Trust me, I’m legit.

Dave Bittner: Hello, everyone, and welcome to N2K CyberWire's "Hacking Humans Podcast," where each week we look behind the social engineering scams, the phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey, there, Joe.

 

Joe Carrigan: Hi, Dave.

 

Dave Bittner: And our N2K colleague and host of the "T-Minus Space Daily Podcast," Maria Varmazis at a conference this week. She's actually in Florida at the "Space Week" conference.

 

Joe Carrigan: That must be very nice.

 

Dave Bittner: I think that's a pretty cool place to -- pretty cool conference to be at. It's actually one of the --

 

Michelle Kellerman: Especially with the Artemis launch window opening this week.

 

Dave Bittner: That's right. That's right.

 

Joe Carrigan: I just want to be in Florida.

 

Dave Bittner: Where it's warm? [laughs]

 

Joe Carrigan: Right. Right.

 

Dave Bittner: Well, filling in for Maria this week is our friend to the show, Michelle Kellerman. Hello, Michelle.

 

Michelle Kellerman: Hi, Dave, and hi, Joe.

 

Dave Bittner: We've got some good stories to share this week. But first, let's get into our follow-up. Joe.

 

Joe Carrigan: Big chicken news, Dave. [laughter]

 

Michelle Kellerman: I was so excited when I saw this.

 

Dave Bittner: Yeah. Go ahead.

 

Joe Carrigan: We have our first eggs. [laughter] This is a lot earlier than I was expecting. And I think you and I have discussed this offline. I was not --

 

Michelle Kellerman: And online.

 

Joe Carrigan: Yeah. Oh, have we?

 

Dave Bittner: Yeah.

 

Michelle Kellerman: Mm-hmm.

 

Joe Carrigan: Oh, when I was going to -- I was not planning on getting eggs until like April --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- March or April of this year. But one of our hens -- and I believe it is my favorite hen, Snuggle Bug.

 

Dave Bittner: Snuggle Bug? [laughter]

 

Joe Carrigan: Snuggle Bug, but --

 

Dave Bittner: Snuggle Bug never disappoints.

 

Joe Carrigan: Right.

 

Dave Bittner: It's all the snuggling.

 

Joe Carrigan: Yes.

 

Michelle Kellerman: What a lady.

 

Joe Carrigan: It made her feel maternal. [laughter]

 

Dave Bittner: That's right.

 

Joe Carrigan: And she started popping out eggs. And she's laying eggs right now at about a rate of one every day and a half or so --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- which is actually a lot of eggs for a hen to be laying in winter.

 

Dave Bittner: Oh, really?

 

Joe Carrigan: Yeah.

 

Dave Bittner: Okay.

 

Joe Carrigan: Generally they slow down in winter, and she has just started laying, and is like pooping these things out, man. [laughter]

 

Michelle Kellerman: What a weirdly specific detail.

 

Joe Carrigan: Yeah, it is. I have lots of weirdly specific details about chickens.

 

Dave Bittner: How is -- so is she the only chicken that's laying eggs so far?

 

Joe Carrigan: Yeah, I'm pretty sure she's the only one.

 

Dave Bittner: Okay.

 

Joe Carrigan: I know it's her because I was out there doing some winterizing of the run --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- because they can't around in too much snow, so I went out and bought some straw, and after the snow fell, I went out and scattered the straw around the run. So the run is just a mess of straw right now.

 

Dave Bittner: Okay.

 

Joe Carrigan: And when I was doing that, she was out there, she was like making like [clucks], you know, like laying noises, which --

 

Dave Bittner: Oh, I didn't know there were such a thing.

 

Joe Carrigan: There are laying noises.

 

Dave Bittner: Okay.

 

Joe Carrigan: And then when I went and looked inside to see how they had done with the straw inside the coop, she is sitting in a nesting box and right underneath of her is a warm egg. This first egg -- this picture on the left --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- is the first egg.

 

Dave Bittner: Nice.

 

Joe Carrigan: And it is like still warm when I pick it up.

 

Dave Bittner: Mm-hmm, mm-hmm.

 

Joe Carrigan: Like chicken temperature warm. [laughter] So --

 

Dave Bittner: Okay. Okay.

 

Joe Carrigan: -- it's kind of weird to pick up a warm egg and know it's the --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- freshest thing in the world.

 

Dave Bittner: Right, know where -- know exactly where it just came from.

 

Joe Carrigan: That's right. [laughter] That chicken's butt.

 

Dave Bittner: Hey, hey, Joe, I don't want to, you know, burst any bubbles for you, but I don't think it's actually the butt. [laughs]

 

Joe Carrigan: It's actually -- technically it's called a cloaca.

 

Dave Bittner: Oh, that's right, birds have like one --

 

Joe Carrigan: It's one opening.

 

Dave Bittner: -- access point, yes.

 

Joe Carrigan: Yep. And it's --

 

Dave Bittner: You are correct. You are correct.

 

Joe Carrigan: It is same orifice out of which she poops. So --

 

Dave Bittner: Right. I guess it does make sense when you look at the relative size between an egg and a chicken that there would be a calling out of noise that they would make --

 

Joe Carrigan: Yeah.

 

Dave Bittner: -- when this thing has passed.

 

Joe Carrigan: I have found -- and this is like my horror -- you know, I keep worrying about things that aren't going to happen, but --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- or may not happen, but there's a thing called "egg binding," when a hen gets egg bound --

 

Dave Bittner: Oh, yeah.

 

Joe Carrigan: -- and that's when they have an egg that's too big for them to pass. And it can be lethal.

 

Dave Bittner: Aw. Okay.

 

Joe Carrigan: So I'm really worried about how to find that and how to treat it.

 

Dave Bittner: Sure.

 

Joe Carrigan: So but right now --

 

Dave Bittner: So how many eggs have you had total so far?

 

Joe Carrigan: Let's see, we had these -- I think we're up to four eggs --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- which brings the average cost per egg down to about $400.

 

Dave Bittner: [laughs] Ooh.

 

Michelle Kellerman: Every time you give me a chicken update, I think I know how it's going to go. And every single time I'm proven wrong. [laughter] Every time.

 

Dave Bittner: See, Michelle, I'm just looking for the day when Joe walks in here with a dozen eggs to give to me.

 

Joe Carrigan: And says, "Here you go, Dave."

 

Dave Bittner: "Here you go, Dave. I don't know what -- " Joe -- when Joe gets to the point where he's like, "Dave, I don't know what to do with all these eggs." [laughs]

 

Joe Carrigan: Oh, I have a line of people who have said they want the eggs.

 

Dave Bittner: Okay.

 

Michelle Kellerman: Yeah, it's like you don't want a pool, you want a friend with a pool.

 

Dave Bittner: Right. Exactly.

 

Michelle Kellerman: You don't want chickens, you want a friend who has chickens. [laughter]

 

Dave Bittner: That's right. Exactly. Exactly.

 

Joe Carrigan: But I actually do want the chickens. I don't want a pool.

 

Dave Bittner: Now, how do you keep the chickens warm, because it's been very, very cold. It's been single digits at night here.

 

Joe Carrigan: Yes.

 

Dave Bittner: Do you have any kind of heat lamp or anything for them?

 

Joe Carrigan: I don't know. Actually, couple weeks ago in Montgomery County, just one county south --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- there was a fire that was started at somebody's house because they had like a heat lamp in the chicken coop --

 

Dave Bittner: Right.

 

Joe Carrigan: -- and burned the house down.

 

Dave Bittner: Oh.

 

Joe Carrigan: So that's bad news. But the other problem is if you start warming up the chickens and start getting them used to a warm temperature, they become less cold hardy.

