Wood you fall for this?
Dave Bittner: Hello, everyone, and welcome to the "Hacking Humans" podcast where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner and joining me is Joe Carrigan. Hey, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: And our N2K colleague from the "T-Minus Space Cyber Briefing," Maria Varmazis. Maria.
Maria Varmazis: Hello, Dave. And hello, Joe.
Dave Bittner: We've got some good stories to share this week, but first we've got some follow up. Maria, you want to take the honors here?
Maria Varmazis: Oh, do I ever? So we got this comment from a listener and it goes like this. Long time listener, first time writer. "I am cranking the album "Jealousy" by X Japan as I type this. I nearly choked on my morning coffee when Maria mentioned X Japan and I nearly spilled it when so-claimed heavy metal fan Joe said he never heard of them. Why is there chicken talk when we could be talking about the greatness that is X Japan?" I totally agree. "Love the show. Maria is a great addition." Thank you very much. "Keep up the great work. You guys do a great job with the "Hacking Humans" podcast." Thank you. Thank you so much. Yeah.
Joe Carrigan: Let me go grab my phone right now. Hold on. Let's see. All right. Pulling up Spotify. And I'm going to add --
Maria Varmazis: Just for the record, when N2K wants to do a Japanese metal podcast I am here for the hosting on that one.
Joe Carrigan: See. I did not know they were metal.
Maria Varmazis: I mean it's like symphonic metal. It's they had their heyday.
Dave Bittner: Symphonic metal?
Maria Varmazis: Yeah. Like late '80s hair band, but like very melodic music. Not -- don't think thrash music. Think more heavy orchestrations.
Joe Carrigan: Oh. Not really thrash? All right.
Maria Varmazis: Yeah. So --
Dave Bittner: Well, it sounded kind of -- I don't know. I -- the one song I listened to in response to this feedback sounded plenty thrashy to me.
Joe Carrigan: It did sound. I heard it.
Maria Varmazis: Depends on the song. Depends on the song. Yeah. Yeah.
Joe Carrigan: This album was from 1991. Jealousy. I am putting it on my Spotify right now so when I get in my car it will play. And I will listen to the album and let you know what I think next week.
Dave Bittner: All right. Next week.
Maria Varmazis: I would be very -- well, I won't be here next week. So you'll have to let me know next time. I'm trying to remember.
Dave Bittner: Next time Maria's back we will compare notes.
Maria Varmazis: Let me see what's on the track listing. Okay. Not my favorite album of theirs so I'll be curious to hear what you think. I will give you and anyone if this makes it in to the final cut the vocalist is extremely polarizing. So if you go, "Music's great, but I can't stand the vocalist," it is known.
Joe Carrigan: Okay.
Maria Varmazis: So.
Joe Carrigan: That's how I feel about just about every single death metal band.
Maria Varmazis: Yeah. I had a really hard time with the vocalist. Like that -- he's just he's known for his style. It's just very distinctive. I'm not going to describe it. But yeah. My favorite song of theirs is probably their most famous song so I'm pretty basic. It's called "Kurenai" and it's like the most fun song to sing at Karaoke in existence. It's so so fun. But it's not on that album, Joe. So I'll send it to you separately.
Joe Carrigan: Okay.
Maria Varmazis: Yeah.
Dave Bittner: All right. Well, thank you to the listener who sent this in. Greatly appreciated. We love getting follow up from you all and love to read your comments. Let's take a quick break to hear from our sponsors and when we come back we will get in to our stories. All right. We are back. And, Joe, you are up first this week. What do you got for us?
Joe Carrigan: So this is not really a social engineering story, but it is an interesting story that I think is relevant to all of our listeners whether or not they are cybersecurity experts or not. We have talked in the past about how many devices we have in our house connected to our internet.
Maria Varmazis: Yep.
Dave Bittner: Yes. All of them.
Joe Carrigan: All of them. Right. And it's a lot. Well, the "Wall Street Journal" has an article by Robert McMillan called "How Hackers Found a Backdoor in to the American Living Room." This is from like the middle of last month. And it starts out with a story about two years ago a top Microsoft security executive reaches out to his counterpart over at Comcast. And Microsoft is investigating some kind of like hack, digital break in, linked to one of the most capable cybersecurity foes in the world is what it says here. But they needed to investigate six IP addresses which are what your -- it's how the internet knows which computer to send things to or one of the parts of the ways that it does that. And this article keeps referring to it as the internet's equivalent of a phone number and I think that's probably a helpful analogy. Not really accurate, but if you don't know what an IP address is you can just think of it as the phone number for your house on the internet.
Dave Bittner: Okay.
Joe Carrigan: Right? Comcast found that an organization called Midnight Blizzard -- I love these names for these hacking --
Maria Varmazis: Same.
