When AI wears a suit and tie.
Dave Bittner: Hello, everyone, and welcome to N2K CyberWire's "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague, Maria Varmazis. Maria.
Maria Varmazis: Hi, Dave. And hi, Joe.
Dave Bittner: We've got some good stories to share this week. But first, let's jump into some followup here. Joe, what do you got for us first?
Joe Carrigan: So last week or last, actually, two weeks ago, because I was not on the podcast last week.
Dave Bittner: That's right.
Maria Varmazis: We missed you.
Joe Carrigan: I was postulating. I'm sorry. I really wish I could be in Florida during this time of year, especially with the snow falling outside right now. I'm very angry about it. It's March, and there should be no snow.
Dave Bittner: Yeah.
Maria Varmazis: Oh, yeah.
Joe Carrigan: Anyway, Michelle was noting that I was wondering what aggravated identity theft is as opposed to just regular identity theft. And Michelle is, has a lot of background in law and policy.
Dave Bittner: Right.
Joe Carrigan: And she says aggravated identity theft is identity theft that is used in the commission of another crime.
Dave Bittner: Oh.
Joe Carrigan: So if you just steal someone's identity, it's fine. But then if you, it's not fine, it's just identity theft.
Maria Varmazis: It's just vanilla identity theft.
Joe Carrigan: Right, exactly. But then if you use that to commit something like wire fraud in that person's name, then that becomes aggravated identity theft.
Dave Bittner: I see.
Maria Varmazis: Because it's very aggravating that you've done that.
Joe Carrigan: It's an aggravated, yeah, right. I think it has to do with the legal terminology is it's an aggravating factor, or there are --
Maria Varmazis: Gotcha.
Joe Carrigan: -- aggravating factors.
Dave Bittner: I see. That makes sense.
Joe Carrigan: That make, like, this wound you've committed to society worse.
Dave Bittner: Right. All right. Good. Well, thank you, Michelle, as always. All right. We've got some other feedback from one of our listeners here. Maria, you want to take us through this one?
Maria Varmazis: Sure. This one comes from listener Robert Eberhardt from Calgary, Canada, and he wrote a very detailed email, so I'm just going to read it through, because this is really good stuff. And he wrote, "Hi team, I listened to Dave's story about attackers using social engineering to reroute payroll deposits. And the interesting part for me was the contracted discussion about shared mailboxes," this is shared email inboxes to be specific. "And I heard you ask the question, Why would you ever use them? And it just so happens that my job deals with these on a regular basis with my clients." So this is a really detailed email, so I'm going to go through all the bullet points that Robert puts in here. And he writes first, "In exchange, shared mailboxes do not need a license, so they are used typically for inbound email only. They can be AP, like a, what is it?
Joe Carrigan: Accounts payable.
Maria Varmazis: Accounts payable, thank you. "Accounts payable @, or accounts receivable @, or HR questions @, etc. The shared mailbox does have an address associated, but typically does not have an ID and a password assigned. Users with a license are assigned access to the shared mailbox from their own mailbox. It shows up in the folder pane on the left side of the window as another top-level folder. And permissions can include 'read', 'manage', and 'send as'." That jives with my experience with them as well.
Dave Bittner: Okay.
Maria Varmazis: I didn't know they didn't need a license. That is an interesting wrinkle. That's --
Dave Bittner: Me neither. We have one, we have editor@thecyberwire.com, you know, which is for people send their PR pitches and things.
Maria Varmazis: Yeah.
Dave Bittner: I'm on that mailbox, but it's not my primary mailbox. So, I guess that is categorized as a shared mailbox.
Joe Carrigan: So when people bug me about being on the podcast, should I just tell them to email editor@thecyberwire.com or n2k.com?
Dave Bittner: No.
Joe Carrigan: Okay.
Dave Bittner: Because I still have to read them [laughter].
Maria Varmazis: How can they bother you directly, Joe?
Dave Bittner: No, you tell them just to email joe@thingsjoehates.com [laughter].
Joe Carrigan: I don't know who owns that domain anymore, Dave.
Dave Bittner: Okay.
Joe Carrigan: I wish I still had it.
Dave Bittner: You let it pass?
Joe Carrigan: Well, yeah.
Dave Bittner: Unintentionally?
Joe Carrigan: It wasn't me, it was the domain. I had a friend managing the domain for me.
Dave Bittner: Joe.
Joe Carrigan: And yeah, thingsjoehates. I don't know if it's still doing this, but it was going to some kind of Japanese porn site and it was just awful [laughter].
Dave Bittner: It's on brand for your podcast.
Joe Carrigan: It is absolutely not on brand.
Maria Varmazis: Wow. Okay, I'm going to just leave that one hanging there.
Dave Bittner: Alright, Maria, save us here with the second half of this. Get us back on track.
Maria Varmazis: This email has more to it. The email goes on to say, "In some cases, you would assign a license to a shared mailbox, but why would you do this? And the answer is, an unlicensed shared mailbox has a quota of 50 gigs and does not allow for online archives. Space needs to be managed to ensure that you don't hit the quota, but it is free. And adding a license can add capacity to the mailbox quota and allow additional features, such as online archive, litigation hold, and that would be part of the license. When licensed, an ID and password can be assigned to the shared mailbox, and from a control standpoint, assigning an ID and a password and then sharing that information among multiple staff is definitely not a best practice." Amen to that, Robert [laughter].
Dave Bittner: Okay, yeah.
Maria Varmazis: So yeah, this was very in-depth info. Very, very much appreciate Robert sending this in, because this is definitely not my world. So, I appreciate this bit of color to the story. So thank you, Robert.