 

Dave Bittner: Oh.

 

Joe Carrigan: And they're already pretty cold hardy. So --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- what I've done is I've put a bunch of straw into the coop --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- and then I put straw on the run so they're not walking around on any snow that may have gotten into the run. I actually did the most redneck thing I think I could possibly do to keep the snow --

 

Michelle Kellerman: That's a high bar.

 

Joe Carrigan: Yeah. I surrounded the run with cardboard boxes --

 

Dave Bittner: Oh, okay.

 

Joe Carrigan: -- up to about two feet.

 

Dave Bittner: Yeah.

 

Joe Carrigan: So the snow won't blow in there. They're just --

 

Dave Bittner: Aw.

 

Joe Carrigan: -- zip-tied to the cage.

 

Dave Bittner: That's good. Yeah.

 

Joe Carrigan: So I will -- when the snow is melted and it looks like there's no more threat of snow, I'll just go out, cut those up, and put them in the recycle bin.

 

Dave Bittner: Sure.

 

Joe Carrigan: But you know, I was thinking do I buy plastic, or do I -- or I could just be like farmers are, which is really cheap and just use what I have, which I had, zip ties and cardboard boxes, and just put them around the coop --

 

Dave Bittner: Yeah. That's good.

 

Joe Carrigan: -- for the run.

 

Dave Bittner: So I met some chickens over the weekend.

 

Joe Carrigan: Oh, you did?

 

Dave Bittner: I have a -- there's a picture in the show note.

 

Joe Carrigan: I see it. Look at that.

 

Dave Bittner: Isn't that pretty?

 

Joe Carrigan: Golden Laced?

 

Dave Bittner: I don't know what they are, but they are pretty birds. [laughter]

 

Joe Carrigan: Yes, they are.

 

Dave Bittner: They're pretty birds.

 

Joe Carrigan: Pretty hens.

 

Dave Bittner: So it was my wife's birthday, and to celebrate there's a farm nearby, it's called "Mary's Land Farm," ha, ha, because we're in Maryland.

 

Joe Carrigan: Right.

 

Dave Bittner: And they have a winter barn experience. [laughter] And that's what we did. And there are little mini goats or -- yeah, little mini goats, there are little mini pigs, there were a couple of donkeys, couple of baby cows that we got to feed, and some sheep. And let's see, there was a tom turkey --

 

Joe Carrigan: Oh.

 

Dave Bittner: -- and a girl turkey, and then these chickens. So you know, you could just spend an hour in there snuggling with all the cute little animals.

 

Joe Carrigan: Are the chickens holdable? Do you get to hold the chickens?

 

Dave Bittner: Yeah.

 

Joe Carrigan: Awesome.

 

Dave Bittner: Yeah, yeah.

 

Joe Carrigan: They're used to being handled.

 

Dave Bittner: Yeah. And the goat you can hold the goat. I held a pig, which was something. The pig wasn't happy about it and was making a lot of squealing noises, but got to hold this little pig and little goat. It was fun. My wife loved it. We had some friends join us, so it was just the right amount of time. But I couldn't help thinking about you because of these beautiful hens who were --

 

Joe Carrigan: They are --

 

Dave Bittner: -- strutting around.

 

Joe Carrigan: -- some good-looking chickens, full-sized.

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: I'm looking -- one of them is definitely Black Laced something. I don't know what it is. That's the gold -- the one on the left --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- is -- you know, she has gold feathers and then around each feather she has like a little black line, it circles the -- goes around the whole [inaudible 00:07:25] called "Gold Laced."

 

Dave Bittner: Okay.

 

Joe Carrigan: And then the other one looks just like a -- eh, standard chicken. [laughter] I don't know what that is.

 

Dave Bittner: Aw.

 

Joe Carrigan: What's she doing? Nothing. She's probably a great chicken.

 

Dave Bittner: Yeah. Eh, all right. Well, hopefully she doesn't listen to this show.

 

Joe Carrigan: Yeah, I hope not. [laughter] It doesn't matter, I still like her.

 

Michelle Kellerman: Justice for standard chickens.

 

Dave Bittner: Yeah.

 

Joe Carrigan: You know what, she might be an Easter Egger, looking at her because she --

 

Dave Bittner: They do sell their eggs, so.

 

Joe Carrigan: Do they?

 

Dave Bittner: Yep.

 

Michelle Kellerman: All right.

 

Dave Bittner: Yeah.

 

Joe Carrigan: How much do they sell their eggs for?

 

Dave Bittner: No idea.

 

Joe Carrigan: Asking for a friend. [laughter]

 

Dave Bittner: No idea.

 

Joe Carrigan: Like I've spent $1,500 on -- and try to recoup some of those costs.

 

Dave Bittner: Mm-hmm. [laughs] That's a lot of eggs, Joe.

 

Joe Carrigan: It is, yeah.

 

Dave Bittner: A lot of eggs.

 

Joe Carrigan: Last night I had to go out and buy a -- spend another 50 bucks on these eggs, so --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- it drove the average cost of eggs up by $12.50 --

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: -- so I can get a water bowl that doesn't freeze.

 

Dave Bittner: Oh, sure. Sure.

 

Joe Carrigan: And -- yeah, that's -- yeah. I'm hoping that works. And doesn't set the coop on fire.

 

Dave Bittner: [laughs] Right. Right, because then you'll have fried chicken. [laughter]

 

Joe Carrigan: Right. Roasted chicken. But that would be a little sad. I think -- I don't know, would I throw in the towel then, probably because my -- all my work would have been destroyed.

 

Dave Bittner: Yeah. That would be --

 

Michelle Kellerman: I'll call an authority if you don't. [laughter]

 

Dave Bittner: That would be a pretty sad day. [ Music ] All right, well, let's get to some stories here. Joe, why don't you lead things off for us here today?

 

Joe Carrigan: So my story is a little bit old. It goes back starting in 2012.

 

Dave Bittner: Wow.

 

Joe Carrigan: I recently -- I found this article thanks to -- or found this story because of a recent article in "AgWeb".

 

Dave Bittner: You were reading "AgWeb"?

 

Joe Carrigan: I'm -- [laughter]

 

Dave Bittner: Farmer Joe is reading "AgWeb"?

 

Joe Carrigan: I'm not reading "AgWeb", but --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- I was -- when I saw the story was in "AgWeb", I was like, "Ooh, 'AgWeb', wonder what this is about?"

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: So this story is about Nikesh AJ Patel, or as his friends call him, "Nick."

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: And in 2012 Nick was the CEO of a company called "First Farmers Financial," with their headquarters in Orlando --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- and then other offices in California and Georgia.

 

Dave Bittner: Yeah?

 

Joe Carrigan: So Nick was working with his chief operating officer of this First Farmers Financial company called Tim Fisher. And they, or maybe just Nick -- and the article's not really clear, fabricated a bunch of documents to make the company look legit, saying that they had $20 million in assets sitting in the Wells Fargo account. They also created resumes, and financial statements, and a bunch of other --

 

Dave Bittner: Hmm.

 

Joe Carrigan: -- background information. Just completely fabricated a company.

 

Dave Bittner: Okay.

 

Joe Carrigan: Why did they do this, so that they could go to the United States Department of Agriculture and get approval for USDA secured loans.

 

Dave Bittner: Hmm.

 

Joe Carrigan: So the government secures a bunch of different kinds of loans.

 

Dave Bittner: Right.

 

Joe Carrigan: So for example, the one everybody's probably most familiar with is in buying a house if you are a veteran, you are eligible to receive a Veterans Administration loan.

 

Dave Bittner: Right.

