Caught on ScamTok
Dave Bittner: Hello everyone, and welcome to the "Hacking Humans" podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Carrigan. Hey there, Joe.
Joe Carrigan: Hi Dave.
Dave Bittner: Maria is on vacation this week. We miss Maria when she's not here, don't we, Joe?
Joe Carrigan: We do, yeah [laughter].
Dave Bittner: But I have it on good authority she will be back with us next time. So, before you go diving for that "Skip" button --
Joe Carrigan: Right [laughter].
Dave Bittner: Joe and I are doing it old school like we used to.
Joe Carrigan: That's right.
Dave Bittner: PM, pre-Maria.
Joe Carrigan: Yes. That's the acronym now, or the initialism is PM?
Dave Bittner: I don't know.
Joe Carrigan: Okay.
Dave Bittner: It's better than BM, right?
Joe Carrigan: Right, yeah.
Dave Bittner: Okay. All right. We don't have any follow-up this week, do we?
Joe Carrigan: I don't think so. We do have something to talk about next week, though.
Dave Bittner: Okay.
Joe Carrigan: Maria needs to be here for that.
Dave Bittner: Oh, all right. Fair enough. Fair enough. All right. Well, I'll tell you what. Let's take a quick break to hear from our sponsors. And when we come back, we will dive into our stories. [ Music ] And we are back. I'm going to jump into things here with us today, Joe.
Joe Carrigan: Okay.
Dave Bittner: I have a story from the folks over at "Info Security Magazine". This is an article written by Danny Palmer, and it's titled, "Phishing Attacks Targeted Facebook Users with Fake Verification Offer". So, imagine you're running a small business.
Joe Carrigan: Okay.
Dave Bittner: And one morning you get what looks like an official Facebook business email.
Joe Carrigan: Yeah.
Dave Bittner: And it says, "Good news! [laughter]. We're going to help you protect your brand with a verified badge."
Joe Carrigan: Okay.
Dave Bittner: That sounds reasonable.
Joe Carrigan: Yeah, sounds like something I might be interested in doing. I don't want --
Dave Bittner: It's a trap, Joe.
Joe Carrigan: Yeah, I don't want somebody out there impersonating me.
Dave Bittner: Right. So this campaign that's outlined in this article was particularly sneaky because the emails all looked legitimate enough to slip past a lot of security checks. So instead of being like a sloppy phishing attempt, the attackers actually borrowed Facebook Messenger chatbots to make the whole experience feel interactive and authentic. So, they made it look like you were interacting with a Facebook Messenger chatbot.
Joe Carrigan: How'd they do that?
Dave Bittner: I don't know. I don't know. I don't know what was going on behind the scenes, but I suspect that's probably not too hard a thing to spin up.
Joe Carrigan: No.
Dave Bittner: In other words, click here to chat with Facebook, right? You get an email that says, "Click here to chat with Facebook". It sends you someplace that, you know, has a domain name that has the word "Facebook" somewhere in it, right?
Joe Carrigan: Right.
Dave Bittner: And next thing you know, you're chatting, but it's not with Facebook.
Joe Carrigan: Yeah, you're at, like, awesomefacebooksupport.com or something like that.
Dave Bittner: Right, exactly, exactly.
Joe Carrigan: Right.
Dave Bittner: So they say the victims were guided through what looked like a normal verification process. They requested usernames, passwords, multifactor authentication codes.
Joe Carrigan: Oh, no.
Dave Bittner: Here's where it gets really interesting. Photos of passports or driver's licenses.
Joe Carrigan: Oh, so they're not only stealing your Facebook account, they're also stealing your identity.
Dave Bittner: Yeah. Right.
Joe Carrigan: Great.
Dave Bittner: They said the scammers were basically building their own customer service department. But I think what's noteworthy is that every step along the way reassured the victims that they were protecting their account, when in reality they were handing over the keys.
Joe Carrigan: Right. Yeah.
Dave Bittner: And this research I should mention, by the way, comes from Huntress, which is a very well-known and respected cybersecurity company.
Joe Carrigan: Yes.