Dave Bittner: Yeah, important distinction there. So yeah, thanks for sending that in. And of course, we would love to hear from you. If there's something you'd like us to discuss on the show, you can email us. It's hackinghumans@n2k.com. Alright, let's jump into our stories here. Joe, you have the honors this week. What do you got for us?
Joe Carrigan: Dave, my story comes from the Cyber Press. And this is a story about a data breach that happened at Ericsson US, which is the United States subsidiary of the Swedish or Norwegian? What is it, Norwegian? No, Swedish telecommunications giant.
Dave Bittner: Yeah.
Joe Carrigan: They make phones and everything. They, remember the, no, that was Nokia I'm thinking.
Maria Varmazis: That was Nokia, yeah.
Joe Carrigan: Yeah, the indestructible phones. [ Maria sings the Nokia tone ] So, yeah, there's a lot of confusion here in the US because Ericsson is also the name of an eldercare company here in the US, the biggest eldercare company.
Dave Bittner: Oh, yeah, retirement homes.
Joe Carrigan: Right. So let's specify this is the phone manufacturer.
Dave Bittner: Right.
Joe Carrigan: They have suffered a data breach that exposed sensitive personal financial information from about 15,000 employees and customers. And the interesting wrinkle to this is the incident was not caused by compromising Ericsson, but rather by compromising a third-party service provider that they were doing business with. So, according to a regulatory filing submitted to the US authorities, the breach originated from a vishing attack.
Dave Bittner: Oh, your favorite word.
Maria Varmazis: Oh, yummy, yummy.
Joe Carrigan: My favorite thing about this is the article has parenthetically "voice fishing attack", which is a social engineering attack. We've all talked about this before.
Dave Bittner: Right.
Joe Carrigan: Somebody called up impersonating somebody else and got them to reveal some login credentials, which got them, got the attackers access. They were able to infiltrate the, this network, the vendor network, and access files. And the dates are between April 15th and April 22nd of 2025. So, the attack started almost a year ago, and they didn't detect anything until April 28th, which is actually, like, 11 days later, which is really below the average. The, you know, the average, I don't know, actually what I'm thinking of is old information, but it used to be that it would take you 180 days before you knew you had somebody in your network. Now, I think that's decreased, so here we are now down to 11 days, and this group of attackers has still exfiltrated about 15,000 records. Once the vendor discovered the breach, they did the right thing. They engaged an external cybersecurity company to, you know, do forensics and have incident response. But they also notified law enforcement. And here's where it gets a little bit iffy on things on how well things were, you know, how well things were conducted. Despite the fact that they found this breach back in April, they didn't notify Ericsson of it until November of 2025, November 10th.
Dave Bittner: Oh, you mean they didn't identify their mothership?
Joe Carrigan: Right.
Dave Bittner: Yeah, yeah.
Joe Carrigan: This is a third-party vendor. They're out there.
Dave Bittner: Oh, the vendor didn't identify.
Joe Carrigan: Right.
Dave Bittner: Okay, I'm with you now. Gotcha.
Joe Carrigan: The vendor said, Oh, we have a cyber incident, and they know about it within 11 days, and they start resolving it, but then it takes them to November to get around to going, Oh, by the way, Ericsson, we lost 15,000 of your employees' and customer records back in April.
Dave Bittner: Right. Six months ago.
Joe Carrigan: Right.
Dave Bittner: Okay.
Joe Carrigan: Right. Which would, I got to tell you, Dave and Maria, if I was doing business with a company that took this long to notify me that they had breached my data, I would be nonplussed. Let's put it that way.
Maria Varmazis: Nonplussed.
Dave Bittner: It would be a former business relationship.
Joe Carrigan: Yeah, I think that's kind of long. They don't, this article doesn't name who that third party is, but it says here that a detailed forensic investigation data review process continued for months to identify impacted individuals, you know, who was leaked. And the analysis finally concluded last month, in February of 2026. So the incident response took almost a year, which is fine.
Maria Varmazis: Yeah, it can take some serious time, yeah.
Joe Carrigan: That can take some time. But notification of affected people, affected entities rather, should be a lot faster than this.
Maria Varmazis: Well, if they only found out that the data was exfiltrated during the course of the investigation, how would they get it faster?
Joe Carrigan: Well, that's a good question. Maybe that's what they, it took them that long to figure out that they had lost that much data.
Maria Varmazis: Yeah, I mean, I think the bigger question that you're getting to is what is a reasonable timeframe? And that's a very complicated question.
Joe Carrigan: Right, right.
Maria Varmazis: Yeah.
Joe Carrigan: So the compromise details included full names, residential addresses and dates of birth, Social Security numbers, driver's license numbers.
Maria Varmazis: Aye, aye, aye. Which used to be the same.
Joe Carrigan: Right.
Maria Varmazis: Not that long ago.
Joe Carrigan: In some states, yeah.
Maria Varmazis: I know in my case it was.
Joe Carrigan: It was never the same in Maryland, at least not during my lifetime.
Maria Varmazis: Smart.
Dave Bittner: No, my student ID was my Social Security number.
Joe Carrigan: Yeah, mine too.
Maria Varmazis: Yeah, my driver's license was my Social Security number here in Massachusetts for an alarmingly long amount of time. Alarmingly long.
Joe Carrigan: We actually had to fill out our own student identifications by hand at my first university. And I think that my sloppy handwriting may have gotten me out of something. Because --
Maria Varmazis: Security through obscurity, right?
Dave Bittner: Like the draft [laughter].