 

Joe Carrigan: And what that is, is a lender will give you even a lower interest rate because they know the government is going to guarantee that loan. So if --

 

Dave Bittner: Right.

 

Joe Carrigan: -- the veteran defaults on the mortgage and then they go through the foreclosure process and there's a shortfall, that the lender is entitled to, the government will cover that shortfall.

 

Dave Bittner: The full faith and backing of the United States government.

 

Joe Carrigan: Right. Other things include guaranteed student loans --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- are this way.

 

Dave Bittner: Yep.

 

Joe Carrigan: And then there's also apparently some farming loan programs through USDA.

 

Dave Bittner: Okay.

 

Joe Carrigan: So Nick saw this as an opportunity. And once he had the approval to offer these loans, he then created 26 fake loans ranging in value from the 2.5 to 10 million dollars each.

 

Dave Bittner: Wow.

 

Joe Carrigan: And built a portfolio of $179 million of fake loans.

 

Dave Bittner: Hmm.

 

Joe Carrigan: He had forged USDA loan ID numbers and signatures from people at the USDA that did not exist. And then when you have a bunch of fake loans, what do you try to do with them, Dave?

 

Dave Bittner: Buy -- yeah so it buys a lot of chickens.

 

Joe Carrigan: Right, that's -- [laughter] he had received no money for these loans so he hasn't -- I mean --

 

Dave Bittner: Oh, so he's giving out -- he's granting the loans to other farmers?

 

Joe Carrigan: Nope, nope.

 

Dave Bittner: No?

 

Joe Carrigan: He is saying that he has granted the loans to other farmers --

 

Dave Bittner: Oh, okay.

 

Joe Carrigan: -- but he has not given out any money, and --

 

Dave Bittner: But now he has to figure out how to launder it.

 

Joe Carrigan: How to cash in. Well, I think he's already --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- figured out how to cash in because he --

 

Dave Bittner: Right.

 

Joe Carrigan: -- contacts a company called "Pennant Management," which is an investment firm --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- and they were interested. And they did a significant amount of due diligence -- not enough, in my opinion. They fly down to meet with Patel and he shows them all this fabricated evidence, including audited financial statements from a CPA named Geoff Cane, spelled Geoff.

 

Dave Bittner: Oh, yeah.

 

Joe Carrigan: British spelling of Jeff.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Geoff does not exist.

 

Dave Bittner: Oh.

 

Joe Carrigan: He's completely fictitious, completely synthetic. But Pennant winds up taking the bait and buying the fake loans for $179 million.

 

Dave Bittner: Wow.

 

Joe Carrigan: And they wire Nick Patel the money. Sometime in September they start to notice -- September -- this is 2014, they start to notice the -- some address inconsistencies. And they're probably wondering, "Hey, why aren't we getting paid," because when you loan money to somebody they generally pay you.

 

Dave Bittner: [laughs] That's right.

 

Joe Carrigan: If you've ever had a mortgage, one of the first things that happens when you get a mortgage is they sell it to somebody else and then you make your payment to that other person --

 

Dave Bittner: Right.

 

Joe Carrigan: -- and they'll send you notifications. That happens.

 

Dave Bittner: Yeah.

 

Joe Carrigan: But so these guys did something similar, and they were expecting payments but none of them came. So they contact the FBI and they say, "Hey, what's going on? Help us with this." And the FBI investigates and they charge Patel in 2014 with fraud. And he gets arraigned in 2015. And by the way, that's the same year that Pennant Management collapses.

 

Dave Bittner: Oh, no.

 

Joe Carrigan: Goes out of business. He ruined this company.

 

Dave Bittner: Right.

 

Joe Carrigan: Right? Nick then -- during the process of this, Nick pleads guilty in late 2016. So he's been, you know, criminally charged for a couple of years. He's got 196 -- or $79 million in the bank. And he's spending it like wild. I mean, if you read the story, [laughter] it talks about all of the things he did.

 

Dave Bittner: Okay.

 

Joe Carrigan: It's crazy. He -- eventually he winds up pleading guilty in 2020 -- in 2016, and it gets scheduled for sentencing in April of 2017.

 

Dave Bittner: Okay.

 

Joe Carrigan: Nick manages to get his sentencing delayed until April -- or January of 2018.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Now, here is why this is such a wild ride. [laughter] During that time, in 2017, Nick invents the persona, Ron Alias, who is the vice president of Guaranteed Lending at Banco do Brasil --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- which is a real bank, but the position vice president of Guaranteed Lending does not exist and neither does Ron Alias.

 

Dave Bittner: Okay.

 

Joe Carrigan: He then executes the same scheme again selling agricultural loans -- selling loans to Agricultural Mortgage Corporation. That's the Farmer Mac. So I didn't know that Farmer Mac was a thing until I read this. It's sort of the like the Freddie Mac --

 

Dave Bittner: Oh, so like the agricultural version of Freddie Mac?

 

Joe Carrigan: Right, and Sallie Mae.

 

Dave Bittner: Huh. Yeah.

 

Joe Carrigan: There's Farmer Mac. And he sells these loans to Farmer Mac for $20 million.

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: While he is waiting sentencing [laughter] for the exact same crime --

 

Dave Bittner: Wow.

 

Joe Carrigan: -- that took down Pennant Management.

 

Dave Bittner: Okay.

 

Michelle Kellerman: Well, you can't be a multimillion dollar thief and be shy about it, can you?

 

Dave Bittner: [laughs] That's right.

 

Joe Carrigan: We're not done yet. [laughter] This is amazing to me. Three days before sentencing in January of 20 -- what was it, 2017 --

 

Dave Bittner: Yeah?

 

Joe Carrigan: -- or 2018, he says, "Well, I'm not sticking around for this. I know this is not going to go well." And he charters a plane to Ecuador. But the FBI picks up on this and they nab him at the airport. And in March of 2018, two months after that, he is sentenced to 25 years in prison.

 

Dave Bittner: All right.

 

Joe Carrigan: You'd think that would be the end of it.

 

Dave Bittner: [laughs] I'd say justice has been served.

 

Joe Carrigan: No, sir.

 

Dave Bittner: [laughs] Oh, no.

 

Joe Carrigan: Then while in prison for taking out Pennant Management and under indictment for defrauding Farmer Mac, he works with his wife, Trisha, from 2019 to 2023, to start a third company called "Community First Mortgage". Trisha secures a loan guaranteed by the USDA for a company called "Precision Powered Products". Right, this was a company that was -- that existed and was looking to be sold, so they -- you know, she contacted them, asked them some questions, and then she impersonated that company to get another loan to expand into Puerto Rico. And the USDA --

 

Dave Bittner: Oh.

 

Joe Carrigan: -- guaranteed that loan, then Trisha turned around acting as the lender for Community First Mortgage, to sell that loan for another $7.4 million.

 

Dave Bittner: A poultry $7.4 million, right? [laughs]

 

Joe Carrigan: Right. That's just the smallest tank this guy has had so far. So in 2023, the FBI and the USDA inspector general found everything and they have arrested Trisha. And they cleared out Nick's cell, right, they -- in his prison cell, they went in there and they found 3,000 pages of documentation in his cell related to this latest fraud.

 

Dave Bittner: What?

 

Michelle Kellerman: What were they just thinking that those were?

 

Joe Carrigan: I don't know.

 

Dave Bittner: Like Nick's running a lending library out of his cell or stuffed his mattress with papers?

 

Michelle Kellerman: He's an artist. [laughs]

 

Joe Carrigan: It was under his mattress.

 

Dave Bittner: Three thousand pages of documentation.

 

Joe Carrigan: Three thousand pages of documentation.

 

Dave Bittner: Okay.