Joe Carrigan: This is a hacking group from Russia's foreign intelligence service. Had accessed email accounts. And they had accessed email accounts from senior Microsoft leadership. And using -- they were using these consumer internet connections to mask their traffic because if you just come in from Russia and try to log in on a Microsoft server Microsoft has very basic security that says, "Hey, there's no way you're in Russia. No. You can't have access." So here's what Comcast found when they were investigating this. They found that there is a low cost consumer devices shipped to the U.S with backdoor software preinstalled on it. And this software is also being installed in mobile apps and pirated games. Pirated games. Right? So if you're downloading pirated software from, you know, warer sites, if you will, there's a very good chance that you have some kind of malware on there. And --
Maria Varmazis: Well, yeah. I mean I think anyone who's pirated video games knows that that's going to happen.
Joe Carrigan: Right.
Maria Varmazis: I'm just -- I'm just saying. I've never done that.
Joe Carrigan: I don't care. I just want to play the game. Right. Right.
Maria Varmazis: No. I've definitely never done that.
Joe Carrigan: No. Of course not.
Maria Varmazis: Nope. Nope. Nope. Not at all.
Joe Carrigan: So what has happened is this software, this backdoor software, has turned tens of millions, literally tens of millions, of consumer devices and apparently some computers as well in to a criminal cloud computing network. And these networks have a name. They're called residential proxy networks. So what that means is residential it's just in somebody's house or parts of it are in the house. It's a proxy that let's you represent like you're coming out of that house's IP address or coming from that house. And network is just, you know, all these things linked together. And government industry officials have said this problem has ballooned, absolutely gotten huge, over the past couple years. And there's an organization called the Digital Citizens Alliance that is a digital advocacy group, and they are estimating that there are about 20 million of these devices in the -- with back doors in the U.S alone. 20 million.
Maria Varmazis: You know, this reminds me, Dave -- does this remind you at all of the conversation we had with Brandon Karpf recently about sort of malicious GPS signals that are squatting on genuine ones? And they were seen to be also coming from Russia. Do you remember that conversation we had?
Dave Bittner: I do. I do. Yeah.
Joe Carrigan: Oh. Was that the -- I saw a YouTube video about this.
Maria Varmazis: Yes. By Veritasium.
Joe Carrigan: It was coming from the satellite.
Maria Varmazis: Yeah. Yeah. Yeah. Yeah. And they were -- yeah. And they were -- it was basically using legitimate GPS signals to mask what is presumed to be sort of tests of an emergency system which just it's sort of a similar thing going on, using a legitimate service as a smokescreen. But also presumably from Russia. That's very interesting.
Joe Carrigan: Right.
Dave Bittner: Right.
Joe Carrigan: That - I don't know that there's anything anybody can do about a Russian satellite broadcasting information across the GPS part of the spectrum. That's a different problem.
Maria Varmazis: Yes. Yes. These sort of rhyme. They're not the same thing. I'm just -- I'm just to me they're they just they rhyme. That's all.
Joe Carrigan: So the IP addresses that Microsoft provided belong to customers who were on one of these networks. It was put together by a Chinese provider and they called themselves IP Idea. And IP Idea gets its software installed on devices like it gets it preloaded on video streaming boxes and digital picture frames. Do you have a digital picture frame, Dave?
Dave Bittner: Not one that's hooked up to anything.
Joe Carrigan: Right. I have never had a digital picture frame. I've just from the very get go these things have always seemed sketchy to me and there have been multiple stories about these things coming with malware on them so I just don't buy them.
Dave Bittner: You know who loves them?
Joe Carrigan: Who?
Dave Bittner: Grandparents.
Joe Carrigan: Grandparents.
Maria Varmazis: Yeah. They sure do.
Dave Bittner: They do. Yeah.
Joe Carrigan: Right.
Dave Bittner: Yeah. When my parents were around they had one. I can think of several grandparents I know who have them. And what's great about it is the grandchildren can update the photos on them remotely and so grandma comes in and --
Joe Carrigan: I don't know if that's a great idea because right now I've got a nephew that's getting in to, you know, getting in to computers and stuff. And he's looking at -- he would definitely do something awful.
Dave Bittner: Okay.
Maria Varmazis: To his gram gram? Really?
Joe Carrigan: To -- yeah. To his grandma? Yeah. Absolutely.
Dave Bittner: In a normal family --
Joe Carrigan: Right. I mean it would be funny. It would be something that would make me laugh. Right? It would be hilarious, but it would not be my -- and my mother would probably be like, "I'm going to strangle Ethan or Joe next time I see them." One of the two. You know, I'm sorry. Not Ethan. It's Colin. I'm sorry.
Dave Bittner: But I think it's these low cost devices that aren't very well scrutinized as they make their way over here.
Joe Carrigan: Yes. So Comcast their engineers took a look at these six IP addresses and found -- now this number is staggering to me. That they were part of a network that was about 750,000 IP address networks located in homes and businesses. Three quarters of a million IP addresses. Now when you're a Comcast customer you get one IP address on the internet.
Dave Bittner: Right.