Dave Bittner: According to their research, the campaign ran from November of last year until June of this year when Meta disrupted the infrastructure behind it. And they point out that a Meta business account in particular can be used to buy scam ads, you could lock out the legit owners, and then you can launch convincing attacks against customers and followers. So they point out that the irony here is that Facebook really does offer account verification.
Joe Carrigan: Right.
Dave Bittner: But that starts inside Facebook.
Joe Carrigan: Yes. Yeah.
Dave Bittner: They charge you for it.
Joe Carrigan: The, one of my biggest fears is my wife has a Facebook page that is for her quilting business. And she doesn't, you know, she doesn't use it a lot. Every now and then she'll put a quilt that she's worked on --
Dave Bittner: Yeah.
Joe Carrigan: -- on the page, but a lot of times she can't do that. The customers she has are like, yeah, don't do that until I give it to somebody.
Dave Bittner: Right. Right.
Joe Carrigan: So yeah, don't spoil it.
Dave Bittner: Happy retirement, Uncle Harvey.
Joe Carrigan: Yeah. So, I mean, she doesn't use it a lot, but my fear is that that gets taken over.
Dave Bittner: Right.
Joe Carrigan: Whether somebody compromises my wife's account or somebody somehow convinces somebody on the admin team, because actually there's three people on admin. It's me, my daughter and my wife. And, you know, my daughter and I are both pretty good at this. But, and my wife is actually quite shrewd. She is not, not easily duped. You know --
Dave Bittner: Right.
Joe Carrigan: I get questions from her all the time and I'm like, is this legit? And I'm like, no, although one time with the puppies, you know, the puppy scam, I had to convince her by having, you know, eliciting a certain behavior from the scammer. But she's like, yeah, you're right. This is a scammer. I'm like, because if we offer to go, this was a, I told the story a couple of weeks ago.
Dave Bittner: I remember. Yeah.
Joe Carrigan: It was up in Pennsylvania, Philadelphia, which is not far from where we live.
Dave Bittner: No, but still a few couple hours.
Joe Carrigan: Right. But we said, hey, we're willing to come up and meet the puppies.
Dave Bittner: Right.
Joe Carrigan: And they started hemming and hawing and beating around the bush about it and saying all kinds of things that just didn't make sense. Like, you need to make a deposit before you can come and see the puppies. I'm like, tell them that we'll come up and see the puppies, and if we like one of the puppies, we'll give them a deposit in cash then.
Dave Bittner: Right. Right.
Joe Carrigan: And, you know, and that was, you know, that seemed like the we're willing to hand you a box of cash, an envelope full of cash, for a dog.
Dave Bittner: Right.
Joe Carrigan: And they didn't want to do that. So obviously they were not in Philadelphia. Obviously they were scammers. But, you know, when she gets mails, emails that look like they're coming from something, she talks to me about it and I'm like, you know, I make the evaluation. I help her, you know, I talk to her about it as well.
Dave Bittner: Yeah.
Joe Carrigan: And, yeah, anytime she does, there are some things that just seem like scams. I know I'm going off topic here, but I recently, Dave, purchased a pachinko machine.
Dave Bittner: Oh, okay.
Joe Carrigan: Yeah, another pachinko machine. Now I have --
Dave Bittner: I'm glad you said it so I didn't have to.
Joe Carrigan: Now I have eight.
Dave Bittner: Eight? Oh my lord. Is it possible that I remember you getting your first pachinko machine?
Joe Carrigan: Yeah, probably.
Dave Bittner: Oh my.
Joe Carrigan: Yeah, I got a problem, Dave.
Dave Bittner: Yes, you do.
Joe Carrigan: So --
Dave Bittner: Yes, you do.
Joe Carrigan: But this one was a much more modern pachinko machine.
Dave Bittner: Okay.
Joe Carrigan: And I was interacting with somebody on Facebook Marketplace, and the price seemed really good for a machine in this condition. It doesn't need any restoration at all, or it did. It actually did need a little bit of work, but not a full teardown. It's in good enough condition. I just needed to clean out some blockages and get it working. But during the course of that, the person who was selling it responded very slowly, which I immediately thought was a scammer. And then I said, you know, we live in the same area. And she's like, how do you know where I live? I said, there's a map on the Facebook Marketplace listing that says you live in Sykesville.
Dave Bittner: Right.