 

Joe Carrigan: So now Nick has been sentenced to another 27 years in the "federal pen" --

 

Dave Bittner: Hmm.

 

Joe Carrigan: -- as Boss Hogg used to say.

 

Dave Bittner: Yeah. [laughs]

 

Joe Carrigan: So you know, he's got like close to 50 -- or he got more than 53 years of prison time. His wife, Trisha, got 51 months, because I guess her crime was only $7.4 million.

 

Dave Bittner: Yeah, and you know, I mean, who knows, I'm speculating here, but maybe they were able to convince the government that she was operating on his behalf or something. He was the mastermind, right? [laughs]

 

Joe Carrigan: Right, yeah. And she fully cooperated and --

 

Dave Bittner: Yeah.

 

Joe Carrigan: I mean, the -- why is this on "Hacking Humans"? This is -- what's going on here is this guy is smooth talking these people, these lenders that are going to buy these loans and showing them all kinds of fake documentation.

 

Dave Bittner: Right.

 

Joe Carrigan: And it seems to me like all of these lenders didn't do their due diligence. Like in this story from "AgWeb," the USDA when they were looking at that Precision Powered Products, didn't even check the address of the location in Puerto Rico --

 

Dave Bittner: Hmm.

 

Joe Carrigan: -- that they were expanding into, because that was just an abandoned building.

 

Michelle Kellerman: Yeah, that's what I'm wondering, like when I bought my house, I felt like I had to do a blood pact and dental impressions to get my --

 

Dave Bittner: Right, yeah.

 

Michelle Kellerman: -- mortgage.

 

Dave Bittner: It's true.

 

Michelle Kellerman: And they were just, "No, you're cool. Well, I believe you."

 

Joe Carrigan: Yeah.

 

Michelle Kellerman: What?

 

Joe Carrigan: That's essentially what happened, they said, "Yeah, you're cool."

 

Dave Bittner: Hmm.

 

Joe Carrigan: And you know, I don't know about you guys, but if I'm Nick and I run into 100 -- get this $176 million payout from Pennant, I am not sticking around in the US. [laughter]

 

Michelle Kellerman: Well, you don't get many cautious types doing this type of deal.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Yeah, that's true. I mean, yeah. Well, and I think we can learn something about Nick's personality that he continued to do this even while incarcerated. [laughs]

 

Joe Carrigan: Yeah. Yeah, there's something up with this guy.

 

Dave Bittner: So like, you know, you think if, "Oh, maybe they're going to have an eye on me and my family since I'm incarcerated having already done this twice."

 

Joe Carrigan: Right.

 

Dave Bittner: That's really something.

 

Michelle Kellerman: Yeah, I feel like when you've made like 2,700 steps without getting caught --

 

Joe Carrigan: Yeah.

 

Michelle Kellerman: -- you might think that you have a few more. [laughter]

 

Dave Bittner: Maybe. Wow.

 

Joe Carrigan: "Maybe this time I'll get real lucky."

 

Michelle Kellerman: Yeah.

 

Dave Bittner: Right. Wow, that's -- oh. Yeah, I mean, to the due diligence point --

 

Joe Carrigan: Right.

 

Dave Bittner: -- I mean I would imagine that part of this is Nick figured out what the standard degree of diligence was --

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: -- and provided exactly that.

 

Joe Carrigan: Right.

 

Dave Bittner: And that was it.

 

Joe Carrigan: Nobody ever followed up, nobody --

 

Dave Bittner: Right.

 

Joe Carrigan: -- from Pennants said, "Hey, why don't we call the USDA and verify these numbers --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- these loan numbers, just to make sure this isn't some kind of fraud thing?"

 

Dave Bittner: Right.

 

Joe Carrigan: Because if you do that, then the USDA goes, "Nope, none of these are real numbers," then you call the FBI before you send any money --

 

Dave Bittner: Mm-hmm.

 

Joe Carrigan: -- and you know, Nick Patel doesn't collapse your company.

 

Dave Bittner: Right.

 

Joe Carrigan: Right? He doesn't run you out of business.

 

Dave Bittner: Well, who knows? I know -- you know, who knows what was going on with the management company, but --

 

Joe Carrigan: Yep.

 

Dave Bittner: -- we've certainly seen lots of cases where people get blinded by greed --

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: -- you know? [laughs]

 

Joe Carrigan: It was a [inaudible 00:20:00] of an opportunity to be true, I think --

 

Dave Bittner: Right.

 

Joe Carrigan: -- is what was going on.

 

Dave Bittner: Right. Absolutely. Wow. Well, boy. So I guess lesson learned here is do your due diligence and also just because somebody has reams and reams of paperwork --

 

Joe Carrigan: [laughs] In their prison cell.

 

Dave Bittner: -- in their prison cell, right. "Listen -- " [laughter] yeah, "Listen, I'm going to take a meeting, but I need to warn you ahead of time that it's a very secure facility, [laughter] so in my office."

 

Michelle Kellerman: Were they just like, "Hey, I'll throw in an ink cartridge for you for free?"

 

Dave Bittner: Right. Right. All right, well, we will have a link to that story in the show notes. Michelle, let's move on to you. What do you have for us this week?

 

Michelle Kellerman: So my story is currently breaking. It only came out yesterday, and details are still a little squishy, I guess. Story is from "CyberScoop," where --

 

Dave Bittner: Hmm.

 

Michelle Kellerman: -- Okta SSO, the Single Sign-On provider, they put out an alert that their service was being abused by a group called "ShinyHunters" --

 

Dave Bittner: Hmm.

 

Michelle Kellerman: -- in a targeted voice phishing campaign combined with custom phishing kits against certain corporations.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: So this is a very targeted phishing campaign where they are not just doing the phish to try and get somebody to give their multifactor authentication codes, they are also using that -- once they get their initial access they are pivoting to register their own multifactor authentication devices to be able to move around the network and steal data.

 

Joe Carrigan: Maintain presence.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: Yeah, the interesting detail is this is so custom and so specific that they are using -- they're registering custom domains. Sophos is tracking about 150 custom domains registered for this campaign that makes it look like a legitimate domain, as they are posing as the company's help desk, and then making it seem legitimate like it's on behalf of the company, using those custom domains to make it look real, and they mimic the MFA site almost exactly --

 

Dave Bittner: Hmm.

 

Michelle Kellerman: -- that you have no idea that you are putting something into a weird site that you've never seen. They have them for not just Okta, but also Google and Microsoft multifactor authentication. So they're --

 

Dave Bittner: Well, let me just back up for a second for folks who may not be familiar, can -- explain to us what Single Sign-On is and -- because Okta a third-party provider of that service, right?

 

Michelle Kellerman: Yes. So Single Sign-On is something that corporations use to -- you can -- it's what the name describes, you have your one user name and password, either an email or just a regular user name, and one password for the company that will work across multiple services. So when you want to sign onto your email, but also sign onto your timesheet to fill out how many hours you work, you get to use the same logon.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: That doesn't happen by itself, there needs to be something that if you have multiple services from multiple providers -- because Microsoft isn't going to be doing your timesheet, Okta will do that for you on your behalf. So you only have to memorize one user name and password instead of like 3,000 --

 

Dave Bittner: Right.

 

Michelle Kellerman: -- depending on how large your corporation is.

 

Dave Bittner: Okay.

 

Michelle Kellerman: So it's a single point of failure if you have access to the multifactor authentication.

 

Dave Bittner: So for the user it makes life a lot easier --

 

Michelle Kellerman: Mm-hmm.

 

Dave Bittner: -- because you have, as its name, the single sign-on that basically logs you into everything you need to do at work, for example.

 

Michelle Kellerman: Yes. And so you only have to memorize one, but there's also then just one authentication to get access to anything that you may need for that company.