Joe Carrigan: Right? Now your machines -- your machines inside all have different IP addresses that are subletted out differently than the rest of the internet, and there's something called network address translation which manages communication between your machine and the outside world. But you get one. That means there are 750,000 homes or business locations that are part of this network and there could be multiple devices inside these things and that's just from Comcast. So this thing is huge. Now in January Google got a court order to go ahead and dismantle IP Idea's infrastructure. Guess how long it took them to get it back up and running?
Dave Bittner: Well, we talk about machine speed so I don't know. Are we talking nanoseconds, days, weeks?
Joe Carrigan: A number of weeks.
Dave Bittner: Number of weeks. Okay. Yeah. Okay.
Joe Carrigan: Guess how many weeks.
Dave Bittner: Maybe a month or so.
Joe Carrigan: Two weeks.
Dave Bittner: Two weeks.
Joe Carrigan: Two weeks it was back up and functioning. So of course as, you know, this is not really a technical podcast and this is a very technical story. And I will put a link to the show notes -- in the show notes to the story. There is another story in the middle of here that is -- that talks. It says how to protect yourself from these networks. And it has a link to a tool from a company called spurs.us. I have not done this on my home network, but I am going to do it tonight. And if you click on the link for spur U.S then it will tell you when you click on it there's a field there that says, "Observe risks." And it may say, "NA" or none. As long as there's nothing in that field that says observe risks you're probably okay, but if there's something in that field, you need to pay attention to that.
Dave Bittner: I want to say I don't know. In the past year or so there was a story about how the FBI had gotten permission to go out and basically patch a bunch, like thousands, tens of thousands, of people's home routers.
Joe Carrigan: They were -- they weren't Netgear, were they? They were TP Link routers.
Dave Bittner: Yeah. I think that's right.
Joe Carrigan: Because TP Link doesn't sunset their routers. Netgear and other router manufacturers will say, "Yep. Your router no longer works."
Dave Bittner: Yeah. And it's you can understand because it's one of those if it ain't broke, don't fix it kinds of things. Your router just sits there doing its job, minding its own business. And but if you're not keeping its firmware up to date which nobody does --
Joe Carrigan: Yep.
Dave Bittner: Then maybe every five years just go buy a new one.
Joe Carrigan: Yep.
Dave Bittner: Right?
Joe Carrigan: You could do that. That would be a great help.
Dave Bittner: And the first thing you should do is change the password.
Joe Carrigan: If you are technically inclined you can take that old TP Link router and install an open source routing operating system on it if it's compatible. And there's -- if you're technically inclined. If you're not technically inclined just go buy a new router. That's the simplest solution. It's going to save you the most amount of time and effort.
Maria Varmazis: Yeah, but have you ever been to someone's house and the router's like 15 years old and they're going "Why doesn't my TV have streaming video worth a damn?" I mean I've been in that situation.
Joe Carrigan: Yeah. That's a hardware issue.
Maria Varmazis: I know, but just like buy a new router every five years. It's like that's very ambitious I think for a lot of people.
Joe Carrigan: Right.
Dave Bittner: Well, that's my point though. Right? Like, you know -- I mean if you're like on the cutting edge, well how often do these protocols get updated? Every two or three years maybe we get WiFi protocols. WiFi protocols.
Joe Carrigan: Yeah. Well, the old WiFi protocols still work.
Dave Bittner: Right. Right. But they get better and faster and more robust and more secure and all those kinds of things. So every few years to invest in a new router, because they're not that expensive, and get the security updates that come with it, to me that's money well spent. So put it on your calendar. Every five years it pops up. It says, "Hey, knucklehead. Go buy a new router."
Joe Carrigan: Right. That's a good idea. That is the easiest way to get around the router problem here. Now that doesn't solve this other problem of these residential proxy networks from cheap devices that you buy and put on your network.
Dave Bittner: Yeah.
Joe Carrigan: Because they just hop right over the firewall because they're making connections from the outside.
Dave Bittner: Right.
Joe Carrigan: Or from the inside rather.
Dave Bittner: Just real quick in case folks are still not 100% clear on what this is about, basically this is somebody putting some software on a device in your home so that they can pass their data through it remotely so that it looks like it's coming from inside your home.
Joe Carrigan: Correct.
Dave Bittner: Rather than from them.
Joe Carrigan: Correct.
Dave Bittner: And so the places that they want to get to, the places they want to do the bad things they want to do, they're more likely to have their defenses down for something coming from a home in middle America than from, like Joe said, Russia.
Joe Carrigan: Right.
Maria Varmazis: Yep.
Dave Bittner: So that's what the residential -- that's what they're doing here. They're trying to mask their traffic to make it look like it comes from somewhere benign. And they're very good at it.
Joe Carrigan: Yeah.
Dave Bittner: All right. Well, we will have links to that story in the show notes. My story this week comes from the folks over at Bitdefender. And this is about some fake emails that are being sent out to folks claiming to be from Interpol which is the European law enforcement agency. And they're targeting small businesses with ransomware. And this is a phishing campaign that seems to be focusing on small businesses this article says across Europe, Asia, the middle east, and the United States with fake investigation emails impersonating law enforcement officials. So of course as these things work the email comes and gets your attention right away. They have a copy of one of the emails here. And the email title is "Emergency Response Needed."
