Hearing Is no longer believing.

Dave Bittner: Hello everyone and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.

 

Joe Carrigan: Hi, Dave.

 

Dave Bittner: And our N2K colleague from the "T-Minus Space-Cyber" podcast, Maria Varmazis. Maria?

 

Maria Varmazis: Hello, Dave. And hello, Joe.

 

Dave Bittner: And our very special guest, Kieran Human, a lead cybersecurity engineer at Threat Locker. Kieran, welcome.

 

Kieran Human: Thanks for having me.

 

Dave Bittner: We've got some good stories to share this week. We don't have any follow-up this week, so let's take a quick break here to hear from our sponsors, which happens to be Threat Locker. When we come back, we'll dive into our stories. Stay tuned. [ Music ] All right, we are back and I am going to kick things off for us here today. I've got a story. This comes from the FBI. And this is an interesting little escalation of social engineering. This is from the folks over at Bleeping Computer whose story we're referencing. They are saying that the Silent Ransom Group, also known as SRG, they're targeting U.S. law firms, but beyond just regular social engineering and trying to break into people's accounts, they're using in-person data theft tactics. Says they're using social engineering, pretending to be internal IT support through phone calls and phishing emails. So, nothing unusual there. But if those remote tech -- if those remote access attempts fail, they might actually send someone to the office, to the victim's office, to put a malicious USB drive or plug an external hard drive into their computers.

 

Maria Varmazis: That's some high touch scamming. Kind of quaint.

 

Dave Bittner: Yes. So, before we dig into some of the details, what do we all make of this? Kieran, you're -- you're new with us here. What's -- what's your take on this?

 

Kieran Human: I mean, I'm quite surprised that they're sending the in-person people. That's much higher risk, especially against the government. But I mean, it's a classic -- classic thing, trying to get someone to plug in that malicious USB. I've done many, many presentations with just how much damage you can do by quickly plugging in a single USB.

 

Dave Bittner: Yes, you know, I -- this reminds me that, how do I say this? I have done this.

 

Maria Varmazis: You -- you have gone to an office and --

 

Dave Bittner: No, no.

 

Maria Varmazis: -- posed as IT.

 

Dave Bittner: No, no, even worse, even worse. I've let the person in.

 

Joe Carrigan: Oh, no.

 

Maria Varmazis: Dave. All right.

 

Dave Bittner: Yes.

 

Maria Varmazis: You know, I click links, but come on.

 

Dave Bittner: Well, so here, just a couple weeks ago, I -- I was here at our -- at our studio space, which is a -- a share -- it's a -- we -- we're a -- sort of behind the scenes here. CyberWire is part of an incubator space called Data Drive. And so, we have some space here, but it's also shared with a bunch of other different startup organizations and that sort of thing. So, I was here one morning all by myself, which is not unusual, especially in this day of remote work. And the doorbell rings and I go and I answer the door and there's a, you know, perfectly normal-looking gentleman there and he says, "Hi." He says, "I'm here to fix the mini split air conditioner in the server room." And I sort of gave him a once over and he had tools on his belt and, you know, those little --

 

Joe Carrigan: Did he have a ladder?

 

Dave Bittner: He did not have a ladder.

 

Maria Varmazis: A little hard hat.

 

Dave Bittner: But he did have --

 

Maria Varmazis: Clipboard.

 

Dave Bittner: -- you know those -- you know those little pressure tool, little pressure meters that HVAC guys have?

 

Joe Carrigan: Sure.

 

Dave Bittner: Yes, he had a set of those.

 

Joe Carrigan: Okay.

 

Dave Bittner: So. I was like, "Come on in." So, not only did I lead him to the server room, I unlocked the server room door for him, let him in.

 

Maria Varmazis: So nice of you.

 

Dave Bittner: Yes. Just, you know. Now, moments after I did this, the office manager showed up and she was happy to see that I had let this person in and into the room and all that kind of thing. So, disaster averted.

 

Joe Carrigan: He was supposed to be there then.

 

Dave Bittner: He was supposed to be there. It was a planned appointment. I didn't know anything about it. But my point is how easily any of us, maybe this is just me. I'm very trusting.

 

Joe Carrigan: Right.

 

Dave Bittner: And I also don't want to be -- I don't want to confront this person. I don't want to be adversarial. It's just not in my nature. So, I basically let this guy in and handed him the keys to the digital kingdom.

 

Maria Varmazis: Yes.

 

Joe Carrigan: I mean it's --

 

Maria Varmazis: Pentesters love you.

 

Joe Carrigan: Yes.

 

Dave Bittner: Yes.

 

Joe Carrigan: It's easy to do. I mean, the -- the reason I ask if he had a ladder. And Dave, I think you've heard this before because you -- you laughed at that. But you can get anywhere if you just carry a ladder around.

 

Dave Bittner: Yes. It's better than a clipboard.

 

Joe Carrigan: Right.

 

Dave Bittner: Right?

 

Maria Varmazis: A clipboard will get you in just about anywhere though.

 

Dave Bittner: Right. But a ladder, people will actually hold the door for you.

 

Joe Carrigan: Right?

 

Maria Varmazis: Oh, yes. So nice.

 

Dave Bittner: Yes.

 

Joe Carrigan: I've seen videos of people getting into movie theaters with ladders. Just walk into the theater and like, as soon as they do that, the guy taking tickets just opens the little velvety ropes.