 

Dave Bittner: Hmm.

 

Joe Carrigan: So if they get that, it's the keys to the kingdom.

 

Michelle Kellerman: Yes. So they had this Single Sign-On attack. And normally when you have a voice phishing campaign, it's kind of a spray and pray, you just try and hit as many as possible. You try and just hope that you get your hooks in one thing. This is very targeted and very specific. The domain registration is -- they chose that you have very specific companies that you are going after. This is not just for everybody, this is -- they are looking for specific information. Once they get the MFA solution, and then they register their own bad devices to be able to maintain that persistence -- so they only need to do the phishing once and then they have their device where they can continuously log on, then they try and get an elevated account, so privileged access. Then comes the data exfil and the extortion. So this group has been known to extort the companies that they are targeting. It's not just pure data exfil.

 

Dave Bittner: Let me just ask Joe, this -- they're using voice phishing here, what's the shortened name for that, Joe?

 

Michelle Kellerman: I specifically left it out, [laughter] because I have to be down the hall from him, okay? I am being very intentful.

 

Dave Bittner: Yeah, what do they call that, Joe? What's the common --

 

Joe Carrigan: Scam phone calls, Dave, scam phone calls.

 

Dave Bittner: -- what's the word they use for -- no, there's something else I'm thinking of, it's -- it has to be "phishing".

 

Michelle Kellerman: I think it's called "phishing". I don't know. I mean --

 

Joe Carrigan: "Phishing".

 

Dave Bittner: Aw, Michelle, you ruined it for me.

 

Michelle Kellerman: -- "phishing" is my favorite word.

 

Joe Carrigan: It's my least favorite, one of my -- actually, "shmishing" and "quishing" are actually --

 

Michelle Kellerman: "Quishing" broke me.

 

Joe Carrigan: Yeah. Yeah.

 

Dave Bittner: Yeah, "quishing" is pretty bad. [laughs]

 

Michelle Kellerman: I had to take a walk when I read that for the first time.

 

Dave Bittner: Yeah, "quishing's" pretty bad, definitely. It's a -- you're diving off a clip with "quishing," but --

 

Joe Carrigan: Yes.

 

Michelle Kellerman: Yup. We commuted here together. If I get in an accident on the way, it was not my fault.

 

Dave Bittner: Right, right. Joe steers the passenger side of the car into a telephone pole?

 

Michelle Kellerman: Mm-hmm. He's taking us all down.

 

Dave Bittner: [laughs] Right.

 

Joe Carrigan: At least I'll never hear -- have to hear the word "phishing," or, "quishing," or, "shmishing" again. [laughter]

 

Michelle Kellerman: There are so many better ways to not do that.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Yeah.

 

Michelle Kellerman: So this has been a developing story, there hasn't been a lot of information about the specifics of what they're exfilling.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: But the phishing kits that are after -- that are part of the attack, it demonstrates the real-time capability to mimic the authentication flow. So it's not just the user interface, they are also programming that user interface that the victim is putting their MFA into to mimic legitimate traffic. So it looks -- so it doesn't get caught by, you know, an intrusion detection system.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: They are going multiple steps beyond -- let's just hope that they don't look too closely, they're even mimicking data packs and dataflows --

 

Dave Bittner: Hmm.

 

Michelle Kellerman: -- amongst the Microsoft, Google, and Okta Sign-In flows.

 

Dave Bittner: Hmm. Is there a sense here that they're going after high-value targets? I mean, they must be with this amount of effort.

 

Michelle Kellerman: Yes, it was for financial institutions, healthcare, banking. This actually -- I first saw this on BankInfoSecurity to get more -- to get additional details. There are -- it's very high value. It's very interesting that ShinyHunters took credit for it publicly when they have a very well-known reputation for not following through on their end of the bargain.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: So I was kind of confused about that. They have a -- even in their press releases, they're just like, "Hey, these guys don't hold up their end and they will re-extort you. Don't bother."

 

Dave Bittner: Oh. Hmm.

 

Michelle Kellerman: And so I was surprised that they said, "Yeah, it's us."

 

Dave Bittner: [laughs] Right. Right.

 

Michelle Kellerman: You don't have the reputation to be doing that.

 

Dave Bittner: It's interesting.

 

Joe Carrigan: What if it's not them and they were just trying to ruin somebody else's take.

 

Michelle Kellerman: Maybe.

 

Joe Carrigan: Could be. That's me just speculating wildly.

 

Michelle Kellerman: Yeah, bad guy PR is not in my wheelhouse, but -- [laugh]

 

Dave Bittner: No honor among thieves.

 

Joe Carrigan: Right.

 

Michelle Kellerman: Yeah. So I thought that that was really interesting, but it kind of -- this story struck me also because -- Joe mentioned the CrowdStrike report that I sent him a couple weeks ago about how 79% of attacks are now malware-free --

 

Dave Bittner: Hmm.

 

Michelle Kellerman: -- and they are going through people. And it's not -- this is going to show how far they are willing to go to not do malware and how even with all this effort and creating all these dataflows, you know, making sure that they have the right domains, they're putting a ton of work into it. And that is still, I guess to them, less work than creating a piece of malware. Like this is clearly a better path for them to get what they want, even with all this extra work attached.

 

Dave Bittner: Right.

 

Joe Carrigan: And it's much more successful, probably.

 

Dave Bittner: Right.

 

Michelle Kellerman: Yeah. So that just speaks to like the degree of difference and difficulty that they're willing to do all of this to just not use malware --

 

Dave Bittner: Yeah.

 

Michelle Kellerman: -- which was interesting to me.

 

Dave Bittner: How -- what -- are there -- and this article have recommendations for how folks can best protect themselves here, because if what I'm logging into looks and feels exactly like my Single Sign-On provider, it's going to be tough to differentiate.

 

Michelle Kellerman: Yeah, using physical MFA tokens, so something like a YubiKey, is a big one.

 

Dave Bittner: Ah. Because you can't pass that on to the bad guy.

 

Michelle Kellerman: Yeah, --

 

Joe Carrigan: Right.

 

Michelle Kellerman: -- you cannot pass that on to the bad guy.

 

Dave Bittner: Hmm.

 

Michelle Kellerman: And so that's really the biggest one, and double-checking the fake domains. But really just know your help desk is not going to call you ever.

 

Dave Bittner: Hmm. Yeah.

 

Michelle Kellerman: Like that's just -- they are not going to -- if they're going to do something, it's going to be an email that goes out to people as a blessing, "Hey, this service is down," not, "Click here to go and fix something." They are never going to mass-prompt their users to do something.

 

Dave Bittner: Mm-hmm.

 

Michelle Kellerman: That's just not how help desks work. They have too much to be doing. They're not going to reach back, "I had to get into my help desk today for something simple." They said, "Yeah, we'll call you back." They didn't. They're not calling you. [laughter] Like that's just -- just don't listen to people who call you on the phone. I'm a millennial. If my phone audibly rings, I'm already doing something wrong. I'm already irritated.

 

Dave Bittner: Right. Yeah.

 

Michelle Kellerman: I'm going to extra not do what you told me to do because you bothered me during my workday.

 

Dave Bittner: Just out of spite.

 

Joe Carrigan: Right.

 

Michelle Kellerman: Take that with you.

 

Dave Bittner: Yeah, I understand.

 

Michelle Kellerman: But yeah, physical keys can't be passed. And the same -- kind of similar, it's not quite juicy enough to make you feel secure, but don't trust when somebody says, "Hey, we're here to help you.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Yeah, that's --

 

Michelle Kellerman: We're here to help you figure this out." That doesn't happen.