Joe Carrigan: Don't send me an email.
Maria Varmazis: I'll get it in like two weeks. What are you talking about?
Joe Carrigan: You're not getting an emergency response from me via email no matter what.
Dave Bittner: Yeah.
Joe Carrigan: That's just not happening.
Dave Bittner: Yeah.
Maria Varmazis: Plus I don't take inbound calls. So you've got to send a pigeon. I don't know what else to tell you.
Dave Bittner: So it says, "Dear compliance." I don't know. "We're writing to bring your attention -- we are writing to bring to your attention information that may be relevant to your organization's compliance and security review. Based on information that has come to our attention, there may be activities involving account systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of that matter." So it goes on and continues to be a scary email.
Maria Varmazis: So generic. Yeah.
Dave Bittner: They give you a link to a Proton Drive account. So a cloud storage area. And they're telling you that there's this video file that you need to check out. And when you go to check out the video, download it, it is a compressed file. When you open it up and go to view it it installs malware. It is password protected which makes it -- the archive hard to inspect by any --
Joe Carrigan: That's right. So Proton can't open it up and go, "What's in here?" And do a virus scan on it and go, "Hey, you're distributing malware."
Dave Bittner: Right. Right. So they're disguising this executable file as a video file and taking advantage of the fact that most people are probably innocent or ignorant to how, you know, that's even a thing. Right? And of course they're curious. They want to see the video that has to do with -- video's a little more interesting than other types of media they might send you. Like what could they possibly have a video of that has to do with me or my business? But no. It's just malware. And once it's installed they encrypt your files and they present you with a ransom message. Yeah. So --
Joe Carrigan: It's a run of the mill ransomware.
Dave Bittner: It's run of the mill ransomware, but the phishing technique is particularly interesting just again in how they're short circuiting your emotions by telling you there's an emergency.
Joe Carrigan: Right.
Dave Bittner: They're sending you to a third party location. Right? Proton mail. They're getting you to open a mysterious file and telling you that it's one thing when it's another. And when you open the file it installs malware and that's the ballgame.
Joe Carrigan: This is very old school.
Maria Varmazis: Yeah. I was just thinking it reminds me of the "Is this you" sort of video DM scam and there's like versions of this that go way, way back. Yeah.
Dave Bittner: That's the first one -- Maria, I think this is -- this is BM, before Maria on the "Hacking Humans."
Maria Varmazis: Please let's not use that acronym again.
Dave Bittner: I like it. Kind of has a nice ring to it. Don't you think, Joe?
Joe Carrigan: I do not like it.
Dave Bittner: Joe, you're no fun.
Joe Carrigan: I snicker every time you say it. Yes.
Dave Bittner: So.
Joe Carrigan: Yeah. Before Maria.
Dave Bittner: Before Maria. Yeah. So I fell for one of these. It was -- it was before we were doing the show. I think it was before I was working with the CyberWire.
Joe Carrigan: Really?
Dave Bittner: Yeah. I was just --
Maria Varmazis: So it is BC.
Dave Bittner: That's right. BC. So but it was exactly that. It was just a text message from someone I knew and it said like, "Hey, Dave. Did you see this video?" And I was like, "What video?"
Maria Varmazis: Yeah.
Dave Bittner: No.
Joe Carrigan: Let me look.
Dave Bittner: Yeah. And so I think it led to like a Facebook log in which of course was fake and anyway they pwned me. We all learned a valuable lesson that day.
Joe Carrigan: It happens, Dave.
Maria Varmazis: It happens. It happens. There's been a lot of flavors of that one and I mean there were email versions of it. There are SMS versions of that. There were I mean -- I remember when Twitter was still the big one. There was a lot of Twitter DM scams around that specific issue. You know, somebody, "Hey, I got this video of you. Can you -- " You know, "You're doing something very untoward and, you know, can you verify that this is you?" I don't know. That's a terrifying allegation.
Joe Carrigan: [inaudible 00:21:41] video of you from the Christmas party.
Dave Bittner: That's right.
Maria Varmazis: Yeah. I mean --
Dave Bittner: All right. Well, I will have a link to that story in the show notes. Again that is from Bitdefender. They've got some good tips in there of how to protect yourself against this sort of thing. But, like Joe said, this is kind of an old school greatest hits sort of thing. There are lots of opportunities along the way, along the attack chain, for you to interrupt and stop this. But starting from the very beginning, you know, someone tries to set you off your game, tries to put you on edge and mess with your emotions. That's about as big a red flag as you can get.
Joe Carrigan: Yeah. Just respond to this with another email that says, "You'll never take me alive, coppers."
Dave Bittner: Right. Come back with a warrant.
Joe Carrigan: Right. Don't do that. Just delete the email. Move about your day.
Dave Bittner: All right. We're going to take a quick break here before we come back with the rest of our show. We'll be right back. [ Music ] And we are back. Maria, what do you have for us this week?