 

Dave Bittner: Yes.

 

Joe Carrigan: And says, "Come on in, this way."

 

Dave Bittner: Yes.

 

Joe Carrigan: I don't know where you're going.

 

Maria Varmazis: We normally give people pro tips on how to do this kind of stuff, but I feel like --

 

Joe Carrigan: Right.

 

Maria Varmazis: All right, I'm writing that one down.

 

Dave Bittner: Do you just set the ladder outside the theater, then you just go in and --

 

Joe Carrigan: Yes, I don't know, I think you'd have to hide the ladder or else they might know something's up.

 

Dave Bittner: Right, right.

 

Joe Carrigan: The cost of a movie theater ticket is a lot less than the cost of a ladder. So.

 

Dave Bittner: That's true.

 

Joe Carrigan: Yes.

 

Dave Bittner: Yes, that's true. A couple other details here. This Silent Ransom Group, they also go by the name Luna Moth or Chatty Spider, depending on, you know, which defensive organization you ask.

 

Joe Carrigan: You ever seen a luna moth?

 

Dave Bittner: Yes, I have.

 

Joe Carrigan: They're huge.

 

Dave Bittner: They are, yes. They're quite beautiful.

 

Joe Carrigan: Yes.

 

Dave Bittner: They -- we have them around here. This group has been active since 2022, and they seem to focus on legal and financial organizations. And the FBI again sent out this notification, that they're targeting law firms through callback, phishing and social engineering attacks. So, I don't know, I mean, what -- what's the best way to protect against something like this and --

 

Joe Carrigan: This --

 

Dave Bittner: -- take your own advice because apparently, I'm no good at it.

 

Joe Carrigan: -- this is the same -- same thing that it always is similar to -- I think my story touches on this a little bit today. But it's process. It's -- it's process and policy.

 

Maria Varmazis: And training.

 

Joe Carrigan: Yes, and training. It's the people side of the equation. So, this is definitely a social engineering hack. So, you come in and you say, "Hey, I'm here from the company I'm here -- you know, the -- your -- your IT service provider. I'm here to take care of the computers." A lot of these law firms are going to have what's called an MSP, which is a Managed Service Provider.

 

Dave Bittner: Yes.

 

Joe Carrigan: I used to work at one of these before they were called MSPs, back when we were just called Value Added Resellers.

 

Dave Bittner: Right.

 

Joe Carrigan: And we had service contracts with people, and they would call us and we would have somebody there within four hours, or if they paid more, we'd have somebody there within two hours. Or if they paid enough, we just have somebody that would show up as soon as we got the call.

 

Dave Bittner: Right.

 

Joe Carrigan: But you know, now -- now everybody has MSPs, and they are not unexpected that you, you know, they'll show up and it could be a different guy every single time because MSPs can be larger companies.

 

Dave Bittner: Yes, yes. What do you make of this, Kieran? What -- what's an appropriate level of resistance to give someone who comes knocking on your door?

 

Kieran Human: I mean, one thing is at Threat Locker, we do have storage control to stop those pesky USB devices. But in general, a lot of the time, it's just verifying who they are. It doesn't matter. I know you said you don't like confrontation, but, you know, when it comes to security, like here at Threat Locker, we have -- everyone has a badge, and you have to wear it at all times, visible. Even if you're a visitor, you get a visitor badge. You have to check in with security to get that badge. So, at least for us, if someone comes knocking, we bring them over to security, and they can go through those necessary checks. And I do think that is very, very important.

 

Joe Carrigan: That's a great idea.

 

Dave Bittner: Yes. So, outsource the confrontation.

 

Joe Carrigan: Right?

 

Kieran Human: Yes.

 

Maria Varmazis: Yes, yes. We had something -- we had a lot of similar training at -- in my Rapid7 days ago. And there -- we went through all these different processes for, you know, what happens if you forget your badge at home that day or lose it when you're out to lunch. And I remember once, I actually had to deal with that on the receiving end, and I had to deal with that confrontation. There was an elevator in the building that we were in at the time that was kind of only known to us employees as sort of like the other way to get in, not the main office way to get in. And so, a lot of us on our lunch break left to go that way. And there was someone in the hall to enter our office on the correct floor who was like, "I lost my badge. Can you just let -- let me in?" And I kept telling him, like, "You got to go." Like, reminded him of the process that we'd been trained on. And he got really angry at me. And I remember thinking at the time, like, people are trying to walk into our office all the time. Like, pentesters want to own a security company. Like, that's like --

 

Joe Carrigan: Right.

 

Dave Bittner: Right, right.

 

Maria Varmazis: -- they want to do it so badly. But this guy got, like, red in the face. He's like, "I work here. You've seen me a million times." I'm like, "That might be true, but you still go to the front desk." And this guy was, like, twice my height because I'm 5'1", so everybody's taller than me. So, it's like, really, he was trying to, like, impose himself on me and get really up on my face. And I, "Listen, just -- just do the thing." So, I was -- I really hope that guy was actually a pentester.

 

Dave Bittner: Right.

 

Joe Carrigan: Yes.

 

Maria Varmazis: I really hope. But it was very uncomfortable. Like, I -- I'm ten years later, I still remember how uncomfortable that made me, dealing with that confrontation of this guy getting so mad about it.

 

Joe Carrigan: Yes. Did you ever find out if he was an actual employee?