 

Joe Carrigan: Right.

 

Dave Bittner: Yeah. The brief time that I was working for a company that was big enough to have a help desk, they were on a different floor from us, and I bugged the heck out of them because anytime they asked for something, I would physically go up there and like knock on the door and be like, "Hey guys, did you send this to me?" [laughter] And they, "Yes, yes, we did." "Okay, just checking." And then, you know, off I went. But I figured why not, right, you know, better safe than sorry. So we can have face-to-face -- it's like the thing about your boss asking you to buy gift cards --

 

Joe Carrigan: Yes.

 

Dave Bittner: -- right, go down the hall.

 

Joe Carrigan: Right.

 

Dave Bittner: Knock on your boss's door. Check in just to make sure. Face-to-face is a great way to diffuse these things.

 

Michelle Kellerman: Face-to-face is a great way to diffuse things for a bunch of work stuff.

 

Joe Carrigan: Yeah.

 

Michelle Kellerman: Being -- having the ability to go down to my boss's office and annoy him personally, it's so much value.

 

Dave Bittner: [laughs] Yeah, right, to complain about Joe. [laughs]

 

Joe Carrigan: I do that a lot to him.

 

Michelle Kellerman: I told him today, I'm like, "I'm judicious with my botherings. This is me being toned down." And he's just like, "Well, isn't that tragic?" [laughs]

 

Dave Bittner: Yeah. All right, well, we will have a link to that story in the show notes. Let's take a break right now to hear from our show sponsor. We will be right back after this. [ Music ] And we are back. My story this week comes from the folks over at Infosecurity Magazine. And this is about a campaign that's going after LastPass, which is one of the big names in password managers.

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: They are --

 

Michelle Kellerman: No comment.

 

Dave Bittner: -- warning companies that there's an active phishing campaign that is impersonating the company to try to steal master passwords and take over people's accounts. So kind of like what we were talking about with the single sign-on, if you get someone's master password and access to their password manager --

 

Joe Carrigan: Yes.

 

Dave Bittner: -- that's it.

 

Joe Carrigan: That's --

 

Dave Bittner: That's the ballgame.

 

Michelle Kellerman: Same thing with email.

 

Joe Carrigan: Right.

 

Dave Bittner: Same thing with email. Right. Right. So LastPass's -- their Threat Intelligence, Mitigation, and Escalation team, which they cleverly refer to as 'TIME" --

 

Joe Carrigan: Ah.

 

Dave Bittner: -- they --

 

Joe Carrigan: That's a good acronym.

 

Dave Bittner: Yeah, it's not bad.

 

Michelle Kellerman: It's a not irritating acronym, and I'll take that.

 

Joe Carrigan: Right. Yep.

 

Dave Bittner: Yeah. Makes me think of Morris Day and the Time.

 

Joe Carrigan: Yes.

 

Dave Bittner: Oh, we, oh, we, oh.

 

Joe Carrigan: Jerome.

 

Dave Bittner: Yeah. [laughter] So --

 

Joe Carrigan: Well, I think we just --

 

Michelle Kellerman: Young --

 

Joe Carrigan: Michelle is shrugging.

 

Dave Bittner: Yeah, Michelle has no idea what we're talking about, no.

 

Michelle Kellerman: -- person here. I'll get the too long [inaudible 00:32:38] later.

 

Dave Bittner: She doesn't want her MTV.

 

Joe Carrigan: Yes.

 

Dave Bittner: So this started happening mid-January. And the phishing emails say that the users need to urgently back up their password vaults within 24 hours because there's going to be maintenance happening soon.

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: So Joe, artificial time --

 

Joe Carrigan: Artificial time horizon, exactly.

 

Dave Bittner: That's right. That's right.

 

Joe Carrigan: Do it now.

 

Dave Bittner: Yeah. And so links in the emails lead to a fake LastPass login page, and that gets their usernames and then their master passwords.

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: And then, as we said, they gain access to not just your LastPass account, but everything stored within there. And that, of course, can be all your passwords. But you know, lots of people store things like credit card information. There are all sorts of things you can trust a password manager like LastPass with.

 

Michelle Kellerman: Yeah, secure notes and stuff.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Sure. Yeah, all kinds of things. So LastPass says that these emails are circulating widely. They're seeing a lot. And as we said, they rely on their urgency to pressure the victims into clicking through, because they threaten you basically by saying, "If you don't do this, you're going to lose access to everything."

 

Michelle Kellerman: And a common rule of thumb is companies will not -- they will not prompt you for the action. They will wait for something to not work and then you call them. [laughter] I think that's a good general rule of thumb.

 

Joe Carrigan: Right.

 

Dave Bittner: Yeah, that's true.

 

Michelle Kellerman: I feel like that's a fair like assessment.

 

Dave Bittner: Yeah, that's true.

 

Michelle Kellerman: It's not a guarantee, but --

 

Dave Bittner: Yeah.

 

Joe Carrigan: So I just went through the LastPass website and they have authentication using desktop biometrics or a security key --

 

Dave Bittner: Yep.

 

Joe Carrigan: -- and they have FIDO2 compatible authenticators like YubiKey, and Google Titan, and all those.

 

Dave Bittner: Right.

 

Joe Carrigan: So if you're going to store your passwords in a password manager and even if that password manager is not in a cloud -- I mean, I would recommend this for like the one I use, what, PassKeeXC? I can't remember what it's called. I have it open right now. Let's see. [hums] Give me one second. Yes, it's PassKeeXC -- no, KeePass, KeePassXC.

 

Dave Bittner: Okay.

 

Joe Carrigan: If you can protect that with a FIDO2 compliant device, your password doesn't do any good to these guys.

 

Dave Bittner: Mmm. Mm-hmm.

 

Joe Carrigan: Because they still need a physical access of that device to get to your password manager.

 

Dave Bittner: Right. Right.

 

Joe Carrigan: So again, here we are, why aren't we using more hardware tokens?

 

Dave Bittner: Yeah, yeah, hardware -- I mean, anything's better than nothing in this case.

 

Joe Carrigan: Yes.

 

Dave Bittner: But a hardware key is pretty much top of the heap --

 

Joe Carrigan: Yep.

 

Dave Bittner: -- when it comes to protecting something. And to Michelle's point, I would say adjacent to your email account is the access to your password manager.

 

Joe Carrigan: Yeah.

 

Dave Bittner: And of course, email accounts are important because everything flows through there.

 

Joe Carrigan: Right, any password resets --

 

Dave Bittner: All the password changes -- yeah.

 

Joe Carrigan: -- go right through it.

 

Dave Bittner: Right.

 

Michelle Kellerman: Unfortunately, people don't like being inconvenienced, which is why "password" is a common password. And then, "password1" is just as common --

 

Dave Bittner: Yeah.

 

Michelle Kellerman: -- because we don't like being inconvenienced.

 

Dave Bittner: I was -- oh, how do I describe this? I was doing a little help -- tech support for a friend of mine, who was having trouble logging onto a community volunteer group website. And she's just having trouble time and time again. And at one point, I said to her, "What I'm going to ask you to do, my friend, is I need you to use -- I need you to create a password for this site and this site alone." And her face dropped like I was asking her to -- [laughter] you know, to sell a child or something.

 

Joe Carrigan: Right.

 

Dave Bittner: She's like, "What do you mean a password just for this site," you know? So I sighed, and she agreed to do it, and so far, so good. But --

 

Joe Carrigan: Mm-hmm. Okay.

 

Dave Bittner: -- you're right, Michelle, I mean, it's just -- and I get it, right, it's human nature. And everybody thinks it's not going to happen to them. But we're past that point.

 

Joe Carrigan: Yes.