Joe Carrigan: And, you know, Sykesville is a big area and I live near that city. And eventually we established, I said, so when we meet, I will bring cash and you bring the pachinko machine. And she said, how about we meet at this place, and it's a place right by my house. And I said, okay, maybe this isn't a scam. So I pull up and sure enough, it was a legitimate deal. She had the pachinko machine, I gave her the, it looked good. I gave her the cash. Took it home, fixed a couple things and it works now. It is very, very loud, though. It is not like --
Dave Bittner: Is there any other kind of pachinko machine?
Joe Carrigan: Well, yeah. So I will tell you --
Dave Bittner: Isn't that kind of the point of a pachinko machine?
Joe Carrigan: Yeah, have you ever seen the videos of a modern pachinko parlor? It sounds like it's just deafening to be in there.
Dave Bittner: Yeah, it's like, it's adjacent to like a Las Vegas slot machine room.
Joe Carrigan: Right, it's very similar. It's the Japanese version of a slot machine combined with kind of like a pinball machine.
Dave Bittner: Yeah.
Joe Carrigan: And I love these machines, but this is not the typical kind of machine I buy. I really like the older ones that are all mechanical.
Dave Bittner: Okay.
Joe Carrigan: I think those are just beautiful works of art and Japanese engineering, which is amazing that these things still work, like, forty years later Anyway, this is not pachinko talk. So, this would kind of look like a scam. So I had my guard up. That was the point.
Dave Bittner: Yeah.
Joe Carrigan: So yeah, I mean, I expect nothing but scams from Facebook.
Dave Bittner: Yeah.
Joe Carrigan: So, I don't know. Maybe this is not something will work on me, but my fear is that my wife loses control of that quilting account.
Dave Bittner: Yeah, no, I think that's not an unreasonable fear.
Joe Carrigan: Right.
Dave Bittner: And, you know, good for her that she has you and that you have each other to bounce these things off of.
Joe Carrigan: Right.
Dave Bittner: So that's, we always talk about that. Stop and talk to somebody.
Joe Carrigan: That is a great way to recognize that something is a scam.
Dave Bittner: Yeah, absolutely. So again, this article says that Facebook does offer business verification, but it is a paid service. So if you suddenly get an email that promises to do it for free, probably a cue to start asking questions instead of clicking links.
Joe Carrigan: Right.
Dave Bittner: By the way, just, that's the end of that story, but I just, this is a podcast so there are no visuals, but I have to tell you, Joe, about a Facebook ad scam that I saw that just cracked me up.
Joe Carrigan: Cracked you up, okay, good.
Dave Bittner: I laughed out loud, and I think to myself, this can't be real. This can't be real.
Joe Carrigan: Do tell.
Dave Bittner: The ad was for bubble juice.
Joe Carrigan: Like the stuff that you pour in a dish for the kids?
Dave Bittner: Yeah, exactly.
Joe Carrigan: Yeah, bubble juice. That's what we call it, too.
Dave Bittner: Yeah, bubble juice, right?
Joe Carrigan: Right.
Dave Bittner: But you can, you know, you can make your own bubble juice.
Joe Carrigan: You can?
Dave Bittner: Yep. My wife has a bubble machine that she puts on our back deck, and when people walk by the pathway near our house, sometimes she'll fire up the bubble machine, and people are delighted.
Joe Carrigan: Yeah.
Dave Bittner: Who doesn't love bubbles?
Joe Carrigan: Nobody. Psychopaths, Dave, that's who.
Dave Bittner: That's right, that's right. And so you can make bubble juice at home. You can make your own formula. I'll just give everyone who is out there blowing bubbles a little tip, a couple drops of glycerin in your bubble juice and your bubbles will last a lot longer.
Joe Carrigan: Yes.
Dave Bittner: Anyway, this ad was for bubble juice. Now, how could you possibly make a fake ad about bubble juice?
Joe Carrigan: That's what I'm wondering, because generally, we just go to, like, Five Below and buy the gallon-sized jug of bubble juice.
Dave Bittner: Exactly. It's soapy water. I mean --
Joe Carrigan: Plan on the kids spilling it everywhere.