Maria Varmazis: Oh, God.
Joe Carrigan: I made, I have, the way I used to draw eights, they would sometimes come out looking like sixes.
Dave Bittner: Okay.
Joe Carrigan: Let's say that. So it kind of made me look like I was two years older than I was --
Maria Varmazis: Uh-huh.
Joe Carrigan: -- when somebody who had the authority to ask for my ID asked for it, because there was something close to, it was a beer. There was a beer next to me. And this RA says, I need to see your ID. And I'm like, Why? She says, You better give it to me or there's going to be issues. And I'm like, Okay, fine. Here's my ID. I hand her my student ID, and she looks at it, and I see her counting in her head. Okay, and hands it back to me. You know, I was like --
Maria Varmazis: They took your student ID as ID? That's amazing.
Joe Carrigan: Yeah, that's all they could ask for. They couldn't ask for my driver's license because she was an RA with the university. She's not law enforcement.
Maria Varmazis: I mean, the liquor store can ask for a driver's license.
Dave Bittner: So this goes back a long way with you, Joe, doesn't it?
Maria Varmazis: Hey, dude, you remember all of this.
Joe Carrigan: I do.
Dave Bittner: You knew your rights.
Joe Carrigan: Well, yeah.
Maria Varmazis: You don't have to get hacking if you've been hacking the whole time. Yeah, wow.
Joe Carrigan: Yeah, that's right. Also, government issue identification documents, like, it looks like they lost the passports and photo IDs. Bank account information, like where your check might go, your credit card and debit card details.
Maria Varmazis: Oh, we're back to the story now. Okay.
Dave Bittner: Yeah.
Joe Carrigan: Oh, I'm sorry.
Maria Varmazis: I thought you were still talking about the RA and buying beer. Okay. Got it. Alright.
Dave Bittner: No, it's all the stuff Joe carried around with him in his wallet.
Joe Carrigan: That's right. That huge backpack.
Maria Varmazis: That's what's in there. All right.
Dave Bittner: Complete medical history. So, you know, if Joe gets hit by a bus.
Joe Carrigan: Yep.
Dave Bittner: There's no searching.
Joe Carrigan: That's right. My medical history is too big for a Life Alert bracelet.
Dave Bittner: Yeah, there you go.
Maria Varmazis: God bless it.
Joe Carrigan: So they lost some financial information as well, certain medical and health-related information. I don't know what they would have as medical and health-related information for employees beyond insurance information, but who knows?
Dave Bittner: Yeah.
Joe Carrigan: This information was accessed. It doesn't specifically say that it was breached, but if you, if it was accessed, you can assume that it was breached. There is, and here's the good news. There is currently no evidence indicating that the stolen data has been misused or publicly leaked.
Dave Bittner: Yeah.
Joe Carrigan: That is --
Maria Varmazis: Yeah.
Joe Carrigan: -- that is cold comfort.
Dave Bittner: Yes. Yeah. Nailed it.
Joe Carrigan: Yeah. Good news is that they have, Ericsson is providing identity theft protection services to, through a company called IDX.
Maria Varmazis: Yep. Yep. Know them well.
Joe Carrigan: But of course people have to enroll before June of this year.
Maria Varmazis: Can I be brutally honest about that? Just brutally, and this is nothing at IDX because this is not their fault.
Joe Carrigan: Right.
Maria Varmazis: I've been enrolled in so many of these identity protection services after a gajillion breaches that my data has been in. All I get is an email at this point and I ignore them all because I don't know what they want me to do with it. I'm just like, I don't really know what this is doing or who it's helping at this point.
Joe Carrigan: Yeah, I had the same thing when I had identity theft protection and there was some kind of incident. Somebody opened a checking account, I think we talked about it on the show.
Dave Bittner: We did, I remember that, yeah.
Joe Carrigan: And I went over to the branch and I said, What's going on here? Because it was a branch that had a local bank here. And I said, I got these things in the mail and I don't remember opening an account with you. And they were like, Oh yeah, that account was open and then immediately closed as a fraudulent account. I'm like, Okay. You didn't --
Dave Bittner: Thanks for letting me know.
Joe Carrigan: I didn't get a letter, all I got was checks in the mail.
Maria Varmazis: It feels like something you should tell me about, yeah.
Joe Carrigan: Should have just gone out and written a bunch of checks, right? I shouldn't have done that. By the way, I want to talk about something else. I'm going to go off tangent here. I was at the pharmacy, as I am wont to do, right? I was at the pharmacy, I'm walking out the other day, and I see a library card for the Carroll County Library on the ground.
Dave Bittner: Okay.
Joe Carrigan: And I get in the car, and I pick it up, and I hand it, show it to my wife, and I go, Hey, you want to go get some free books at the library that we won't have to return? And she looks at me and goes, You're a terrible person. Why would you do that? Why would you say that? I'm like, I'm not going to do it. I'm just going to say that it could be done. I mean, you've got to understand that this, you lose this, that's important. You could wind up paying somebody else's, for buying somebody else some books. I did actually turn it in at the library, though.
Maria Varmazis: Joe, did you know if you find a USB key in a parking lot, sometimes there's really yummy data on there, like payroll info.
Joe Carrigan: That's right.
Maria Varmazis: You should absolutely open that file.
Joe Carrigan: Yes.
Maria Varmazis: Find out what everybody makes.
Dave Bittner: Yeah. Yeah.
Joe Carrigan: Employment data.
Maria Varmazis: Yeah, go for it. Just definitely pick up that USB key. Just put it right into your computer.