 

Dave Bittner: We are past that point, especially with this critical stuff like your password manager and your email account. And the username and password aren't good enough anymore. [laughs]

 

Joe Carrigan: No, they are not.

 

Dave Bittner: You need more than that.

 

Michelle Kellerman: Well, it's also just we have to do it so often, like your lightbulbs have a username and password now, sometimes.

 

Joe Carrigan: Not my lightbulbs. [laughter]

 

Michelle Kellerman: Right, it's like -- and some days it's like, "I'm one poorly-timed MFA request away from a bad mood."

 

Joe Carrigan: Right.

 

Dave Bittner: Oh, my gosh, oh, yes, are you --

 

Michelle Kellerman: So --

 

Dave Bittner: Oh, yeah.

 

Michelle Kellerman: -- I get it.

 

Dave Bittner: No, no, I mean not all --

 

Michelle Kellerman: I get the irritation. [laughs]

 

Dave Bittner: Oh, boy. Yeah, I don't -- I generally don't like to curse, but when I'm in username-password hell -- [laughter] I mean, I'll be by myself and say it under my breath, but man, that -- yeah it boils my blood when --

 

Michelle Kellerman: You know what, I don't need to do this anymore. It's fine.

 

Joe Carrigan: Right.

 

Dave Bittner: Right. [laughs]

 

Michelle Kellerman: This is optional now.

 

Joe Carrigan: I don't need to pay this bill right now. [laughs]

 

Dave Bittner: No.

 

Michelle Kellerman: You need me to pay this bill.

 

Dave Bittner: I'll work in the dark.

 

Michelle Kellerman: Stop -- get out of my way about it.

 

Dave Bittner: Yeah, these lights don't need to turn on. I will light a candle --

 

Joe Carrigan: Yep.

 

Dave Bittner: -- in the darkness.

 

Michelle Kellerman: Yep.

 

Dave Bittner: All right, well, we will include a link to this story in the show notes. And of course, we'd love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans@n2k.com. All right, Joe, Michelle, it is time for our "Catch of the Day".

 

Joe Carrigan: Dave, can I provide one update before we go to "Catch of the Day"?

 

Dave Bittner: Please.

 

Joe Carrigan: I have another egg today. [laughter] My wife just sent me a text.

 

Michelle Kellerman: Were the times -- were the dates stamped like a library date stamp on it? Oh.

 

Joe Carrigan: Yeah, my wife has purchased a date stamp for the egg so we know what day the egg was laid.

 

Dave Bittner: Okay. Oh really?

 

Michelle Kellerman: Is that going to get put up?

 

Joe Carrigan: Yes.

 

Dave Bittner: That's funny.

 

Michelle Kellerman: Are you going to like frame that in a way where like you can see it's like the first dollar ever made of a business and it's like the egg timestamp?

 

Joe Carrigan: You know --

 

Dave Bittner: That's a good idea.

 

Joe Carrigan: Yeah, part of this --

 

Dave Bittner: I figured that Joe -- well you know what --

 

Michelle Kellerman: You're looking at me like I'm crazy like you wouldn't absolutely do that.

 

Dave Bittner: Yeah. I'm also waiting for the day when you install some kind of automation that has a camera that keeps an eye on the coop --

 

Joe Carrigan: Right.

 

Dave Bittner: -- and automatically texts you with a time and number of laid eggs.

 

Joe Carrigan: I just hear that Bugs Bunny industrial music playing [hums] [inaudible 00:38:54].

 

Dave Bittner: [laughs] And then, yeah, automatically prints a barcode on the eggs --

 

Joe Carrigan: Right.

 

Dave Bittner: -- you know, all these kinds of things.

 

Michelle Kellerman: That's why I was chuckling when he was like, "Yeah, I think I'm going to do something redneck." I was like, "You have an automatic time door with a light sensor. [laughter] Nothing about what you're doing is redneckery. Get out of here."

 

Dave Bittner: No, no, he's got more technology in that chicken coop than we had in Apollo 11. [laughs]

 

Joe Carrigan: Yes.

 

Michelle Kellerman: Yes. Your chickens could go to the moon, so.

 

Joe Carrigan: I told you about my daughter's plan for building an industrial control system --

 

Dave Bittner: Yeah, yeah.

 

Joe Carrigan: -- is poultry -- what was it, poultry -- it's poultry operational technology on a raspberry pie, and she was going to call it "Pot pie," the chicken pot pie.

 

Dave Bittner: Oh. [laughs]

 

Michelle Kellerman: Spectacular?

 

Dave Bittner: You know what that means? I don't know if you -- if either of you are familiar with this, and this is kind of a deep cut, but you know the industrial control system company Dragos?

 

Michelle Kellerman: Yes.

 

Joe Carrigan: Mm-hmm.

 

Dave Bittner: So in their lobby, they have a giant Lego set that has Lego versions of basically everything that could be controlled by industrial control systems.

 

Michelle Kellerman: That sounds like a very [inaudible 00:39:53] movie.

 

Dave Bittner: So the Lego set has a nuclear power plant, has a water treatment plant, has -- I wonder if they have a chicken coop, Joe?

 

Joe Carrigan: I don't know.

 

Dave Bittner: Right?

 

Michelle Kellerman: I doubt it because nobody's like -- nobody looks at chickens as like, "You know what this needs --

 

Dave Bittner: Yeah.

 

Michelle Kellerman: -- technology."

 

Joe Carrigan: Right.

 

Dave Bittner: I would imagine.

 

Michelle Kellerman: Nobody looks at a homesteading and is like, "I'm missing a computer." [laughs]

 

Dave Bittner: They probably have like Perdue, you know, the industrial control systems that run a major chicken processing plant.

 

Joe Carrigan: Right.

 

Dave Bittner: But what my point is I think your daughter needs to make a little minifig scale chicken coop --

 

Joe Carrigan: She --

 

Dave Bittner: -- send it over to Dragos with a little letter, with a little picture of her setup, and have it added to the Lego set that's in the Dragos lobby.

 

Joe Carrigan: I think she bought Robert Lee's children's book.

 

Michelle Kellerman: Solid.

 

Dave Bittner: There you go. See?

 

Michelle Kellerman: Spectacular.

 

Joe Carrigan: Because Robert Lee, President -- the CEO of Dragos --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- wrote a children's book about cybersecurity, and I think she'd want it for her kids.

 

Dave Bittner: There you go. Perfect.

 

Michelle Kellerman: Yeah, the book for children and managers. [laughter] There's like four of them. They're excellent.

 

Dave Bittner: Yeah, have a big gap between the two sometimes.

 

Joe Carrigan: Yeah.

 

Dave Bittner: All right, "Catch of the Day," Joe. [ Music ]

 

Joe Carrigan: "Catch of the Day," yes. So this one comes from the scam bait Subreddits. Who's going to do these? Do you want me to read it, you want Michelle?

 

Dave Bittner: I will -- so this first one, I will do the part that is in gray. Joe, you can do the part that's in green --

 

Joe Carrigan: Okay, [inaudible 00:41:21] --

 

Dave Bittner: -- because this first one is very short, but also very funny.

 

Joe Carrigan: Okay.

 

Dave Bittner: Go ahead. "How have you been lately?

 

Joe Carrigan: "Who is this?

 

Dave Bittner: This is Annie, darling. Didn't you save my number?

 

Joe Carrigan: Annie, the same Annie who beat my brother to death?

 

Dave Bittner: Yes." [laughter] I love just the, "Yes." "Yes." [laughter]

 

Joe Carrigan: That's awesome.

 

Dave Bittner: Isn't that great? Yeah.