Maria Varmazis: Well, I have the end of "Hacking Humans." Great.
Dave Bittner: At last [laughs].
Maria Varmazis: Yeah. There was an opinion article in Dark Reading by Arun Vishwanath and the title is "The Beginning of the End of Social Engineering." And I went "Okay. It's over. Finally." We can all retire. And so this opinion piece is about the idea of with the advent of AI -- everybody drink. I just talked about AI. We may be seeing AI actually as something that can help detect all sorts of inbound malicious behavior that might normally socially engineer the average person. So, for example, when you have mobile operating systems like IOS or whatever Google uses because I'm not an Android user.
Dave Bittner: Android.
Joe Carrigan: Android.
Maria Varmazis: Yeah. Because Android's whatever their OOS is flavor of the month because they always name them like interesting things. I don't know.
Joe Carrigan: Now they just give them numbers.
Dave Bittner: Oh. Didn't they used to do like ice cream sandwich?
Maria Varmazis: Ice creams. Yeah. Yeah.
Joe Carrigan: They were named after desserts, alphabetical.
Dave Bittner: I see.
Maria Varmazis: Okay. So just numbers. Now it's been a while since I've used an Android phone so that's why I was like I don't know what the current one is. Anyway, but --
Joe Carrigan: Too [inaudible 00:24:12] cutesy. I hated it.
Maria Varmazis: [Laughs] All right. I'm going to go try that one again. With a lot of the operating systems from mobile systems now whether you like it or not, and I don't really like it, they have AI systems embedded. Vishwanath is arguing that these AI native operating systems could make it so we don't have to maybe work so hard to train human beings to sniff out malicious incoming phone calls or fishy SMSs or just phishing emails in general because the onboard AI systems will actually do that work for you. So I thought this was just like a really interesting idea and I remember going when I was reading it "This is an interesting idea. I don't know if I want to live in that future, but at the same time this could be great." If this actually works, if it actually works.
Joe Carrigan: Yeah.
Maria Varmazis: So the idea is that again the burden goes away from the person and then the device itself becomes a thing that protects people. And I was just I just -- it's a very interesting op ed. It's not terribly long. So definitely please, everybody, read it. I'd love to get your thoughts on it. But the --
Dave Bittner: You know what my thoughts are, Maria?
Maria Varmazis: Yeah.
Dave Bittner: Fool me once. Shame on you. Fool me twice. Shame on me. That's right. You know, because I remember we all thought "Oh, wouldn't this be great? We'll have targeted advertising. They'll be able to gather information about us and then I won't see ads for things that I'm not interested in."
Maria Varmazis: Yeah. That definitely never happened.
Joe Carrigan: No. It did not.
Maria Varmazis: No. Yeah.
Dave Bittner: So who are we going to trust to look over our shoulder when all this stuff is happening to look out for us? And but simultaneously like what's the deal with the devil we're going to have to make here?
Joe Carrigan: Oh, we can trust these big tech giants.
Maria Varmazis: Yeah. Yeah. And definitely using AI is not like just essentially a slot machine. Whether or not you actually get something accurate is just a matter of chance. And it's definitely repeatable. Yeah. So his argument -- and again I found it interesting. I'm not saying I think it's valid necessarily, but he's more of an expert than I am. He was saying that you could imagine that your phone is going to be telling you, you know, this person who's calling you is claiming to be your bank or at the same time you're getting a password reset email and all of these patterns put together mean that this is probably something fraudulent going on. Don't trust it. That is interesting to me that the idea is that maybe your device could be your helper in saying there's a lot of things happening inbound at you at once. Putting all of this together this is a pattern of behavior saying something's not right here. Maybe don't trust whatever's coming at you. But yeah. Is it repeatable? Is it trustworthy? I'm remembering when AI summaries of stuff came out for a lot of people's mobile phones. Those summaries were often really comically wrong.
Joe Carrigan: They were awful. Right?
Maria Varmazis: They were hilariously wrong. I remember we were all trading sort of war stories about that. Maybe they've gotten better. I don't use any of this. I have disabled as much of it as I can on my phone because I just don't want it which is like another angle right there. But another wrinkle to this story that the author mentions also is that scammers will also get wise to this if we start using AI to help protect the user on device. So maybe the scammers will go, "Well, the heck with you. I'm not going to try and even scam the person anymore. I'm going to try and fake out the AI protection." And just go around the human entirely and just mess with the AI system. So maybe the AI assistant would instead become the first target. So I guess our show would become hacking AI agents instead of --
Dave Bittner: On behalf of humans.
Maria Varmazis: But it's not as catchy of a title so, you know.
Dave Bittner: No. It just doesn't really work.
Maria Varmazis: No. No alliteration.
Joe Carrigan: Yeah.
Maria Varmazis: Hacking AI. No. It doesn't work.
Dave Bittner: I like the idea of this. I like the idea of -- and again I tend to -- for better, for worse, I tend to think back of my parents and how helpful it would have been to have some kind of full time assistant. We all know their names.