Dave Bittner: Right, it's soapy water. That's all it is. So, this ad had kids blowing bubbles, and when the bubbles came out, the bubbles formed shapes. Animals and clowns and... Just you name it, if anything that a kid would want to play with, they were blowing bubbles out of the, just the regular way you blow a bubble.
Joe Carrigan: It's like SpongeBob.
Dave Bittner: Yeah, exactly. You got a little plastic wand, but out from the other side of the wand was coming SpongeBob or --
Joe Carrigan: Bubble buddy.
Dave Bittner: Yeah.
Joe Carrigan: Yeah, you've got to bring it around town, bring it around town.
Dave Bittner: And that was what this ad was for, was this special, you know, like, quantum bubbles or something, you know.
Joe Carrigan: Right.
Dave Bittner: Like there was some gobbledygook explanation for why these bubbles were capable of doing this, but.
Joe Carrigan: That is amazing.
Dave Bittner: Yeah, I just sat there with my jaw hanging, going, this can't be real.
Joe Carrigan: Yeah.
Dave Bittner: This can't be real. And yet, I think it was. I don't know, it might have been a prank or a joke or satire. We can't tell anymore, Joe, that's the thing. We can't tell.
Joe Carrigan: The AI-generated video of these kids blowing bubbles with shapes --
Dave Bittner: Right.
Joe Carrigan: -- was so good.
Dave Bittner: We can't tell anymore.
Joe Carrigan: You couldn't tell.
Dave Bittner: No. No.
Joe Carrigan: I know way too much about this as, you know, because when I was a kid, there was a guy, I watched some show where this guy was like a bubble expert.
Dave Bittner: Oh, yeah. I remember. I remember. Yeah. He was on "That's Incredible" sometimes.
Joe Carrigan: Maybe that's what it was.
Dave Bittner: Yeah. Yeah. Are you talking about, I don't want to ruin it. Go ahead.
Joe Carrigan: So he said he could blow a square bubble.
Dave Bittner: Yes. Yes.
Joe Carrigan: Or create a cube bubble.
Dave Bittner: Yes.
Joe Carrigan: And he did it.
Dave Bittner: He did it.
Joe Carrigan: But the way he did it was he put a bunch of bubbles together, so if you notice when two bubbles join, they'll make a flat surface.
Dave Bittner: Right.
Joe Carrigan: So he would put six bubbles together in the right configuration such that there was a cubic bubble in the center, and it was really just the four, or the six flat surfaces of the joining bubbles. And then because it was the '80s, he would take a drag off his cigarette --
Dave Bittner: Right, I remember that.
Joe Carrigan: -- and take a straw that he soaked in bubble juice and put it in there and then blow smoke into that bubble so you could see it.
Dave Bittner: Yeah.
Joe Carrigan: That is the closest thing to a shaped bubble I'd ever seen. And one of the things, when he would talk, he would talk about how bubbles have to be spherical because there's no other choice for it. They have to be spheres because of how the physics works around it.
Dave Bittner: Sure.
Joe Carrigan: And he says, but if you know when they join, you see that they have a flat side. So he leveraged that.
Dave Bittner: I always thought, like, what a unique bar trick, right?
Joe Carrigan: Right.
Dave Bittner: Can you imagine this guy going into a bar and just betting, I bet you I can make a square bubble. So this guy never paid for a beer.
Joe Carrigan: Yeah.
Dave Bittner: But also probably didn't attract the ladies very much at the bar [laughter].
Joe Carrigan: That's like me and my magic tricks, you know. Hey, look at this. Hey, is that a quarter behind your ear? Pick a card, any card. Get away from me, you weirdo.
Dave Bittner: Right, exactly. All right, well, we will have a link to my story in the show notes. I tell you what, let's take a quick break here. We will be right back after this message. [ Music ] And we are back. Joe, what do you got for us?
Joe Carrigan: I got two stories today, Dave, because they're both kind of short.
Dave Bittner: Okay.
Joe Carrigan: My first story actually comes out of WRAL News. And we're not going to put a link to that story in the show notes because it's kind of localized.
Dave Bittner: Okay.