 

Joe Carrigan: Because they're fishing for something here, you know --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- looking for you to go like, "Annie, the Annie I met at the conference?" "Yes."

 

Dave Bittner: Yes. [laughs]

 

Michelle Kellerman: I really don't take enough advantage of my free will.

 

Joe Carrigan: Right.

 

Dave Bittner: Yeah?

 

Michelle Kellerman: I'm missing the bar.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Yeah.

 

Joe Carrigan: Well, you've heard me answer my phone as Mabel Johnson.

 

Michelle Kellerman: Oh, yeah.

 

Joe Carrigan: Yeah.

 

Dave Bittner: All right, so we have a second one here because the first one was short. So --

 

Joe Carrigan: Okay.

 

Dave Bittner: -- tell you what, Michelle, you can do the gray part, Joe, you can be in blue --

 

Joe Carrigan: All right.

 

Dave Bittner: -- and I'll sit back and enjoy the fun. And we will -- well, we'll stop with the -- where there's the big X, and you can abbreviate the profanity there, Michelle, if you please. [laughter] All right, go ahead.

 

Michelle Kellerman: "Long time, no see. Are you back?

 

Joe Carrigan: "Yes, I am. Are you? I heard your sentence was extended for poor behavior."

 

Dave Bittner: That's pretty good.

 

Michelle Kellerman: "I'm planning to host a small barbecue party tomorrow and have invited a Texas barbecue chef. Are you free tomorrow?

 

Joe Carrigan: "I thought you were still locked up, though.

 

Michelle Kellerman: My name is Jack. May I ask, are you Mr. David? We met at a jewelry exhibition.

 

Joe Carrigan: Ah, I see the mix-up. I thought you were my homey Big T, but he is in lockup right now. So I was thinking to myself, 'How is Big T going to invite me to a barbecue party with Texas barbecue -- with a Texas barbecue chef when Big T is currently in the big house?' You know what I mean? Lol. All good, man. You cool, though?"

 

Michelle Kellerman: I am so sorry, my assistant must have dialed the wrong number. I hope my mistake didn't ruin your day.

 

Joe Carrigan: Your mistake only slightly ruined my day. I think I'll survive.

 

Michelle Kellerman: [Beep] you. You should die early. [Beep] you."

 

Joe Carrigan: Well, that's -- hmm, well on that note, I won't be taking you up on your invitation to the Texas barbecue party with the real Texas chef. I could give you the number of a very good therapist, though, someone who is really top-notch with helping people work through their anger management issues. Shall I text her number to you?"

 

Dave Bittner: End scene. [laughs]

 

Joe Carrigan: Right.

 

Michelle Kellerman: Yeah, that was the surprising thing to me is like you would think doing the most irritating thing in existence, being the most irritating person -- like you poll worse than staph infections as a scammer. [laughter] And you have this short of a temper, like you're in the wrong game, my guy. What are you doing here?

 

Joe Carrigan: Right.

 

Dave Bittner: Yeah, that's true.

 

Michelle Kellerman: Like that's very surprising to me. You're the annoying one here.

 

Dave Bittner: I wonder if they have macros for these --

 

Joe Carrigan: Oh, it's just --

 

Dave Bittner: -- to give responses. [laughs]

 

Joe Carrigan: -- copy and paste -- oh for the heated responses, probably not. That's probably them actually typing.

 

Michelle Kellerman: I get to be the one cursing. You're messing my day up.

 

Joe Carrigan: Right.

 

Dave Bittner: Yeah. Yeah.

 

Joe Carrigan: I actually have a Texas barbecue story. You guys want to hear it?

 

Michelle Kellerman: As long as you don't call the Texas barbecue guy a chef.

 

Dave Bittner: Do we have a choice? Go for it, Joe.

 

Joe Carrigan: Okay, so my wife and I we were in Houston and we were driving to our friend, Joel. You met Joel --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- driving to his ranch out in the middle of San Saba County. And she's -- my wife says, "Where do you want to stop for lunch?" I'm like, "Well, let's stop at that guy's place." And it says -- I think it was Dave's -- no, it wasn't Dave's, [inaudible 00:44:43] --

 

Dave Bittner: Famous Dave's?

 

Joe Carrigan: No, it was not Famous Dave's. [laughter]

 

Michelle Kellerman: Imagine if he had a barbecue story.

 

Joe Carrigan: Nathan's. It was Nathan's Barbecue.

 

Dave Bittner: Okay.

 

Joe Carrigan: And it's between Houston, and so -- it's just outside of Houston like about two hours --

 

Dave Bittner: Okay.

 

Joe Carrigan: -- which in Texas is just outside of Houston.

 

Dave Bittner: Right.

 

Joe Carrigan: So I said, "Well, there's that place there." And she goes, "That's 150 miles away." I'm like, "We're going to get there eventually. We might as well stop," and it's woodfire barbecue. So we walk into the --

 

Michelle Kellerman: Ooh.

 

Joe Carrigan: -- woodfire barbecue place and I go, "What's good here?" And of course the people there go, "Everything's good here. This is woodfire barbecue." And we sit down and we're eating. It's like -- it's kind of like the old like Ponderosa --

 

Dave Bittner: Sure.

 

Joe Carrigan: -- where you walk through and you get stuff and then you get --

 

Dave Bittner: Yeah.

 

Joe Carrigan: -- the barbecue sauce on it and you sit down. And Nathan comes out from the back and he's like, "Hey, you guys are from out of town." I'm like, "Yeah, we're from Baltimore." And he goes, "Oh, my favorite baseball players is from Baltimore." And I'm thinking, "He's going to say Cal Ripken," right --

 

Dave Bittner: Sure.

 

Joe Carrigan: -- because every --

 

Dave Bittner: Yeah.

 

Joe Carrigan: We say, "Who's your favorite baseball player," and he goes, "Boog Powell and -- " and my wife says, "I got a picture of me and my daughter with Boog Powell and we just got it last week." And she pulls up her cell phone and shows this guy a picture of her and Boog Powell.

 

Dave Bittner: Wow.

 

Joe Carrigan: And Boog has that barbecue joint outside of Camden Yards.

 

Dave Bittner: Right, exactly. Yeah, yeah, he has his famous barbecue place --

 

Joe Carrigan: Yeah.

 

Dave Bittner: -- where you go to the Orioles game, you can enjoy some delicious Boog Powell barbecue.

 

Joe Carrigan: And you can get your picture taken with Boog because he's almost always there.

 

Dave Bittner: That's true.

 

Joe Carrigan: Yeah.

 

Dave Bittner: Yeah. Is he a hall-of-famer?

 

Joe Carrigan: Ah, good question.

 

Dave Bittner: I don't know.

 

Joe Carrigan: I don't know.

 

Michelle Kellerman: Because that's critical to the story. [laughs]

 

Dave Bittner: Well --

 

Joe Carrigan: This story is critical to nothing.

 

Dave Bittner: Because we were both -- yeah. [laughter]

 

Joe Carrigan: It's --

 

Dave Bittner: It's true. Too many --

 

Joe Carrigan: Just a --

 

Dave Bittner: -- rabbit holes.

 

Joe Carrigan: Yeah. But yeah, it was Nathan's Barbecue. Really good barbecue, it was woodfire barbecue, which not a lot of places in Texas do.

 

Dave Bittner: Hmm. All right. Well, that is our "Catch of the Day" or our "Catches of the Day". [laughs] So again, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's hackinghumans@n2k.com. [ Music ] And that is our show brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly-changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben, were mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

 

Joe Carrigan: I'm Joe Carrigan.

 

Michelle Kellerman: And I'm Michelle Kellerman.

 

Dave Bittner: Thanks for listening. [ Music ]