 

Maria Varmazis: I -- you know what? We were -- we -- I don't know how much I want to disclose on this. He -- he was supposedly with our sales team, and sales guys come and go.

 

Joe Carrigan: Yes.

 

Maria Varmazis: So, to be honest, especially like -- I couldn't keep track of all the sales guys that we had in the -- in the bullpen.

 

Dave Bittner: Right.

 

Maria Varmazis: So, he might have been. But he had definitely, if he was a real employee, he had been trained on what to do. And he was getting real mad at me, so too bad.

 

Joe Carrigan: Yes. I'd have reported him to security just out of spite, you know?

 

Maria Varmazis: Oh, I did. I did. Don't -- don't you worry. I was like, "By the way, someone was trying to get in without a badge in the back elevator. And that's not good."

 

Joe Carrigan: Because I've -- I've told the story about when I had -- you know, we were in, like, this little vending machine room, and a -- a woman I knew was in there, and somebody else walked in, and she looked at him and she said, "Hey, where's your badge?" And he goes -- he grabs his chest and he goes, "Oh, I left it at my desk." And she goes, "Let's go walk back and get it."

 

Maria Varmazis: Correct.

 

Joe Carrigan: And she walked out with him, right?

 

Maria Varmazis: Together.

 

Joe Carrigan: Right, together. And -- and she's like, "I'm very sorry." And his response was, "You did exactly what was right."

 

Maria Varmazis: That's right.

 

Joe Carrigan: And that is the proper response to that challenge. And if somebody -- if somebody doesn't respond that way, they're either a pentester, or they need to be --

 

Maria Varmazis: Reeducated.

 

Joe Carrigan: -- reeducated. I wasn't going to say that. But retrained, possibly --

 

Maria Varmazis: Yes.

 

Joe Carrigan: -- disciplined by HR, I don't know. You know, because you cannot do that. The security of an organization like that has to be, you know, it -- it has to be the first concern of everybody's position. And where I work now, we have to have badges on all the time. And we are told often that it's everybody's responsibility. If you see someone without a badge, ask for the badge.

 

Maria Varmazis: Yes.

 

Dave Bittner: Yes.

 

Maria Varmazis: Yes.

 

Dave Bittner: I got in trouble once in an elevator for not -- having the wrong badge. I was -- I was actually, I was working at the Newseum down in --

 

Joe Carrigan: This is a good story.

 

Dave Bittner: -- D.C. and the -- the chief engineer asked me to go up into where -- there's a part of the facility called Master Control, which is in a broadcast facility, is where all the machines are. And he asked me to go up to Master Control to take care of something. I didn't have normal access to Master Control, so he handed me his badge. Because you needed a badge in the elevators. I went to the elevator, badged in as him, and like seconds later, the elevator stops and they're like, "Who are you?"

 

Maria Varmazis: Oh.

 

Dave Bittner: I was like, "Dave, why?" They're like, "You are not Dennis."

 

Maria Varmazis: You can't do that, Dave.

 

Dave Bittner: Yes, right. They're like, "You are not Dennis." I'm like, "No." They said, "Where's Dennis?" "He gave me his badge." "All right, you and Dennis need to come down here right now." And, you know --

 

Maria Varmazis: They stopped the elevator.

 

Dave Bittner: Well, I didn't know that the elevator had video cameras built in.

 

Joe Carrigan: Yes.

 

Dave Bittner: And whenever you badged yourself on the elevator, down at security, the picture came up of who it was supposed to be, and it got tagged for me not being that person. So, me and Dennis both got a good talking to that day. We both learned a valuable lesson that day.

 

Joe Carrigan: Yes.

 

Dave Bittner: About sharing badges.

 

Joe Carrigan: On a very special episode of "Dave and Dennis."

 

Dave Bittner: Yes. Dennis -- Dennis was one of those, God rest his soul. He's no longer with us, but Dennis was one of those folks who just didn't really care about the rules, you know? Like, he was like, you know, they're talking to -- he's like, "Okay, go ahead, fire me. Do you want your show to go on the air tonight? All right, are we done here? Okay, fine." You know, that kind -- that kind of thing. I was much meeker and did not follow through. All right, we will have a link to this story in the Show Notes, but in the meantime, particularly, if you're a law firm --

 

Joe Carrigan: Yes. Keep your eyes out.

 

Dave Bittner: Right, right. All right, that's what I've got this week. Joe, what do you have for us?

 

Joe Carrigan: Dave, my story comes from a listener named Michael who lives in the continent, slash, country of Australia.

 

Dave Bittner: Oh.

 

Joe Carrigan: We have a lot of listeners down under.

 

Dave Bittner: We do?

 

Joe Carrigan: Yes. And he actually wrote this as a letter, and he says, I'm going to start with what -- what I want to start with here. He says, "Dave, Joe and Maria, first, love the podcast 'Hacking Humans, as well as the 'Daily Podcast,'" Dave.

 

Maria Varmazis: Oh, yes.

 

Joe Carrigan: So, he listens to you every day.

 

Dave Bittner: Very nice.

 

Maria Varmazis: May I recommend my -- the Sunday show, "T-Minus Space Cyber Briefing." I just -- maybe add that to your rotation.