Joe Carrigan: Right. Don't say it.
Dave Bittner: No. But not only listening all the time, but tapped in to their network so monitoring their phone, their devices. Like that's the ideal thing to think about, someone who is vulnerable has this device, this persona, watching their back. I love the idea of that.
Maria Varmazis: Yes.
Joe Carrigan: Yeah. It's a good idea.
Dave Bittner: Yeah. But I am so I guess worn down and cynical about the potential execution of it.
Joe Carrigan: And rightfully so, I think.
Maria Varmazis: Yeah. I would agree with that.
Dave Bittner: How much we've been burned.
Joe Carrigan: Won't social media be great? You can get in touch with everybody and you can have relationships with people you haven't seen in years. You can keep in touch.
Maria Varmazis: You can hear the opinions of literally anyone in the most remote corners of the world including people that you definitely --
Dave Bittner: Everyone will have an equal voice.
Maria Varmazis: Oh yeah.
Joe Carrigan: It's just a dumpster fire now. And no. Everybody does not have an equal voice. There's plenty of examples of these social networks silencing people that dissent that they don't like, that are saying things they don't like. I heard somebody saying, "Hey, they just didn't like what I had to say so they muted me." Or something. Ridiculous.
Maria Varmazis: Yeah. That guy who stands on the street corner in your town center who just raves at passing cars, well he's now your town's most active Facebook commenter and they gave him a badge.
Dave Bittner: That's right.
Maria Varmazis: He never misses a post. Yeah. But he is the loudest voice on there. Yeah. Lots of engagement. So we make sure that you always see what he has to say.
Dave Bittner: Right.
Maria Varmazis: Great.
Dave Bittner: Yeah. What a world.
Joe Carrigan: Yeah.
Dave Bittner: I wonder how you could balance it, though. I don't know. Again love the idea, but execution.
Maria Varmazis: Yeah. I had the same -- I had the same reaction. Like I -- whenever I'm sort of talking family members through a lot of this stuff I often think, "It would just be easier if before they answer email or the phone they just talk to me first." How do I duplicate that? I obviously can't. But, you know, wouldn't it be nice to just have a sense of, you know, your friendly neighborhood nerd just keeping an eye out for you at all times.
Joe Carrigan: Pocket nerd.
Maria Varmazis: Pocket nerd.
Joe Carrigan: That's what you'd call it because it's on the phone in your pocket.
Maria Varmazis: Maybe a squad of geeks. Wait. No. That's been tried. Yeah. We've seen this play out before, but you know, again in theory it sounds great. In theory.
Dave Bittner: I wonder if there needs to be either a custom OS or like an OS overlay for vulnerable populations. You know? That has this kind of thing built in.
Joe Carrigan: That's not a bad idea.
Dave Bittner: You know, the -- I don't want to say dumbed down, but with higher -- taller walls and deeper moats.
Joe Carrigan: Right. Right.
Maria Varmazis: Yeah. I mean it's for -- there's this WiFi landline for kids thing. Dave, I think I've mentioned it. It's called tin can. I got for my kid. And I've heard that actually a lot of people are buying them for their elderly parents because it works through allow listing for phone calls. So it's super simple. There's no apps. It's just, you know, WiFi calling. But because it is explicitly allow listing you can't get any phone calls from anyone who's not already preapproved which is real nice. I don't know. Yeah. I'm a big fan.
Joe Carrigan: It's called tin can?
Maria Varmazis: Tin can. Yeah. I'm not --
Joe Carrigan: Is that an app or is that a piece of hardware?
Maria Varmazis: It's a physical piece of hardware. It's -- I'm not getting paid for this. I'm just I'm a customer. It's like I'm getting -- we should bleep the names. Like they are not sponsoring this podcast. But it's -- it is a very unfancy, you know, WiFi - just a VoIP phone. I mean there's nothing really complicated about it, but it doesn't have any screens. It's just a physical phone like the kind we all used to have. And on the back end it is fully allow listed and you can also put quiet hours and we don't have to run any of this for the podcast. I'm just --
Dave Bittner: I've mentioned it here before that I'm only half joking. You know, Sony used to have a brand called My First Sony which were little devices for little kids. So you had -- and they were just you could beat the crap out of them. Right? So it was like a cassette player, you know, that you could throw across the room. It would be fine. So My First Sony. I say my last Sony.
Maria Varmazis: Honestly, a lot of these -- a lot of these apps and devices that I see on the market for, you know, in theory to help kids have a more social media free childhood I think are going to be great for a lot of us adults who are just sick of it.
Dave Bittner: Yeah.
Maria Varmazis: And, you know, allow listing for phones, I mean I'm a -- I would have just gone back to proper going through my local phone company and getting a landline. I had done that actually when my husband and I first bought our house. But we got so many spam calls that we just after I think two months we just disconnected it. So --
Joe Carrigan: Yeah.
Dave Bittner: Yeah. Yeah.
Joe Carrigan: I wonder. Can you port a number to this, one of these services? Because if you can port a number to one of these services --
Maria Varmazis: You're like, "I'm doing it."