Joe Carrigan: Somebody did some research, some A-B research on that, where they dropped USB keys and saw what was more effective when you wrote something on the outside of it, depending on what was written on the outside of it. I can't remember where that was, though. But I do remember reading that research. It was interesting.
Dave Bittner: It's in the parking lot of the Johns Hopkins Applied Physics Lab [laughter].
Maria Varmazis: Top secret information.
Dave Bittner: I remember that, too. You know, I had a funny little Social Security number security incident yesterday. I went to the eye doctor just for my, you know, annual exam. And, you know, you walk into the eye doctor and they hand you a form on a clipboard with all your information. And they say, Please check this to make sure everything's accurate. So I'm looking over the form and at the top it has my name, address, date of birth, Social Security number. And the Social Security number is all X'd out.
Joe Carrigan: Right.
Dave Bittner: I'm like, Excellent. Good, good, good job, folks.
Joe Carrigan: Yep.
Dave Bittner: So then I'm going down the list of things and it gets to my insurance and it has my primary insurance for my eye doctor, which is some kind of vision coverage, and it says account number. And it's my Social Security number [laughter]. It's like, so close.
Joe Carrigan: Right.
Dave Bittner: So close. Yeah. Right. Oh, well.
Joe Carrigan: Yeah. That's unfortunate. You need to talk to your eye insurance people.
Dave Bittner: You know, I could.
Joe Carrigan: Right.
Dave Bittner: But I'm not. Yeah. I mean --
Maria Varmazis: It's a much bigger problem than them, honestly. Yeah.
Dave Bittner: Yeah. Like, I've surrendered when it comes to that. I'm just like, because really, you know, okay, have at it.
Joe Carrigan: Right.
Dave Bittner: Anyway. Alright, we will have a link to that story in the show notes. I'll tell you what, I'm going to go next here, and I have two stories here because they are short. The first one certainly is short. The second one may or may not be, depending on how much we decide to dig into it. This is from the Federal Trade Commission. A little notice that they put out about some scams that they're seeing going around, and these are the "You've Won a Prize!" scam. So the idea is --
Joe Carrigan: Lucky me.
Dave Bittner: Right.
Maria Varmazis: Wow, really?
Dave Bittner: You get a notice that says you've won a new car, you've won a laptop, maybe some money.
Joe Carrigan: I hear that guy that used to be on "The Price is Right" with Bob Barker. A new car!
Maria Varmazis: Oh my gosh, yeah.
Dave Bittner: Yeah, Rod Roddy.
Joe Carrigan: Rod Roddy.
Maria Varmazis: That's right! Rod Roddy. That's definitely his name.
Dave Bittner: Yeah. Yeah. You know, I met Bob Barker once. My wife and I went to see a taping of "The Price is Right" on our honeymoon.
Joe Carrigan: Really?
Maria Varmazis: That's adorable.
Dave Bittner: Yeah. I got to shake his hand. It was pretty cool.
Joe Carrigan: That's awesome. Does he come out and meet everybody?
Dave Bittner: Just me.
Joe Carrigan: Just you?
Dave Bittner: Yeah.
Maria Varmazis: Nice.
Joe Carrigan: The Dave Bittner?
Dave Bittner: Right, that's right. Just me. No, but we have it on, we were actually sitting in the front row. We didn't get called up to be on the show, but we were sitting in the front row. So my wife has the aisle seat and I'm right next to her, and Bob Barker comes down the aisle. For whatever reason, on this particular show he was coming in through the aisle. And so they announced and everyone's on their feet and clapping and everything. I, and on the show, because we videotaped it, when it aired, you can see me hurling my recent bride out of the way so that I could shake Bob Barker's hand [laughter]. Just, like, pushing her out of the way. Thrusting out my hand and shaking Bob Barker's hand.
Joe Carrigan: This is going to be a great marriage, she's thinking.
Dave Bittner: Exactly. Exactly. To this day she reminds me at least once a year that I'm lucky to still have her after that.
Joe Carrigan: She'll remind you of that at least once a year for the, forever.
Maria Varmazis: If that episode's on YouTube, I need to see this because that would be very funny.
Dave Bittner: Yeah, no, I have it, I think I still have the VHS at home. So we'll have to try to find it. I don't remember the date. But anyway, so these "You've Won a Prize" things are scams. They, what happens is they say, Congratulations, this is a prize you've won for a laptop, car, whatever. All you have to do is pay the taxes. All you have to do is pay the shipping and handling fees or the processing fees.
Maria Varmazis: What a steal.
Dave Bittner: Yep, yep. And it's usually something like 50 bucks, not a whole lot, although taxes can be more. So if you win a car, they'll say, Oh, well, it's only, you know, $5,000 taxes on this brand-new Mercedes, and they get you. So the FTC says some of the things that we say here all the time. They say slow down. Scammers will say things like it's a limited time offer to try to pressure you into acting quickly. They say know that real prizes are free. Say anyone who tells you to pay to get your prize is a scammer. And also do some research. If you search online for the name of the contest along with words like "complaint", "review", or "scam", you can see what other people are saying.
Maria Varmazis: Yeah, that's usually what comes up in autocomplete nowadays. You'd search anything, the next word is always scam.
Dave Bittner: Yeah.
Maria Varmazis: It's amazing.
Dave Bittner: So, this is from the FTC, but I will say I did see someone else calling attention to this just within the last week or so, that evidently this is an active scam. And, you know, whoever's doing this has revved this one up. So just be on the lookout for it. So that is story number 1. Story number 2 is, well, I'm just going to get to it here. You guys will see why. So Meta --
Maria Varmazis: Uh-oh.