 

Joe Carrigan: And here's my favorite part. "My daughter is obsessed with the chickens," and apparently, they have 15 in a small residential area, "so really love hearing Joe's updates and telling her about them." Well, I'm glad that your daughter likes hearing about the chickens, which is awesome. Anyway, he got called -- called upon to help fix a problem that was happening at his daughter's employer, which is a dental surgery outfit. And he is actually a patient there as well. So, he gets an email from the dental surgeon, and it is actually from their email address, and it is saying that this is a -- a document. We need you to look at this document. But the document is too big to sign -- to send. So, and also, you need to read this document on a desktop or a laptop. It will not be readable on mobile. Again.

 

Maria Varmazis: What year is it? Okay.

 

Dave Bittner: Right, right. Like flags -- red flags going up.

 

Joe Carrigan: Yes.

 

Maria Varmazis: Make sure to install Adobe Flash.

 

Dave Bittner: Right.

 

Maria Varmazis: Like, wait a second.

 

Joe Carrigan: Michael does in fact work in security. So, his -- he says his Spidey senses were triggered. So, he sought some clarification from his daughter and after a while she responded that the dental surgery's computer had been hacked somehow. He assumed that it did not have like, multi-factor authentication enabled, or something. And it got caught. But what had happened was they had received an email from another dental surgery, which is common practice, sharing a link to a document. The email address again legitimate. And this is a normal request to share patient details as they're not allowed to send these documents.

 

Dave Bittner: Right, right.

 

Joe Carrigan: Right. So, you can't send them an email. Cause that's PHI. I don't know what they call it in Australia. But you know, you can't just email patient health records around.

 

Dave Bittner: No, but you can send a fax.

 

Joe Carrigan: Right.

 

Dave Bittner: We're back in 1987.

 

Joe Carrigan: Right.

 

Maria Varmazis: Or in Japan.

 

Joe Carrigan: Yes.

 

Maria Varmazis: Japan also has faxes. So, what happened when -- when Michael's daughter's practice received the -- the email is the receptionist clicked on the link, it opened a blank screen and that was all it did. So, they thought it was just an error, and they thought no more about it. They were done. But the next day, about 2,000 of their patients received an email just like the one Michael had received with a link to a document going to the same URL. After the investigation, it appears the -- when the original link was clicked, it caused a silent install of something called Screen Connect, which is one of these remote access tools.

 

Dave Bittner: Yes.

 

Joe Carrigan: It's a legitimate software. So, it -- it didn't fire any alerts, no virus things went off. It was a silent install, so nobody noticed anything. Then here's what's really interesting. At about 7:30 in the morning, before anyone came into the office, and he notes that they had a security camera on which showed the computer. A fake Windows Update screen was displayed on the machine's monitor. And behind the scenes, the attackers were extracting the contacts from the mail system. The contacts, all the -- all the patients email addresses from the mail system.

 

Dave Bittner: Wow.

 

Joe Carrigan: Creating a mail merge with Excel. And they found the file, the Excel file, that had -- that was created around the same time. And then sending the emails with the malicious link to groups of about 200 people at a time. The clients who received the email and clicked the link were -- were prompted for login credentials for their email. And this, he -- he notes, that's anecdotal. In other words, they called a couple of clients and said "Hey, you didn't click the link, did you?" And they were like "Yes, we clicked the link, but it asked us for our email credentials." They -- they could also have -- Michael notes that it could also install the Screen Connect as well. So, this is -- looks like it's a -- a manual spreading of -- of this backdoor or this remote administration software.

 

Maria Varmazis: Yes. Because groups of 200 would mean that they wouldn't get hit with those like -- the spam rules. Right?

 

Joe Carrigan: Right.

 

Maria Varmazis: So, essentially you can still -- it's still a person to person email as opposed to a mass email. So, wow, but that's so much work.

 

Joe Carrigan: Yes, it is. What I found so interesting about the attack Michael writes is they used a legitimate software, and -- and process to first bypass any MFA and gain access and then create the -- the spam mail to try and trick others. True living off the land. Which is, yes, they're -- they're doing that. I mean they're not technically living off the land, they're actually downloading and selling software. But it's not malicious software.

 

Maria Varmazis: Yes, yes.

 

Joe Carrigan: And because it's a -- because it's a recognized software again, not going to trigger an a -- an AV -- an antivirus check. They have for now disabled the services and removed the files for Screen Connect, changed passwords and will increase user access control in Windows to ensure that any software install requires approval, which is a great idea. And he says I'm not sure how the average person can avoid this other than extreme paranoia. Well, that's what I advocate. So, it's -- it's interesting that, you know, he points this out, but that that's exactly right. If you're on the receiving end as a patient from one of these -- one of these compromised companies, what do you do? I mean if it's going to do a silent install on your system -- I don't, you know, I'm not -- I've lost my Windows administration capabilities years ago. So, I don't know if that --

 

Maria Varmazis: Someone took the keys away.

 

Dave Bittner: Completely atrophied.

 

Joe Carrigan: Right, completely atrophied. So, I don't know if I could stop this from happening to me if someone sent a, you know, some kind of drive by download like this.

 

Dave Bittner: Well, let's back up and -- and I want to get Kieran's take on this sort of from the outset. I mean, what do you suppose was going on with this original, I'm using air quotes here, "empty email" that started all of this?