Joe Carrigan: And it has some information that is not germane to the global audience. But, you know, if you just go to WRAL and look for the scam heat map. That's the story, is that in May, the Better Business Bureau, the BBB, brought back their scam tracker feature, or on their scam tracker feature, they brought back the heat map. So you can click on the link in this story, and we'll put the link to this in the show notes, the heat map from the Better Business Bureau, and this is a map of, it's a data analysis or data visualization tool for all the data that gets reported to the Better Business Bureau. So this is only their data. It doesn't represent all the data in crimes, or in scams, but assuming that it's a representative sample, which is a big assumption. That assumption is doing a lot of heavy lifting here.
Dave Bittner: Right. I'm looking at this right now and I'm wondering what the heck's going on in Kentucky.
Joe Carrigan: Yeah, Kentucky has an incident rate of 0.2 per 1000 residents, which is not the highest. I think the highest on the 90-day timeline is Idaho, which has 0.23. So, but Kentucky, you can click on a state, which is really cool. So let's pick on Kentucky some more.
Dave Bittner: All right.
Joe Carrigan: But you can see there's Number 8 in the ranking of 51 reporting locations here. They have a total of 904 reports for the last 90 days, totaling $1.3 million in losses.
Dave Bittner: Wow.
Joe Carrigan: Which means that per 1000 residents, that state has lost $284 to scams. I mean, interesting way to look at the data. I don't know how helpful this is. The story from WRAL says now people in states can track how they're doing over time. And I'm like, not really with this tool. It's an interesting snapshot for looking at, like, last 12 months, last 90 days, last 30 days.
Dave Bittner: Yeah.
Joe Carrigan: And then it has all time. The all-time data is kind of interesting because it changes the kind of scam that has been popular. Like, the number one scam in Kentucky in all time was debt collection scams. But if you come down to, like, the last 90 days, that's going to switch to online purchases, which generally tends to be, in my cursory exploration of this tool, the number one scam across the board recently. So there, I don't know what's caused debt collection to drop as a scam. Probably some --
Dave Bittner: People not answering their phones.
Joe Carrigan: Right, people not answering their phones.
Dave Bittner: Right, right. Well, and also, I'd say online purchase as a category is a pretty big umbrella.
Joe Carrigan: Right, right. And that's probably only gone up in... I mean, I guarantee you that's only gone up in the past 10, 15 years. And I don't know how long this data goes back for.
Dave Bittner: Yeah.
Joe Carrigan: Anyway, cool tool. Check it out.
Dave Bittner: Yeah, that's fun.
Joe Carrigan: We'll put a link in the show notes. The other story I have today comes from Interpol, which has an amazing story. They have made over 5800 arrests and seized $293 million in a global fraud bust. And this comes from Lyon, France. And how's my French?
Dave Bittner: Not good.
Joe Carrigan: Okay. So Interpol got together with 90, had 97 participating countries, which is a huge international effort. And they have arrested 5811 people and seized this $293 million in illicit assets. And they called this Operation First Light. It ran from January of this year to late April of this year. And they were focusing on combating social engineering scams and the associated money laundering that goes on around it. So the way this worked was they did an initial period of intelligence collection and getting information together and talking with each other. Just participating countries took three months of operational activities, and they were proactively going against high-value targets, so they knew who they were going after. You know, they prioritized the big offenders. They used Interpol's Global Rapid Response, Global Rapid Intervention Payment, Intervention of Payments, or IGRIP, which means, you know, I'm butchering that acronym, but it's a stop payment mechanism that facilitates the swift blocking of illicit financial flows. Which is, and they say here that it can block both fiat and virtual currencies. One of the things they say in here is that they seized cryptocurrency from someone's virtual wallet, which is probably not 100% correct. They probably seized that money from an exchange rather than from a wallet, because unless you get the actual wallet, because the wallet is what holds the private keys. And if this is on a personal wallet and that guy's out there and you don't have him in custody and can't extract the keys from him through, like, I don't know, rubber hose cryptography, which is my favorite. That is actually a term of art. It's one of my favorite terms of art. I can break any crypto system if I have the guy that knows the secret and I have a rubber hose. I just hit him with this rubber hose until he tells me what it is. And they analyzed, these numbers are impressive. They analyzed over 150,000 cases. They seized the assets from 31,000 bank accounts, or 31 bank accounts that were blocked, rather. They solved 23,000 cases, which sounds like they got about one-sixth of the cases. That is, I'm impressed by that number. That's pretty good. They also identified 15,000 suspects. So again, they arrested about a third of them. And they have 99 notices and diffusions issue. I don't know what a diffusion is.