Joe Carrigan: I'm doing it. Yeah.
Maria Varmazis: I have no idea. I have absolutely no idea. I've never tried that. So.
Dave Bittner: It's another thing for Joe to report back on. He's got -- he's got Japanese metal music.
Joe Carrigan: I will listen to that. I doubt I'll actually do anything with this because this sounds great, but it also sounds like a lot of research and work and I just don't have time for that.
Maria Varmazis: Yeah. No. No. It's but I just think it's -- I've seen this for a few different things like GPS watches for to keep an eye on where your kids are so they don't get lost. Same thing. People are saying, "Maybe gam gam could use that." So, you know.
Joe Carrigan: That's really the actual valuable use case. Right?
Dave Bittner: No. No. Yeah. No. I had a -- what's the -- what's Apple's little tag thing, little GPS?
Joe Carrigan: Air tags.
Dave Bittner: I had an air tag on my father's key chain because he kept losing his keys, you know.
Maria Varmazis: Yep.
Joe Carrigan: Right.
Dave Bittner: It was great.
Joe Carrigan: My son has that, has a tile on his key chain because he keeps losing his keys.
Dave Bittner: Same thing. Yeah. It's great.
Maria Varmazis: Same for me because I keep losing my keys.
Joe Carrigan: I don't think that's age related though. I think that's --
Dave Bittner: No. No. Some people yeah.
Joe Carrigan: Yeah. You do.
Dave Bittner: Yeah. Well, money well spent. All right. We will have a link to Maria's story in the show notes. And of course we would love to hear from you. If there's something you'd like us to consider for the show please do email us. It's hackinghumans@n2k.com. All right. Joe, Maria, it is time for our Catch of the Day. [ Soundbite of Reeling in Fishing Line ] [ Music ]
Joe Carrigan: Dave, our Catch of the Day comes from the scam bait subreddit R/scambait, and the title of this one is "Polish Frank Part One." And this is like a bait in progress so it's not going to go to finishing. I've started reading this and I have no idea what's going on here.
Dave Bittner: Okay.
Maria Varmazis: It's really really long. I feel like we should just on the production side it is very very long.
Dave Bittner: Yeah. I have a feeling we will know when to stop.
Joe Carrigan: Okay.
Dave Bittner: Having read through this. And the clue is in the title.
Maria Varmazis: Oh boy.
Dave Bittner: Maria?
Maria Varmazis: Yep.
Dave Bittner: All right.
Maria Varmazis: Jesus Christ.
Dave Bittner: So I will be the instigator. Maria, you're in light blue. Here we go. It says "Hello. You pump in my wall and I decided to write to you. Do we know each other?"
Maria Varmazis: "I do not know what that means. What wall?"
Dave Bittner: "I mean you. I find you in my telegram and I thought I should message you. Do we know each other? I'm Frank by name."
Maria Varmazis: Frank by name. Frank by nature. "I don't know why you found me there. I don't recall talking to you. What does it say my name is?"
Dave Bittner: "Well, I'm just seeing skyline pigeon. Can I have a photo of you or I should see you my photo to see if you know me."
Maria Varmazis: "I -- no. I've never seen you, that I recall. Where do you live?"
Dave Bittner: "Are you sure? Well, I'm from Lublin, Poland. What about you? Can I have a photo of you? Do you play Bingo Frenzy?"
Maria Varmazis: "I don't send pictures when I don't really know someone yet. My name is Linda and I live in Chicago. I might have played that game in the past. Do people talk on there?"
Dave Bittner: "Yes. People talk on there. I play that once in a while whenever I'm less busy with work. You mean you have never played that game? Your picture is just for my eyes only. Maybe I can recognize you with you."
Joe Carrigan: Never. Never believe someone who tells you that.
Maria Varmazis: "If you don't know me by name and location then my picture will not help you. Maybe if you tell me what you do for a living it would help. I'm retired."
Dave Bittner: "Oh. I see. I work as a timber contractor and that's what my late father was doing before he passed on. I had to take over from you. What was your profession before you get retired?"
Maria Varmazis: "I was a doctor at Northwestern Hospital here in Chicago."
Dave Bittner: "Wow. That's very lovely to hear. I have been to North Carolina once. And I stayed for seven months. Nice to meet you."
Maria Varmazis: "Okay, but that has nothing to do with Chicago. It's [inaudible 00:37:43]. So what kind of forestry -- " I know I'm mispronouncing that. "So what kind of forestry happens in Poland?"
Dave Bittner: "I don't know more about the United States. In Poland forestry mostly involved logging, replanting trees, and maintaining natural areas. Poland has a lot of pine and mixed forests. Have you ever visited any large forests or nature parks before?"
Maria Varmazis: "Sure. I've been all over the United States and I've seen many forests, especially in Northern California. I'm sure they're beautiful there in Poland. May I ask how old you are, Frank?"
Dave Bittner: "Of course they are beautiful here in Poland. I will be 62 years old February 28. And you? I still insist a photo from you. You seem very intelligent."