Dave Bittner: -- says --
Maria Varmazis: Uh-oh.
Joe Carrigan: One of my favorite companies to talk about on this show.
Maria Varmazis: Strap in.
Dave Bittner: Meta, you know them as the folks behind Facebook and Instagram. They say that they've removed 159 million scam ads in 2025, and they shut down nearly 11 million accounts tied to scam centers, presenting their effort as a major crackdown on online fraud. The company says most of these ads were caught automatically, and they're working with law enforcement around the world to disrupt large scam networks. This article, which comes from the folks over at Recorded Future say critics aren't entirely convinced.
Joe Carrigan: Right.
Maria Varmazis: Yeah.
Dave Bittner: They say Americans lost more than $10 billion to scams back in 2023, many of them originating on social media platforms. And of course I think we talked about it here. There was an investigation from Reuters that suggested that Meta projected about 10% of their ad revenue comes from ads linked to scams. Meta disputes that claim, but who are you going to believe?
Joe Carrigan: Reuters says that 10% of the revenue comes from scams?
Dave Bittner: Correct. Correct.
Maria Varmazis: That number seems conservative to me.
Joe Carrigan: Yeah.
Dave Bittner: It does.
Maria Varmazis: Based on nothing but gut feeling, I, just to be for the record.
Dave Bittner: Right. And so lawmakers are pushing for investigations and regulations requiring platforms to verify advertisers, to which I say, Halle-fricken-lujah. Hallelujah. Yeah, there you go.
Maria Varmazis: Halle-fricken-lujah, yeah. So, Meta claims it's fighting scams aggressively. My experience says otherwise.
Joe Carrigan: Yeah.
Dave Bittner: I don't know about the other two of you, but this led to just a giant eye roll for me and I'll believe it when I see it. Because everything I see on Facebook and, well, Facebook's really the only Meta platform I'm on, but everything I see says otherwise. So I don't know if it's a drop in the bucket or, you know, trying to bail out the ocean, but thanks, Meta [laughter]. I guess the bottom line here is that they just have no integrity for this, you know.
Joe Carrigan: Nothing is believable.
Dave Bittner: Right. Right. Yeah. They, I just don't feel like we can believe anything they say. They've demonstrated time and time again that they don't seem to be a good actor when it comes to following through on what they say they're going to do, or even ever doing the right thing.
Joe Carrigan: Yeah.
Dave Bittner: So just call me skeptical.
Joe Carrigan: Ol' Skeptical Dave.
Maria Varmazis: And yet we're all still on their platform. So.
Joe Carrigan: Yeah. I gave up social media for Lent, so I took it all off my phone. Except for the messenger app. I have to keep that on because that's how my family communicates. But I'm not doom scrolling Facebook or LinkedIn or anything else.
Dave Bittner: That's good.
Maria Varmazis: Doomscrolling LinkedIn [laughter]?
Joe Carrigan: Yeah. Every time I go to LinkedIn, it's, like, my favorite new term for LinkedIn is Facebook in a suit [laughter].
Maria Varmazis: That's so true. It's unhinged.
Joe Carrigan: It's garbage from front to back.
Maria Varmazis: It really is.
Joe Carrigan: Everybody's out there. Look, I'm a LinkedIn content creator. I had AI generate this post that you might find insightful. No, I don't.
Dave Bittner: Yeah.
Joe Carrigan: I don't.
Maria Varmazis: Yeah, LinkedIn Lunatic subreddit is one of my favorite places on the Internet. It's quite amazing.
Joe Carrigan: Oh, I will have to check that out.
Maria Varmazis: Yeah, it's basically the people who spend way too much time on LinkedIn trying to make themselves very, very influential. And I just, I really hate LinkedIn.
Dave Bittner: Yeah.
Maria Varmazis: I recognize its utility and I have an account and I use it, but I also hate it.
Joe Carrigan: I have an update on my thingsjoehates.com domain.
Dave Bittner: Yeah?
Joe Carrigan: It's mine again.
Dave Bittner: What? Wow, that was quick.
Maria Varmazis: In the course of this recording.
Joe Carrigan: Yeah, I just went to GoDaddy.com and said, Hey, is this still available? Because, you know, if the people who snatched it up snatched it up when it expired.
Dave Bittner: I see.
Joe Carrigan: And then they just, they were like, Okay, this guy's not contacting us. So we can't just blackmail him for his domain. So it is expired again, so I bought it.
Dave Bittner: Alright.
Joe Carrigan: So I have it.
Maria Varmazis: Wow.
Joe Carrigan: There's nothing going to it. They won't, people won't see the podcast if they go to it, but I have it.
Maria Varmazis: Breaking news on "Hacking Humans", this is what we do here. What we're known for is breaking news.
Dave Bittner: Oh my gosh. You know, somebody once created a "The Awesomeness That is Dave Bittner.com" I think.
Maria Varmazis: When did you buy that domain, Dave?
Dave Bittner: Well, the thing is, I didn't. It was some friends of mine who were razzing me, and yeah. When you brought it up, it was just a big picture of my smiling mug. Hilarious. It was a hilarious joke back in 2004, I think.
Maria Varmazis: Wow.
Joe Carrigan: Yeah.
Dave Bittner: Anyway. Alright. Tell you what. Let's take a quick break here to hear from our show sponsor. We will be right back after this message. [ Music ] And we are back. Maria, it is your turn. What do you got for us?