Dave Bittner: No, I don't. Maybe it's a note to telling someone they need to break up their operations. They need to diffuse it.
Joe Carrigan: Maybe.
Dave Bittner: I don't know. That's just a guess.
Joe Carrigan: One of the things that impressed me is there is a small, or I was interested in, there's a small country in Africa, the south of Africa, it borders on South Africa, called Eswatini, that was a location for a lot of these scammers they arrested. And they have pictures in this article. There is a scam center in Sri Lanka that's being busted, and then they have the Eswatini pictures where they have seized 240 electronic devices, foreign currency, and a realistic replica of a Brazilian police station complete with fake uniforms and signage. So, I mean, these guys in the southern part of Africa were probably trying to fake, you know, trying to simulate, hey, we're the Brazilian police and you need to send us money.
Dave Bittner: Right, right. So you're on some Zoom call with somebody and you see Brazilian police officers strolling around in the background. Make it look like a Brazilian police station.
Joe Carrigan: Right. So in Eswatini alone, they arrested 82 people.
Dave Bittner: Wow.
Joe Carrigan: Which is really good. They also had people in Thailand. They made two arrests in Thailand. Singapore and Oman utilized the IGRIP to block $6.6 million in illicit transfers. There's a lot of details in this country, or in this article. But one of the interesting things is there's a Note to Editor in the bottom of this and it says, "Operation First Light is funded by China's Ministry of Public Security and supported by the participation of three regional policing bodies included ASEANAPOL, GCCPOL, and Europol." So, and then they go on to list all the 97 countries that are involved. And it's a "Who's Who" of people. Costa Rica's in there. The United States is also one of the participants in this.
Dave Bittner: Yeah.
Joe Carrigan: Vietnam, Zimbabwe, Zambia, a lot of countries in Africa, a lot of countries in Europe. I mean, it's an interesting list.
Dave Bittner: Yeah, it is. And interesting that China took the lead here in funding it.
Joe Carrigan: Yeah. Well, you know, China's been taking the lead on a lot of this stuff. And good for them. You know, I'm happy to see that. They have, and one of the reasons they're taking the lead on it is because their people are getting hurt by these scam centers.
Dave Bittner: Yeah.
Joe Carrigan: And that doesn't reflect well on the government. And I'm glad to see this kind of a bust. I'm glad to see that 5800 of these people are going to get arrested. And you know what happened to those scam center operators that were extradited to China?
Dave Bittner: Yeah. A lot of... yeah.
Joe Carrigan: They won't be scamming anybody ever again, let's just say that.
Dave Bittner: No. No. I guess the one thing that I always wonder about with these sorts of things, because like you, I look at this and I think this is great. There's all these, these numbers are big and they've gotten a lot of money and a lot of people and they've shut down things, but it's hard to know what to compare it against, right? Like, how big a chunk of the global market are they actually shutting down? How much do the other operators take note of this --
Joe Carrigan: Yeah.
Dave Bittner: -- and maybe change their ways or decide to get into a different business?
Joe Carrigan: Go legit.
Dave Bittner: Yeah, I just don't know the answer to that.
Joe Carrigan: I don't think anybody does.
Dave Bittner: Right.
Joe Carrigan: And I think that's part of the problem.
Dave Bittner: I hope it makes a big difference.
Joe Carrigan: But I guarantee you this $293 million of illicit assets they seized, that is a small fraction of what these people have taken.
Dave Bittner: Yeah.
Joe Carrigan: These people have probably taken billions. I mean, there's 15,000 of them.
Dave Bittner: Yeah. Well, I think they should create a grant program for podcasts that help prevent scams.
Joe Carrigan: I agree with you 100%, Dave.
Dave Bittner: Take some of that acquired, those ill-gotten gains.
Joe Carrigan: You know what? We'll just take 1/10 of it. We don't want much.
Dave Bittner: No, we're not greedy.
Joe Carrigan: We'll just take $29 million.