Maria Varmazis: "I'm 70 myself. I've never been to Poland."
Dave Bittner: "Not even any Europe countries?"
Maria Varmazis: "I have been to the Canary Island which is close to Spain and off the coast of Africa, but that's it. I'll try to find a photo, but I don't have too many. Give me time."
Dave Bittner: "Okay. Once again nice to meet you. Like I said, can we be friends?"
Maria Varmazis: "I guess. It depends on whether -- "
Joe Carrigan: Sounds like something a first grader asks you.
Maria Varmazis: Please be friends. "I guess. It depends on whether we have -- we find any mutual interests to talk about. What kind of things are you interested in?"
Dave Bittner: "I'm honestly not too interested in politics. I prefer more peaceful and personal conversations, but I don't keep friends due to what has happened to me in the past."
Joe Carrigan: Oh no.
Dave Bittner: "I enjoy talking about life, nature, family, faith, and meaningful experiences and getting to know someone personally. I also enjoy simple moments like coffee. What kind of things do you enjoy talking about most?"
Joe Carrigan: All right. Stop right here. There is a hook in here that is I think it's pretty obvious, but you know I don't keep friends due to what has happened in the past and he goes on to describe a bunch of other stuff and what you're supposed to do is go, "What's happened in the past?"
Dave Bittner: Yeah.
Joe Carrigan: And he's supposed to have this sob story that gets you emotionally involved with him.
Maria Varmazis: I'm dying to know what happened to him in the past. I mean okay. Yeah.
Joe Carrigan: Yeah, but don't. I don't think this person's going to engage with that.
Maria Varmazis: Yeah. "Well, I'm Linda again and I like nature and am pretty familiar with wildlife and various plants and love bird watching. I'm not religious at all so I can't relate to that stuff. I like to talk about books and -- " What's that? Oh. "And world history too." Sorry. The thing's in the way. "Do you have a big family?"
Dave Bittner: "I am the only child of my late parents. My dad have a brother, but I know where he is because he's a drug trafficking and also a drug addict. I don't know where he's with his family right now. My dad was a timber contractor, like I told you before. He was hit in the bush while he was cutting down timbers. My mom had an heart attack when she heard the news. She was revived, but died three years after my father death. Talking about this was make me feel sad and talking books and world history I don't do any of that. LOL. So I guess I'm too old for that. What about you? How many brothers and sisters do you have? How bigs is your family?"
Joe Carrigan: So he went ahead and gave you a whole sob story anyway.
Dave Bittner: Yeah. Yeah.
Maria Varmazis: Wow.
Dave Bittner: He cut it there. Yeah.
Maria Varmazis: I was taken on a journey. I'm in. I mean no. I shouldn't be, but I'm totally in.
Dave Bittner: You're intrigued. Right? I mean, you know.
Maria Varmazis: He was hit in the bush.
Dave Bittner: He was hit in the bush which for a second I thought maybe we were in Australia.
Joe Carrigan: Right.
Dave Bittner: But maybe something else.
Joe Carrigan: Right.
Maria Varmazis: Yep.
Dave Bittner: All right. Well, what do we -- obviously what's going on here is just your standard --
Joe Carrigan: It's your standard romance scam.
Dave Bittner: Romance scam or getting to know you scam or cryptocurrency scam. Stage one of some kind of scam.
Joe Carrigan: Yep.
Dave Bittner: And I think our hero in this story was doing a good job of stringing this person along and wasting their time.
Maria Varmazis: Yeah. General question for us as we've read through a bunch of these in the past couple of months. Are a lot of these coming from online game -- like mobile games? With the chats in mobile games? Are we noticing a subtext there? Because I -- yeah. Some of them have been from like Scrabble. And this one seems to have a reference to a game as well. I'm wondering.
Dave Bittner: That's a great point, Maria. It seems as though some of them are using the online game as the other place.
Joe Carrigan: Right.
Dave Bittner: Right? So instead of trying to get you to go to Instagram we're going to try to get you to go to Candy Crush or whatever, some game that has a chat function, because chances are that chat function isn't going to be scrutinized.
Joe Carrigan: Right.
Dave Bittner: Yeah.
Maria Varmazis: And probably used by lonely or older people in some cases.
Dave Bittner: Maybe. Maybe. I mean it could be as simple as, "Hey, go meet me at this game." And it costs 5 bucks to buy the game.
Joe Carrigan: Right.
Dave Bittner: But I suspect it's more sophisticated than that.
Joe Carrigan: Yeah. I would imagine as well.
Maria Varmazis: Yeah. Yeah.
Dave Bittner: Longer thing than that. All right. Well, we will have a link to that Catch of the Day in the show notes and once again please send us your submissions for Catch of the Day. We always enjoy reading them. Our email is hackinghumans@n2k.com. [ Music ] And that is "Hacking Humans" brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: I'm Joe Carrigan.
Maria Varmazis: And I'm Maria Varmazis.
Dave Bittner: Thanks for listening. [ Music ]