 

Kieran Human: Yes. So, I mean we've seen attacks like these before. I mean I've even made some example ones where I look on the computer if you have 7-Zip. If not, download it and [inaudible 00:20:37] away your computer. So, it's likely just going to be when you try and open it, it runs that executable. One thing I do want to note is as you'd mentioned, I think that they're limiting the installations. You want to take that a little further and make sure to do allow listing. Small -- small difference it seems like, but actually huge capability difference.

 

Joe Carrigan: Like whitelisting, you're saying?

 

Kieran Human: Yes, whitelisting.

 

Maria Varmazis: Yes.

 

Joe Carrigan: Yes.

 

Maria Varmazis: Yes, whitelisting, yes.

 

Kieran Human: Yes, we ran actually a webinar, myself and Chief Product Officer Rob from Threat Locker, earlier last year and I had five ransomware samples. I was a user, not an admin, couldn't install anything. All five ran. So, it's super, super important to do allow listing, whitelisting, whatever you call it, and then don't be clicking on links.

 

Maria Varmazis: Dang it.

 

Dave Bittner: Maria, you -- you're listening?

 

Kieran Human: That's why you can never really -- no matter how much training you have, users are going to do what users do.

 

Joe Carrigan: Users are going to do user stuff.

 

Maria Varmazis: Users are going to user.

 

Dave Bittner: Users going to use.

 

Joe Carrigan: Yes.

 

Kieran Human: So, layer eight issues will happen.

 

Joe Carrigan: Right.

 

Kieran Human: So, you want to make sure to put those controls in place so that whatever they do, do, we control.

 

Dave Bittner: What do we suppose they're ultimately after here? I mean, it seems like the part that we have visibility into was about expanding their reach.

 

Joe Carrigan: Right.

 

Dave Bittner: But there's nothing in this story about any sort of monetary theft or anything like that. Do -- Kieran, do you think they're just biding their time?

 

Kieran Human: Yes, I would think that eventually they would try and pivot into extracting money. One thing we see common with a business email compromise, something like that, is where they will then reach out to a vendor or someone trying to make a payment and say, "Hey, like our payment information has changed. Send it to this bank instead." So, I could really see that being one of the targets. Or also, depending on what information that vendor has, it could be more sensitive information like your bank account information, your address, email, any sort of government ID that you provided could be included in your information.

 

Dave Bittner: Yes, I guess. And -- and we've -- medical information is more valuable than just run of the mill personal information, right?

 

Joe Carrigan: It is. It's like seven times the value on the black market.

 

Kieran Human: And they can get really, really, really targeted phishing attacks. Instead of, "Hey, so and so, you know, here's something." It's they give you a call a day before your dentist appointment that, you know, they now have access to know, "Hey, we've changed to this or you need to update your information" or whatever it may be. They get that really, really specific data on you.

 

Dave Bittner: Right, right.

 

Maria Varmazis: Yes. And nobody's really expecting a -- a scam or a fish from their dentist's office. That just feels --

 

Joe Carrigan: Yes.

 

Maria Varmazis: -- wow --

 

Dave Bittner: Right.

 

Maria Varmazis: -- because it's like nobody likes going to begin with, so --

 

Dave Bittner: So, there's enough pain as it is.

 

Maria Varmazis: Yes. Dang.

 

Joe Carrigan: Now, I have to go pay them in advance to hurt me?

 

Dave Bittner: Yes.

 

Joe Carrigan: Make my gums bleed.

 

Dave Bittner: I happen to be friends with my dentist. And, you know, I've known him for probably, I don't know, 20, 30 years now. And I was recently at his office and he has this really cool like X-ray scanning thing that does this panoramic view of your entire jaw. And the printout of it or the view of it on the computer is in 3D. So, you can move it all around, but it looks kind of like the creature from "Alien."

 

Joe Carrigan: You look like a xenomorph.

 

Dave Bittner: Yes, you look like a xenomorph with all -- you're like, "Oh, that's, oh, that's scary." But on this --

 

Joe Carrigan: You got a little mouth inside.

 

Dave Bittner: Right? Well --

 

Maria Varmazis: Put little Dave in there.

 

Dave Bittner: -- some of us -- some of us do. Yes.

 

Joe Carrigan: Right.

 

Dave Bittner: But on the machine that did this was a little sticky note with the username, and password.

 

Joe Carrigan: I'm going to irradiate a lot of people.

 

Dave Bittner: I said -- I said, "Doc, I know, like, you know, it's probably okay, but just humor me."

 

Joe Carrigan: Right? Please don't have this sitting on there when I back.

 

Dave Bittner: Yes, I can't -- I can't let it go without just saying something. And when I'm done saying it, do whatever -- do what you will, but just -- you have been warned. So.

 

Joe Carrigan: Finally, Michael says he loves the podcast and he loves the chickens. So, Michael, I'm happy to talk about my chickens whenever I can, but not this week. Not this week. Except for the fact that some of our listeners just love hearing about the chickens.

 

Dave Bittner: Kieran, since you're new to the show, you're probably scratching your head and wondering what the heck we're talking about when it comes to chickens. Joe actually raises chickens, on his vast, palatial estate.

 

Joe Carrigan: Yes.

 

Dave Bittner: And so, we've been sort of monitoring his journey from his first starting with his chickens, to where he is today. And it's about 50/50. About half of our listeners really enjoy hearing the chicken updates. And then the other half we get letters from saying, "Please get to the show." So.

 

Maria Varmazis: How do the hosts feel about it?

