carrigan: Nothing's going to kill that kid.
Dave Bittner: That's right.
Maria Varmazis: Hey, that's for sure.
Dave Bittner: No allergies here. All right, we will have a link to that story in the Show Notes. I'll tell you what, let's take a quick break. We'll be right back after this message. And we are back. My story this week comes from a journalist. His name is Sean Captain, and he writes for an online publication called "Techlicious," which I wish I'd come up with.
Joe Carrigan: That's pretty good, "Techlicious."
Dave Bittner: Yeah. And he was sort of chronicling his own journey down a pathway of almost being scammed. And he noted that he's a tech writer, you know, so he should be immune to these sorts of things.
Joe Carrigan: No.
Dave Bittner: He was not. He says.
Maria Varmazis: You get complacent and listen to people like me who say, "just click it."
Dave Bittner: Right. What could go wrong?
Joe Carrigan: I've talked on this show about -- numerous times -- about how I've been hit by the early phishing, first step phishing emails.
Dave Bittner: Yeah. We all have.
Joe Carrigan: Yeah.
Maria Varmazis: Yeah, absolutely.
Dave Bittner: So Sean got an email and the subject line as he described it was screaming, "Dashlane have been hacked." Now, Dashlane is a password manager, so this could be concerning. And turns out that this writer used Dashlane, used a free version of Dashlane. And as he pointed out, he says, at first glance, the whole thing looks legitimate. The message, he said, used familiar breach reporting language, had phrases like zero-knowledge architecture and encryption metadata relay systems -- the technical jargon that makes you lower your guard.
Joe Carrigan: Got me with your technical mumbo-jumbo [laughter].
Dave Bittner: That's right. This reminds me of, what's the thing, tune in to see Jordy use up all of his screen time on technobabble.
Maria Varmazis: Reverse the polarity. Something, something, quantum relay, something warp drive. Yeah.
Dave Bittner: Right. But then he also points out that there are tells here -- a sloppy subject line, a suspicious link and request to download software that Dashlane doesn't even support. He was saying Dashlane stopped making standalone apps for, I want to say, Mac and Windows a few years ago. And these folks are asking you to download the new version, the updated, the patched version of Dashlane. Yeah. But he points out that he had an emotional reaction to this. He said his heart skipped a beat. He was afraid that his passwords would have been compromised. He had written a recent article about Dashlane talking about pass keys, and he was concerned that maybe he had just endorsed a compromised product. Right?
Joe Carrigan: See, that's the multi -- what he is experiencing here is called "cognitive narrowing."
Dave Bittner: Okay.
Maria Varmazis: Okay.
Joe Carrigan: And he is losing focus on what is important here and focusing only on what they want him to focus on.
Dave Bittner: Right.
Joe Carrigan: And in this case, unbeknownst to the hackers or to the attackers, he has an extra layer of things he can focus on. Things that make him think, oh my God, I just recommended this. Oh, am I going to look like a jerk?
Dave Bittner: Right, right. Yeah. So Captain has cognitively narrowed the main deflector dish.
Joe Carrigan: Correct.
Dave Bittner: He says.
Maria Varmazis: Well, that's how you get rid of the Borg, so, you know.
Dave Bittner: Right. That's right, yeah. So he said once he calmed down, he got his wits about him, and he said he checked Dashlane's official site. He searched for credible news reports, and he found there was no evidence of a hack. And the email was, in fact, a classic phishing attempt that was designed to steal his credentials or spread malware. And so he points out, it's the classic thing, the simple reminder: pause. Unlike Maria, pause before you click [laughter]. Don't dive for that button reflexively as quickly as possible, trying to set a new record for how quickly you can click.
Maria Varmazis: Unlike me, who will never work in cybersecurity ever again after this.
Dave Bittner: No. So verify directly from the company's official site. Inspect the sender address carefully. And he said, even cybersecurity experts can be fooled. So what matters next is what matters most -- or what you do next is what matters most, I guess is the right way to say it. So we'll have a link to his complete narrative here in the Show Notes. But I thought it was a nice example of both the combination that this can happen to anybody, even folks who have some knowledge in this space, but also, as we say over and over and over again, how important it is to pause when you find yourself wound up emotionally. All right, it is time to move on to our catch of the day. [ Music ]
Joe Carrigan: Dave, our catch of the day comes from the scam's sub-Reddit, and it is a message. It looks like it's on an iPhone. Somebody's battery's at 73%, that's pretty good.