Dave Bittner: Sure, we'll put it to good use.
Joe Carrigan: Yeah.
Dave Bittner: Say the Joe, Dave, and Maria Institute for Scam Fighting.
Joe Carrigan: Right.
Dave Bittner: Be like our Hall of Justice.
Joe Carrigan: Yeah, that's right. We'll build a Hall of Justice, Dave.
Dave Bittner: That's right. Love it. All right, we will have links to Joe's stories in the show notes. And of course we'd love to hear from you. If there's something you'd like us to consider for the show, please do email us. It's hackinghumans@n2k.com. All right, Joe, it is time for our "Catch of the Day". [ Soundbite of reeling in fish line ] [ Music ]
Joe Carrigan: Dave, our "Catch of the Day" comes from the Scambait subreddit. "These TikTok scam accounts are literally so stupid", is the title of this post.
Dave Bittner: Okay, I'll lead us off here.
Joe Carrigan: Okay.
Dave Bittner: Just you and me today.
Joe Carrigan: Okay, so everybody's going to have to listen to me stammer my way through this.
Dave Bittner: Here we go. So this claims to be from the official Noah Kahan live chat. Now, Joe, do you know who Noah Kahan is?
Joe Carrigan: I do not know who Noah Kahan is.
Dave Bittner: I did not either.
Joe Carrigan: Okay.
Dave Bittner: So I looked up Noah Kahan, and Noah Kahan is a musician, and quite talented, quite well-known, has a lot of fans.
Joe Carrigan: I'm looking at him now. He's a good-looking dude.
Dave Bittner: Legit celebrity.
Joe Carrigan: Yep.
Dave Bittner: All right. Now, just because you and I don't know about him, we're old.
Joe Carrigan: Yes, we're old. I was just going to say that, Dave. There's a reason we don't know who this is.
Dave Bittner: He probably started putting his music out sometime after the year 2016, which means it's just off my radar.
Joe Carrigan: Right.
Dave Bittner: Okay, so it starts off as if it were Noah saying, "Hey dear. I kindly appreciate you for being a great fan. I got too many messages and comments on my official page, so I isolated myself here to reach out to my fans. What's your favorite song of mine? God bless you."
Joe Carrigan: Amazing, so cool. I can't believe you're messaging me. I think my favorite song by you is probably "Fruit Salad". I'm going to guess that's not one of his songs.
Dave Bittner: So I looked it up. He does not have a song called "Fruit Salad".
Joe Carrigan: Okay.
Dave Bittner: And what do you think of when you hear the song "Fruit Salad", Joe? The Wiggles? Is it the Wiggles?
Joe Carrigan: No, I don't... We were never Wiggles fans in our house.
Dave Bittner: Oh, you're so lucky, Joe. Yeah. Because when I hear "Fruit Salad" in a song, Fruit Salad, yummy, yummy. Does that mean anything to you?
Joe Carrigan: No. No, I'm fortunate.
Dave Bittner: You're so lucky to not have it.
Joe Carrigan: That's the one Australian show that didn't make it into my house.
Dave Bittner: If Maria were here, she'd be...
Joe Carrigan: Give me a "Bluey" song, I'll sing it.
Dave Bittner: Okay. So Noah goes on. "How's the family? I hope all is well. I really want to appreciate you because without you, my fans, I won't be where I am today. Thank you once more."
Joe Carrigan: I'm groovy and glad to be a big fan of yours. Do you like the song "Fruit Salad"? What's your favorite song that you've written?
Dave Bittner: Thank you so much, that really means a lot. "Fruit Salad" has such a fun vibe. As for my favorite, it's "Stick Season". The lyrics and emotion are really incredible.
Joe Carrigan: Wabbit season. Come on, Dave, you're not doing --
Dave Bittner: Stick Season!
Joe Carrigan: Wabbit Season!
Dave Bittner: Stick Season! So, he does actually have a song called "Stick Season".
Joe Carrigan: Okay.
Dave Bittner: I believe also an album called "Stick Season". So whatever bot this is did their homework.
Joe Carrigan: Right.
Dave Bittner: Where are you from, my dear?
Joe Carrigan: I'm from Las Vegas. I'm a stripper at a club there. You can come see me dance when you're there for your show tomorrow.