 

Dave Bittner: Oh, I like the chickens.

 

Joe Carrigan: I like the chicken stories.

 

Dave Bittner: I like -- I like the chicken stories. I'm just, you know, someday maybe my friend Joe will bring me some eggs.

 

Joe Carrigan: Dave, you know what? I will bring you some eggs next week. Sorry about that, Dave.

 

Maria Varmazis: That's bribery.

 

Dave Bittner: I just [inaudible 00:25:53] him into it. Right?

 

Joe Carrigan: I brought --

 

Maria Varmazis: Bribery.

 

Joe Carrigan: -- I brought some eggs in for one of my coworkers today and she was very excited.

 

Dave Bittner: There you go. Some fresh eggs.

 

Joe Carrigan: Yes.

 

Dave Bittner: All right, we will have a link to that story in the Show Notes. Let's take a quick break here to hear from our show sponsor. We'll be right back after this message. And we are back. Maria, you're up. What you got for us this week?

 

Maria Varmazis: I've got a short story today. I feel like a lot of my segments are what is AI doing now? And how's it making scams a lot worse.

 

Joe Carrigan: What's that crazy AI up to?

 

Maria Varmazis: Yes, I mean, it's -- it's -- I try not to have it be every week. Here's a new thing that people are using AI to do terrible things with. But, here, that's what my story is this week. Because I've been seeing this specific story making it all in -- making the rounds in very mainstream media. And that always catches my attention when that happens. Mainly because it's nice to see these stories making their way in, you know, in the non-infosec spheres. It's good for awareness and it's good for people to understand what's going on. So, some of our listeners may be like, I knew about this one, but listen, your family might not have. So, please tell them about this. Okay?

 

Joe Carrigan: Right.

 

Maria Varmazis: So, we've talked a bunch of times about how voice cloning with AI is trivial. Like, can be done in seconds. Heaven knows, all of us on a podcast, there's a lot of material for AI to work with. And I've had to have this conversation with my loved ones many times about what we need to do about that. So, there's a -- there's a scam that affected a woman in San Francisco where she lost $5,400 to scammers, because of an AI voice cloning scam. This one specifically said the scammer used artificial intelligence to mimic the voice of her 37-year-old daughter. And I'm just going to read the quote from her. She said, "It was my daughter's voice having an absolute panic attack, scared, telling me, I love you, mom, I'm so sorry, I'm so scared. And then they, the scammers, just cut her off." So, essentially the scammers were posing as kidnappers and the whole scam call was basically saying, "Your daughter's been kidnapped and you know, if you want her to be alive, you got to pay us this ransom money." Now, on the outset, I'm sure a lot of us might be very skeptical going, "Who would fall for something like that?" But if you hear a voice that sounds really realistic, this was actually -- I'm very glad I found this story because it prompted a really good conversation with my family because I sent it around on the group chat. It's -- it's one of those things like if -- even if you think you know how you could tell, oh, it's -- I know my loved one wouldn't sound like that. I -- I could totally tell if it's AI. If you think they're having a panic attack and also they're being held at gunpoint for ransom, it -- it would -- all of that fear would just completely override your common sense circuitry.

 

Dave Bittner: Right.

 

Maria Varmazis: And so, I was just like, yes, I've had all these conversations with my family about how we would try and figure out what's real and what's not. And this one made me go, you know what? I think people easily fall for it.

 

Joe Carrigan: Yes.

 

Maria Varmazis: Because I feel like --

 

Joe Carrigan: Oh, absolutely. The stakes are very high in this one. I mean --

 

Maria Varmazis: You get that one wrong, it's catastrophic.

 

Joe Carrigan: Yes, absolutely. And I mean this -- this is like the ultimate, you know, the ultimate short circuit for any parent's brain.

 

Maria Varmazis: Yes.

 

Joe Carrigan: And it's, you know, these people are just horrid people. I mean, first off, they're scammers, but they're like, they're not even respectable. The worst kind of scammers.

 

Maria Varmazis: Yes. Yes. So, the woman in question, her name is Deborah Del Mastro and I'm naming her because she's been really brave in going on national news, including "Good Morning America," telling people about what happened to her. So, she -- she again, she lost that money to scammers. Her daughter's fine. She -- after she wired the money to the scammers, she actually then called her daughter's phone, just to verify, like, actually, was that real? In an ideal world, the two things would have been switched, but I can completely understand why that didn't happen.

 

Dave Bittner: Right.

 

Maria Varmazis: So, to me, this is like flavor of the week of what people are doing with AI, because again, I know for many of us, we have, like, code words or other things, but if you think that person's being held at gunpoint and they're having a panic attack, I could totally believe them not being able to get a code word out, if they've got, like, two seconds to talk to you. So, that's pretty, pretty gross. I just wanted to make sure people knew about this one. And definitely I've seen this in "People" magazine. It's been on "Good Morning America." So, it's a good thing to talk to your family or friends about because this one's pretty nasty.

 

Dave Bittner: What do you make of this one, Kieran? Something as human and -- and person to person as this?