Maria Varmazis: I've got a short story for today. Just a, it's been a little while since we've checked in on the world of deepfakes. And it's not that there's necessarily anything new, new, new, aside from they continue and they're getting better all the time. But it's one of those vectors that just continues making everything worse, so I figured it's time for us to just take a little look at it. And the lens through which I wanted to just take a look at it was actually through Canada and Canada-US politics and political engagement right now. Not a big surprise that US-Canada relations right now are not fantastic. Yeah. And unfortunately, there have been a spate of deepfake videos, blanketing YouTube especially, that are a lot more subtle than you might expect that are fanning the flames. Sorry?
Joe Carrigan: It's Americans bad-mouthing their bacon. It's just ham.
Maria Varmazis: Well, no. See, that would be, to me, more obvious. But --
Dave Bittner: Okay.
Maria Varmazis: -- yeah.
Dave Bittner: A little more subtle than that?
Maria Varmazis: A little more subtle than that. Yeah, like, that's obvious bait, right? But if you have a half an hour long video of Warren Buffett sort of pontificating on the economic fallout of US-Canada relations souring. And again, it's him sitting in a chair talking about it in economic terms, and there's nothing really obviously malicious about what he's saying. You might go, Oh, and really give that video a listen, and not suspect that somewhere in that long video there's some stuff that's not quite correct, or exaggerated, but it's subtle.
Joe Carrigan: Is the entire video synthetic?
Maria Varmazis: The entire video is synthetic. It's a half an hour long deepfake of Warren Buffett. And this specifically comes via Toronto Star, this little investigation about that specific video. But what I thought was very interesting was that one video, and there's many like this, got 300,000 views on YouTube alone about, the Warren Buffett deepfakes, to be specific. And it is propaganda, it is disinformation, but because it got so many views, it also made money for the people who are spamming these deepfakes.
Dave Bittner: Right.
Maria Varmazis: So it is a self-perpetuating problem of it seems credible enough to have Warren Buffett not saying anything crazy or off-hint, like, it's not like him going out there being like, I'm going to bomb name a province. You know, nothing like that. It's just him pontificating in a way that sounds like you've just caught him in a quiet moment at Davos, right? And he's talking about how, you know, things are bad and going to get worse, and it all sounds plausible. So it's enough that you would sit there and listen and go, This is an expert giving some really good insight on current world events, and you might not have any sense that this is actually fake. And indeed, in this case it is entirely fake and the scammers have now made money off of your views because they're able to serve ads against it on YouTube. So, and then of course then the algorithm will serve you more and more and more videos just like this. So, AI slop deepfakes on YouTube not exactly brand new, and I'm sure now with the conflict in Iran we're going to see more along those lines as well. But to me, the idea that it's not just being used for disinformation but also for making money is like, Oh boy.
Joe Carrigan: Yeah, I have noticed that YouTube has just become a pile of garbage in terms of content.
Maria Varmazis: Yeah, it's a shame, isn't it.
Joe Carrigan: It is. And it is it used to be good and there's, you know, the channels I follow I still enjoy going to and seeing. But if I want to know about something, I can't find, I search it on YouTube, I can't find a not-obviously AI video.
Maria Varmazis: Yeah.
Joe Carrigan: You know, it's, and sometimes it takes me like a minute and a half to get into, I'm sorry for cutting you off, Maria, but sometimes it takes me like a minute and a half, and then the cadence of the voice is off a little bit or there's a mispronunciation. I'm like, This is just somebody's AI slop. And I've been consuming it for, like, a minute and a half. Down vote, close your tab.
Maria Varmazis: It feels like a betrayal. And it's also, for all of us who have hobbies, which all of us do.
Joe Carrigan: Right.
Maria Varmazis: YouTube was the goldmine of, you know, getting expert advice from people who are, you know, pro-hobbyists in your chosen field, or for home improvement, you know, how do you fix that squeaky door or whatever. I still remember there's this video, this one guy. His whole video is how to fix a really, like, a door that's out of alignment.
Joe Carrigan: Right.
Maria Varmazis: And it was the best video on YouTube I've ever seen. It has, like, 6 million views, and he tells you exactly how to fix it, and he shows you how to do it, and he tells you exactly, like, if it doesn't work, here's the other things to try, and I gave him five bucks, and it was a legit video. And I'm thinking, That's what YouTube is meant for. That is good internet.
Joe Carrigan: Right.
Maria Varmazis: And now those videos are very hard to find and all our hobbies are getting filled with slop videos of showing things that are just not possible or incorrect. It makes me really sad and mad, and makes me want to go to a cabin in the woods.
Joe Carrigan: Here's Maria David Thoreau.
Maria Varmazis: I don't live far from where he was at, but it's changed a lot since his day.
Joe Carrigan: I told my son that I told that story in this podcast, and he said I was 15 when I told it, not 12.
Maria Varmazis: Oh, still very clever, though.
Joe Carrigan: Yeah, he still couldn't come up. He picked that name. It was either Henry David Thoreau, or he thought another author that he couldn't remember which one it was, but he got it right, so he wins.
Maria Varmazis: Ralph Waldo Emerson.
Joe Carrigan: In fact, you know what, Maria, that's exactly who it was.
Maria Varmazis: Yeah, there you go.
Joe Carrigan: Ralph Waldo Emerson. Thank you.
Maria Varmazis: You're very welcome.
Joe Carrigan: You said the name and I'm like, yep. You know, I want, you know, here's the thing, Maria and Dave. I think there's a real opportunity out there for someone just to come in and eat YouTube's lunch.
Maria Varmazis: A YouTube disruptor.
Joe Carrigan: Right.
Maria Varmazis: Oh.