Dave Bittner: By the way, I hope you're not a journalist.
Joe Carrigan: Nope, Noah, I'm a stripper.
Dave Bittner: Why I asked is because I'm being careful. I've been hurt times without numbers from these journalists out there who pretend to be a fan and end up faking stories about me.
Joe Carrigan: No, no, I would never, Noah Thee. I too have been hurt by people pretending to be Noah Kahan. And other celebrities, I know what that's like.
Dave Bittner: I was told that there are imposters here trying to be me. That's the reason why I messaged you here. I would like us to talk somewhere else, because I don't usually use this account for fan chat, but you are a nice person.
Joe Carrigan: I can only imagine how painful it is for you to have people do identity theft to you. You're so cool with all your music and huge hits, like, I set my friends on fire. I died in a tent. My cat threw up in the litter box. And so much more. These are all great song names. You're an inspiration to many folks out there.
Dave Bittner: Thank you so much. That truly means a lot to me. I'm, really grateful for your support. It keeps me going. I would like to talk to you every day whenever I'm not busy.
Joe Carrigan: Okay, I'm going to stop here for a second because these songs, I mean, this is obviously somebody messing with --
Dave Bittner: Sure.
Joe Carrigan: I mean, nobody makes songs like this, except maybe some death metal band probably has songs like my dying to 10. But I mean, he just skips over, just keeps going, this scammer or bot, probably bot. I don't know.
Dave Bittner: Yeah. Yeah. Just as if it never happened.
Joe Carrigan: Right. So anyway, the scambaiter then says, you are always busy, though. You're on here right now, so you'll be busy every day. You're on tour right now. That's what that should be.
Dave Bittner: Okay.
Joe Carrigan: You are always busy, though. You're on tour right now, so you'll be busy every day my sweet little Noah bean.
Dave Bittner: I love this.
Joe Carrigan: Please put another album out. I love your new album. My Spanx are too tight on my PP [laughter].
Dave Bittner: I'd love for us to chat on Zengi so we can have private conversations there. Do you have Zengi?
Joe Carrigan: I don't know what that is. I need you to prove you're really Noah first. I'll do that over there. I'm not used to chatting on TikTok, and I don't want my manager to know that I'm communicating with a fan on TikTok.
Dave Bittner: I do not have access to that app. I just looked. I have a flip phone, so I only have TikTok. I don't think TikTok is on flip phones? All right, we'll wrap it up there. Yeah, so, I mean, there's obvious stuff here that we call out which is trying to move someone to another platform.
Joe Carrigan: Right.
Dave Bittner: Right, impersonating a celebrity.
Joe Carrigan: Yep.
Dave Bittner: Flattering the victim, trying to move them to another platform.
Joe Carrigan: And the flattering in these things always starts surprisingly early, right? You know --
Dave Bittner: Right. Right.
Joe Carrigan: It's, it starts, "Hey dear". The very first two words. I kindly appreciate you for being a great fan, and it's, I mean, ugh.
Dave Bittner: Yeah, but it's hilarious and I guess demonstrative how it doesn't matter what the scambaiter says, right? I love your new album. My Spanx are too tight on my pp, right?
Joe Carrigan: The guy just keeps going.
Dave Bittner: Just, just, yeah, which again means it's either a bot or just someone who I'm guessing has 20 of these windows open.
Joe Carrigan: Right.
Dave Bittner: Doesn't have time.
Joe Carrigan: And they're just copying and pasting responses in?
Dave Bittner: Right. It's likely that English is not their first language. Like, you know, there's just, there's all kinds of things going on. This person is running a volume game.
Joe Carrigan: Right.
Dave Bittner: And just trying to keep going. So, oh, so funny.
Joe Carrigan: Yeah, so funny.
Dave Bittner: All right. Well, we will have a link to that in our show notes. And of course we would love to hear from you. If there's something you'd like us to consider for our "Catch of the Day", please do email us. It's hackinghumans@n2k.com. [ Music ] And that is our show brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. We're mixed by Elliott Peltzman and Tre Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
Joe Carrigan: And I'm Joe Carrigan.
Dave Bittner: Thanks for listening. [ Music ]