 

Kieran Human: Yes. I mean, one thing that you said that I really liked where she's -- I believe her name was Deborah, is speaking out about this. Like, anyone can fall for things like this. We've had engineers fall for phishing scams. It's -- you're not an idiot just because you clicked the link. And -- and it's really good to talk about it, to educate people. It sparks conversation like these where, you know, we're able to talk about it. But AI, unfortunately, for better or for worse, you know, it's here and it's just going to get better. These scams are going to get easier, quicker, all of that. So, you just have to have those conversations and try your best. I mean, there -- there is no real great answer because like you said, when you're in that panic attack, you know, you're -- you're panicking. Your daughter was just kidnapped and -- and held at gunpoint. It's really, really tough to act rationally.

 

Dave Bittner: Right.

 

Maria Varmazis: Yes.

 

Dave Bittner: Yes. You say, let me -- "Let me put you on hold while I call my, you know--."

 

Maria Varmazis: Let me externally verify. I'll call you back. Kidnappers.

 

Dave Bittner: Right. Right. Right. I mean, even saying, you know, what's the password? What's the password? What's the password? If the scammers say, I can't remember and it's in your daughter's voice, what are you going to do? And what's the risk reward here? I mean, I'd turn over the money.

 

Kieran Human: Yes, and it sounds like they hung up right after faking having the daughter say that. So, it's not like there was even time for some back-and-forth conversation to happen.

 

Maria Varmazis: Yes, they were doing the whole, "Hey, we're just telling you this, we're dropping this bomb and we're out." So, there's no, you know, there's no chance of them messing it up after that point. They're just done. And so, yes. What nasty one? It's just super nasty.

 

Dave Bittner: Yes.

 

Maria Varmazis: Gross.

 

Dave Bittner: I'm trying to think, I mean, like, Joe, can you think of any way to -- to short circuit this? I -- I just can't.

 

Joe Carrigan: The family password is one way, but again, you're right, it is -- it is such a high stakes thing. You know, I mean, my tactic would be -- I don't know what my tactic would be in this situation. I have fortunately never been targeted by this, but you know, saying, "Hey, look, I don't have that kind of cash just laying around. It's going to take me a day to sell some money markets and then I can wire the money tomorrow."

 

Dave Bittner: Right.

 

Maria Varmazis: Delay.

 

Joe Carrigan: Delay.

 

Dave Bittner: Yes, yes, yes, that's smart.

 

Kieran Human: One thing you can also do is honestly, people really shouldn't be answering the phone to unknown numbers super often. You know, if you are expecting a call from your doctor, whatever, you can add those to your list, your contact list. If someone needs you, they can leave a voicemail. To me -- for me, honestly, I don't really answer unknown numbers. I'm actually really lucky. I have a phone number from when I moved from a couple cities away. So, any phone number that's actually from my zip code, I don't answer because those are almost always going to be phishing.

 

Maria Varmazis: Yes.

 

Joe Carrigan: Right.

 

Kieran Human: But in general, just not answering the phone, wait for that voicemail and then respond. You know, that way it wouldn't be so on the moment, you know, the -- the scammers, or the -- you know, in this case the -- the fake kidnappers are not on the line and you're thinking that your daughter's there, you're able to kind of have a moment, collect yourself, listen to it, take action.

 

Joe Carrigan: Yes, that's -- that's a great idea, Kieran. This reminds me of an old 80s standup bit where a guy says he had got an answering machine. It was the best thing in the world. And he just doesn't answer the phone anymore. And his friend said, "Hey, I called you and you never called me back." He says, "Well, you didn't leave a message. Your message is the opportunity for you to plead your case as to why I should pick up."

 

Dave Bittner: Yes, right.

 

Maria Varmazis: Yes.

 

Joe Carrigan: You know? Which I think, I mean, while -- while humorous, that is exactly right. I mean, because if somebody calls you and they say, you know, "We have your daughter," you're not calling them back. You're calling your daughter first. Right?

 

Dave Bittner: Yes.

 

Maria Varmazis: Yes.

 

Joe Carrigan: Are you okay? Okay. I can delete this message.

 

Maria Varmazis: It's -- it's like the concept, Kieran, it's a great thing that you just mentioned. It's like the concept, like, I just got one of those devices that helps me block a bunch of apps on my phone. The idea of building in friction in our lives to just slow down a lot of stuff. What you're suggesting is a great way of doing that, too. Just building in a little bit of friction to give yourself some time and -- and as Joe said, plead the case for -- for the scammer. And I wanted to add a little addendum because I just saw this quote in the "People" magazine story. This is again from Del Mastro, and she said, "I'm a Navy veteran and I'm usually very good in a crisis. And I totally, totally believed this guy had my daughter."

 

Joe Carrigan: Yes.

 

Dave Bittner: Yes.

 

Maria Varmazis: So, again, truly, I -- I just want to give her kudos for going so publicly.

 

Joe Carrigan: Yes. Deborah, thank you so much for coming forward with this. This -- this sucks that this happened to you, but, you know, the -- the fact that -- that you come out and you say what happened to you and you lay it all out, that's the only way we solve these things.

 

Maria Varmazis: Information sharing.

 

Dave Bittner: And I -- I mean, you know, we all think about how we would try to handle something like this, but we really -- none of us know.

 

Joe Carrigan: Yes.

 

Dave Bittner: None of us know how we would actually respond in an emergency situation.

 

Joe Carrigan: I'll bring it up again. Kieran hasn't heard this story, but I got a scam call from someone impersonating my county sheriff's department.

 

Dave Bittner: Yes.

 

Joe Carrigan: And I -- you know, I handled it properly, but it was not as psychologically easy as I thought it was going to be.