Joe Carrigan: We're going to put up content that is not AI. If you post AI-generated content to our website, your entire account is immediately deleted and banned.
Maria Varmazis: It's going to be the rise of curation, I think. YouTube used to be curated. In its early days, it was curated. And, yeah. Now the pure volume of it, it can't be. But I wonder if we're going to have to go back to that, because it's just gotten so bad.
Dave Bittner: I saw someone over the weekend mention, they referred to it as, and actually this is a YouTuber who does sort of home improvement kinds of things, not unlike what you were describing, Maria. And this person was lamenting exactly what we're talking about here. And his prediction was that we're headed for, what has to happen is, he called it an economy of authenticity.
Maria Varmazis: Yeah.
Dave Bittner: Where people are going to be so hungry for authentic creators that there will need to be a way to differentiate them from all the slop. And so I agree, it's a space ready for disruption. But it's just like Facebook. We're all locked in and it's hard for anybody to, I mean, you know, if we had a real fight against monopoly in this country, perhaps something could be done, but it doesn't seem to be happening these days.
Joe Carrigan: The problem with that argument is that there really is no barrier to entry to you standing up another competing service. Although I think what you're talking about more is the huge tech conglomerates, right? Like, there's no way for you to start up an Alphabet or a Meta.
Dave Bittner: Right.
Joe Carrigan: And those companies should be broken up. So yes.
Dave Bittner: Yeah, just the scale at which they operate makes it really hard for anyone else to break in.
Joe Carrigan: Yeah, I don't like that those companies are as big as they are.
Maria Varmazis: Yeah. So Maria, your story reminds me of something that crossed my desk earlier today. Which is that the folks at Grammarly are facing a class action lawsuit. Have you seen this? Yeah, I did. Because I'm in the journalist circle, a lot of people I know are joining that class action lawsuit. Yeah, because Grammarly apparently, and I'm going to summarize it very poorly, but, you know, it's AI so it's fair. Basically, they've got something where you can write in a famous journalistic voice, like a reporter's voice.
Dave Bittner: Right.
Maria Varmazis: So I guess they scraped a whole bunch of articles written by journalists and said, You want to write like this journalist? You can now do that.
Dave Bittner: Right.
Maria Varmazis: And a lot of writers are understandably like, You know, that's actually a skill that people spend years and years honing, developing your journalistic or writerly voice. That's not just something you're born with. That's a skill that you've got to work at. So it's not okay for someone to come in and say, We're just going to steal that, thank you very much.
Dave Bittner: And they didn't ask for permission.
Maria Varmazis: They did not ask. They did not ask. No.
Dave Bittner: Right. Yeah, and it's not just people who are alive, like you could say, you know, write, update this article in the voice of Carl Sagan.
Joe Carrigan: Right.
Dave Bittner: And it'll do it.
Joe Carrigan: Who's that guy that broadcast the Hindenburg?
Dave Bittner: Right.
Maria Varmazis: Not Carl Sagan.
Dave Bittner: Not Carl Sagan. Oh, the humanity! Oh, the humanity!
Maria Varmazis: Billions and billions. Anyway, I just realized also I'm probably going to drive somebody crazy that I didn't actually mention the name of the video about the sticking door. The guy's name is Donnie Doors, and the video is 17 years old. So I put a link in it because someone's going to need a link to how to fix a sticking door from Donnie Doors.
Dave Bittner: Did he retcon the name after he became popular for his door video, or?
Maria Varmazis: Maybe, but he has an e-book on his website and I gave him a few bucks because he actually helped me fix, like, three doors in my house that wouldn't latch properly. I was so grateful.
Dave Bittner: Okay.
Maria Varmazis: So yeah, I figure someone might need this link, so I'm putting it in the show notes.
Dave Bittner: Yeah, maybe I'll start calling myself Davey Cyber [laughter].
Joe Carrigan: I'm looking at his, I'm looking at this guy's YouTube page and he's got, like, how to tie knots on it. I'm going to, this is, thank you Maria, this is my new rabbit hole.
Maria Varmazis: I'm telling you, I did the same thing when I found his channel and I said, You know what, this is what the internet was really made for. This is good internet stuff. I miss this internet, when it was a lot of this kind of thing. And so it makes me happy when I still see stuff like this. This is real expertise and it was delivered very well and to the point, and the video is only seven and a half minutes long. And he goes through, like, every scenario of how to fix a damn door, which, if you don't do it yourself, you end up paying a lot of money for someone else to do it for you, so, you know.
Dave Bittner: It's true.
Maria Varmazis: Yeah.
Dave Bittner: You know, one of my regrets of never having been a Boy Scout is that I wish I knew more knots than I do. And I realize there's nothing stopping me from going out and learning more knots, but I feel as though it's one of those things that would have been much easier and would have stuck with me had I learned them when I was just a young lad.
Maria Varmazis: Well, Donnie Doors is here to help. It's never too late.
Dave Bittner: Alright we will have links to all of this stuff in our show notes. Joe, Maria, it is time to move on to our "Catch of the Day". [ Soundbite of reeling in fishing line ] [ Music ]
Joe Carrigan: Dave, our "Catch of the Day" comes from the Scambait subreddit. Apparently there's a discount Elon Musk out there.
Dave Bittner: Discount Elon Musk.
Joe Carrigan: He loves me within five minutes. It's a romance scam, it looks like.
Dave Bittner: Yeah.
Joe Carrigan: Who's going to be whom here?
Dave Bittner: Well, I think I will be the aspirational Mr. Musk.
Joe Carrigan: Yes.
Dave Bittner: Maria?