Maria Varmazis: That's all right, we'll allow it.
Dave Bittner: Not bad, not bad. They got a strong Wi-Fi signal, so not bad. Right. So it goes like this. It says, "Hey, I forgot to give you a text yesterday with my new number. It's your aunt."
Joe Carrigan: Heart emoji.
Dave Bittner: "Save it, text me when you get this. I'm waiting for my stuff to sink now. I also seen a few sets you might like from Victoria's Secret. Do you prefer seamless or cheeky?"
Maria Varmazis: Oh God!
Dave Bittner: "What size are you now in regular bras? When was the last time you were measured?"
Maria Varmazis: Not my auntie.
Dave Bittner: I might have to get you a size up in the seamless ones. Does your regular cotton shrink after you wash them on the sides?"
Maria Varmazis: What [laughter]?
Joe Carrigan: What the hell, man?
Maria Varmazis: Who's got a relationship like that with their aunt? I just.
Joe Carrigan: Me. That's my -- no, I don't have a relationship like that.
Dave Bittner: It reminds me of the scene in Sixteen Candles where -- what's her name?
Joe Carrigan: Molly Ringwald.
Dave Bittner: Molly Ringwald gets felt up by her grandmother.
Joe Carrigan: Believe it or not, I've never seen that movie.
Dave Bittner: Oh, really?
Joe Carrigan: Even though I'm a big Molly Ringwald fan.
Dave Bittner: Yeah. It's a team favorite of mine. Of the John Hughes films, it's probably, that one and Ferris Bueller are probably my two.
Joe Carrigan: Ferris Bueller is a good one. He also did Better Off Dead, right?
Dave Bittner: Was that John Hughes?
Joe Carrigan: I don't know.
Dave Bittner: It was John Cusack.
Joe Carrigan: John Cusack was in it.
Dave Bittner: I don't know if Hughes directed that one or not. Wouldn't surprise me. All right, so, anyway, Maria, seamless or cheeky?
Maria Varmazis: No, just.
Dave Bittner: What does that mean, by the way?
Maria Varmazis: No, you can Google it. I'm not going to do this. So just I'm horrified at the thought of any of my aunties asking me any question even remotely like this.
Dave Bittner: Right.
Maria Varmazis: So I just, even if it actually was a legit message from my aunt, I would delete and block immediately.
Dave Bittner: Right.
Joe Carrigan: I'm not talking to you anymore.
Dave Bittner: You're out of the will.
Maria Varmazis: You are rescinded. I just know we're not doing this.
Dave Bittner: Yeah.
Joe Carrigan: Better Off Dead was directed by savage Steve Holland [laughter].
Dave Bittner: Okay, there you go.
Maria Varmazis: Thanks for that.
Joe Carrigan: Sorry.
Dave Bittner: Real-time follow-up.
Joe Carrigan: Right.
Dave Bittner: Yeah, yeah. So what's going on here? Obviously, someone's trying to slide into somebody's DMs.
Joe Carrigan: Right, yeah, this is -- oh, it goes on.
Maria Varmazis: What is the scam here, though?
Joe Carrigan: Oh, they're just trying to get you to talk.
Maria Varmazis: Okay, I was like, it's creepy as heck, but.
Joe Carrigan: Because it looks like the next thing in this picture is 11 photos with the top of it being Victoria's Secret.
Dave Bittner: Right.
Maria Varmazis: Right, okay.
Joe Carrigan: Now, I don't know about you, but I'd be tempted to look at those pictures.
Maria Varmazis: Oh, Joe. There's this whole thing called the Internet now, I don't know if you've heard.
Dave Bittner: That's right. We don't need to be squirreling away Victoria's Secret catalogs anymore, Joe.
Joe Carrigan: Don't know what you're talking about, Dave.
Dave Bittner: Yeah, there's this whole thing called the Internet, or so my teenage boys remind me of it literally. Oh my God. All right, you know what? Let's get out of here. Nothing -- we are heading down -- there's -- beyond there, dragon's be. So let's take a quick break before we wrap things up. We'll be right back. All right, and we are back. And mercifully, that is Hacking Humans, brought to you by N2K CyberWire. We would love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity and women's intimate undergarments [laughter]. If you like the show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to hackinghumans@n2k.com. This episode was produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliot Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm seamless or cheeky [laughter].
Dave Bittner: Thanks for listening. [ Music ]