 

Dave Bittner: Yes. Yes.

 

Joe Carrigan: It was -- it took -- it took me going, you know, my cognitive processes and me leaning into them and not letting any emotional processes take over, but that was a struggle as unemotional as I tend to be.

 

Maria Varmazis: Robot Joe.

 

Joe Carrigan: Right.

 

Dave Bittner: So, robotic and heartless as you are --

 

Joe Carrigan: Yes.

 

Dave Bittner: -- that day, your heart grew through three sizes.

 

Joe Carrigan: Yes.

 

Kieran Human: The problem with, as the defender, you have to be right every single time, whereas the attacker only has to be right once.

 

Joe Carrigan: Yes.

 

Dave Bittner: Yes.

 

Maria Varmazis: Exactly it.

 

Dave Bittner: And I guess to kind of, to Maria's point, or -- or actually to Kieran's point also, about not answering the phone, I'm guessing that the bad guys in this case are not going to leave a message. Right? They'll just move on.

 

Maria Varmazis: Hello, we are kidnappers. Please call us back at the following number.

 

Dave Bittner: Yes.

 

Joe Carrigan: But they've gone through -- through all the legwork of cloning a specific person's daughter -- daughter's voice, so.

 

Maria Varmazis: That I'm sure can be automated in -- in milliseconds now, though. I mean, I -- I cannot -- I mean, you just need a -- you just need a second or two of audio from anyone to make a -- a voice clone.

 

Dave Bittner: Yes.

 

Maria Varmazis: It doesn't take very much. So, this is all automated. I can't imagine there's a real person doing all that.

 

Dave Bittner: And they might just keep calling and calling and calling until --

 

Joe Carrigan: Yes.

 

Dave Bittner: -- you know, out of exasperation, you're like, "What?"

 

Joe Carrigan: "What do you want?"

 

Dave Bittner: Any of you have a friend who does that where if you go -- go to voicemail, they immediately call you back again?

 

Joe Carrigan: I -- in -- in our family, that's the code for there's an emergency I need you to pick up.

 

Dave Bittner: Yes.

 

Maria Varmazis: Yes.

 

Joe Carrigan: So, you know, like, if I'm in a meeting and I see that my wife is calling, I -- I decline the call. If she calls back, I'll step out of the meeting to answer it.

 

Dave Bittner: Yes.

 

Joe Carrigan: Because that -- that's the -- that's the system we've -- we've set up. But no, I -- I -- if I had someone in my life like that, I'd weed them out.

 

Maria Varmazis: Yes, I was going to say, that's the someone's in a hospital level of call. Like, don't -- don't bother me, otherwise. That's crazy. Yes.

 

Kieran Human: Boy who cried wolf.

 

Maria Varmazis: Yes, seriously. Exactly.

 

Dave Bittner: Exactly. Exactly. All right, well, we will have a link to that story in the Show Notes. Joe, Maria, Kieran, it is time to move on to our "Catch of the Day." [ SOUNDBITE OF REELING IN FISHING LINE ] So, Kieran, you should read the part that is in gray. I will read the part that is in green. And it goes like this.

 

Kieran Human: Are you free tomorrow?

 

Dave Bittner: On a plane to Anchorage.

 

Kieran Human: This is N. Is this Nicole's new number?

 

Dave Bittner: Nicole died last week.

 

Kieran Human: Oh, my God. I just checked the number. I think I entered it wrong. Your number is very similar to my friend's. I hope I didn't bother you.

 

Dave Bittner: No bother.

 

Kieran Human: Sorry for the misunderstanding. Thank you for understanding. You are such a kind person.

 

Dave Bittner: I'm the one that killed Nicole.

 

Kieran Human: Okay.

 

Dave Bittner: Well, that took a turn.

 

Kieran Human: Yes.

 

Joe Carrigan: Hard, right.

 

Maria Varmazis: My dark humor. I was like, okay, that's awesome.

 

Joe Carrigan: This is -- this is someone just copying, pasting the standard I entered the wrong number script.

 

Dave Bittner: Yes.

 

Joe Carrigan: Like, when -- when the person says Nicole died last week, they don't even bother acknowledging that. They just go, "Oh, I checked the wrong number. I -- I -- and I entered the wrong number." You know, they just go on with the script.

 

Dave Bittner: Right, right. Yes. So, obviously this is someone's valiant attempt at short circuit -- short circuiting that and cutting it off, which I think they probably effectively did.

 

Maria Varmazis: Here's hoping.

 

Dave Bittner: Yes.

 

Maria Varmazis: That or they just told them it's a real number. And now they're going to get lots more spam.

 

Dave Bittner: Right. Right. Absolutely. All right, well, we would love to hear from you. If there's something you'd like us to consider for our "Catch of the Day," you can email us. It's hackinghumans@n2k.com. [ Music ] And that is our show, brought to you by N2K CyberWire. We want to thank our very special guest, Kieran Human, lead cyber security engineer at Threat Locker, for joining us. Kieran, hope you had a good time.

 

Kieran Human: I did. Thank you very much.

 

Dave Bittner: No, great. Please come back anytime. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. Were mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.

 

Joe Carrigan: I'm Joe Carrigan.

 

Maria Varmazis: And I'm Maria Varmazis.

 

Kieran Human: And I'm Kieran Human.

 

Dave Bittner: Thanks for listening. [ Music ]