Maria Varmazis: Oh, boy. Alright.
Dave Bittner: You can be escalating frustration because that's what this is about. So I will begin. I'll say hello.
Maria Varmazis: Hello. How did you get this number?
Dave Bittner: Baby, you don't know me. Send me you pictures.
Maria Varmazis: Uh, no. I don't send pictures to people I don't know. I am not your baby.
Dave Bittner: Honey, you know I love you very much. Try to send me you pictures. You are the best in my life. Heart, heart, heart.
Joe Carrigan: This is just starting off, like, asking for pictures.
Dave Bittner: I mean, Elon doesn't have time to waste, Joe.
Maria Varmazis: No, that's why he's a very wealthy man.
Dave Bittner: He's a very busy man.
Maria Varmazis: Yeah. I don't know you. How can you love me in five minutes? Uh, you just met me. I'm not sending pictures to strange men. You must be crazy.
Dave Bittner: Honey, you need to know me, honey. I love you very much. Heart, heart, heart.
Maria Varmazis: Call me Jen.
Dave Bittner: I can do without you anymore, honey. I love you very much. Heart.
Maria Varmazis: Don't use pet names. I hate them. I don't love you. I don't know you.
Dave Bittner: Honey, why you don't me? I loved you. I love you. And I will love you forever.
Maria Varmazis: I just met you five minutes ago.
Dave Bittner: I will love you till my last breath, no matter what life brings before us.
Maria Varmazis: No, you don't. Your love is literally based on nothing. You don't even know me. How can you love me?
Dave Bittner: Honey, forget that one, honey. I love you very much. Loving you is the only thing that makes my life worth living.
Joe Carrigan: This is like the worst love bombing ever.
Maria Varmazis: It's, like, aggravating love bombing. Forget what? I don't love you. Call me Jen. I hate pet names.
Dave Bittner: Because I love you with all my heart.
Maria Varmazis: I hate pet names. I don't love you.
Dave Bittner: Honey, don't worry yourself anymore. Send me you pictures, honey.
Maria Varmazis: You haven't anything about yourself.
Dave Bittner: I love you very much [laughter].
Maria Varmazis: Capital N-O. No, stop asking for pictures. I don't send pictures to strangers.
Dave Bittner: Okay, my beautiful love.
Maria Varmazis: You will have to actually get to know me as a person. Call me Jen.
Dave Bittner: Okay, my beautiful love.
Joe Carrigan: You're going to call this woman anything but Jen.
Dave Bittner: Am busy for now, honey. Honey, you are my best love. Am feeling on you, honey. Love you very much.
Maria Varmazis: Call me Jen. Call me Jen. Call me Jen. Call me Jen.
Dave Bittner: Honey, you are the only person I love in my life, honey.
Maria Varmazis: Call me Jen.
Dave Bittner: I love you very much.
Maria Varmazis: What's my name?
Dave Bittner: Honey, you are my queen. Honey, I love you very much.
Maria Varmazis: What's my name? If you don't even know my name, how can you love me? I don't want to talk to you unless you can have a real conversation.
Dave Bittner: Honey, don't worry yourself anymore. I'm busy now, honey.
Maria Varmazis: Because just getting "I love you" for every single response is very, very boring. So, call me Jen. Do not call me honey. Why don't you listen?
Dave Bittner: Honey, I know you name honey, but you are my best.
Maria Varmazis: Call me Jen or I will stop talking to you. No more "honey". It is getting really aggravating. So, what is my name? Why won't you use it?
Dave Bittner: Honey, my name is Jennifer Lopez. I love you very much. You are the only person I love in my life. So send me you pictures now, honey. You are my honey.
Maria Varmazis: How do I parse this. So no, you need to have a real conversation with me first, Jennifer Lopez. And it still says it's from Elon Musk. This is confusing.
Joe Carrigan: Right.
Dave Bittner: Honey, you know I really love you very much. Heart, heart, heart.
Maria Varmazis: I doubt this very much, as it did not take much for you to fall in love, and thus it would not take much love for you to fall for literally anything with two legs and a hole slash wiener.
Dave Bittner: Wow, Maria, geez.
Maria Varmazis: Call me Jen!
Dave Bittner: Oh, sorry, Jen. No, I'm Jen. Wait, oh, we're both Jen. Oh, this is so confusing. Alright, let's try to cut to the chase here.
Maria Varmazis: This is a really long one.
Dave Bittner: It just goes on and on and on. No pictures for you, honey, you my heart, so let her honey.
Maria Varmazis: My name is also Jennifer.
Dave Bittner: Alright, I'll tell you what, let's leave it there.
Maria Varmazis: I cannot believe how long this goes on for.
Dave Bittner: I mean, this goes on. I'm interested in just how much patience the recipient has here, who's clearly playing along.
Joe Carrigan: Yeah, I'm not sure there's a person on the end of this.
Maria Varmazis: Yeah, I was going to say, you're just wasting your time with a bot. I wouldn't even bother.
Dave Bittner: You think?
Joe Carrigan: This fails the Turing Test for me.
Dave Bittner: Yeah, yeah, could be, could be. Alright, well. Maria, thank you, honey.
Maria Varmazis: Call me Jen!
Dave Bittner: Alright. Well, we will have a link to that in our show notes. And of course, if there's something you'd like us to consider for the "Catch of the Day", please do send it to us. It's HackingHumans@N2K.com. [ Music ] And that is our show brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly-changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm not Jen. I'm Maria Varmazis.
Dave Bittner: Honey. Thanks for listening, honey. [ Music ]
