Scammers have no ethics whatsoever.

Chris Parker: [00:00:00] People who are out to commit scams really have no ethics whatsoever, and they're gonna do whatever they can do to make a buck.

Dave Bittner: [00:00:09] Hello everyone, and welcome to the CyberWire's Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner from the CyberWire, and joining me is Joe Carrigan from the Johns Hopkins University Information Security Institute. Hello Joe.

Joe Carrigan: [00:00:27] Hi Dave.

Dave Bittner: [00:00:28] Got some good stories to share this week. And later in the show, we've got my interview with Chris Parker. He runs WhatIsMyIPAddress.com, and he's got a lot of interesting stories about people coming to him with scams.

Dave Bittner: [00:00:40] But first, a word from our sponsors at KnowBe4. So, who's got the advantage in cybersecurity? The attacker or the defender? Intelligent people differ on this, but the conventional wisdom is that the advantage goes to the attacker. But why is this? Stay with us and we'll have some insights from our sponsor, KnowBe4, that puts it all into perspective.

Dave Bittner: [00:01:08] And we are back. Joe, you want to kick things off for us this week?

Joe Carrigan: [00:01:11] Yes, I have a very interesting article that doesn't necessarily have to do with a scam, but it does have to do with how we perceive things.

Dave Bittner: [00:01:17] Okay.

Joe Carrigan: [00:01:17] It is from Gustav Kuhn, who is a psychologist and a magician, and he's written this article over at Nautilus. We'll put a link in the show notes.

Dave Bittner: [00:01:24] Okay.

Joe Carrigan: [00:01:24] The article talks a lot about perception - he goes into driving later on - but I'm going to focus on the first half, because the first half is what I think is fascinating. There was a man named Norman Triplett who studied the psychology of magic. And in 1900, he published a scientific paper on magic that discusses an experiment on a group of schoolchildren.

Dave Bittner: [00:01:41] Okay. Over a hundred years ago.

Joe Carrigan: [00:01:42] Over a hundred years ago. Right.

Dave Bittner: [00:01:44] Okay.

Joe Carrigan: [00:01:45] A magician sat at a table with children around him and threw a ball in the air a few times. Before the final throw, he secretly put his hand below the table and dropped the ball into his lap, and then threw the ball up in the air again.

Dave Bittner: [00:01:57] So he went through the motions.

Joe Carrigan: [00:01:58] Correct.

Dave Bittner: [00:02:00] Okay.

Joe Carrigan: [00:02:00] It's not a real clever trick, right?

Dave Bittner: [00:02:01] Yeah.

Joe Carrigan: [00:02:02] But more than half the children claim to have seen an illusionary ball leave the magician's hands and disappear somewhere midway between the magician and the ceiling.

Dave Bittner: [00:02:11] Really?

Joe Carrigan: [00:02:11] Really.

Dave Bittner: [00:02:12] Huh.

Joe Carrigan: [00:02:12] No ball had left his hand. The ball was in his lap. The children had perceived an event that did not happen, which is interesting.

Dave Bittner: [00:02:19] Yeah. So what's going on here? Are we just playing on expectations?

Joe Carrigan: [00:02:21] Triplett, when he wrote the paper, said it was retinal afterimages.

Dave Bittner: [00:02:26] Okay.

Joe Carrigan: [00:02:26] He thought there was a physiological reason for this, right? We all get retinal afterimage...

Dave Bittner: [00:02:30] Sure.

Joe Carrigan: [00:02:30] ...Particularly if you're driving into the sun, you have the sun burned into your retina, right?

Dave Bittner: [00:02:33] Yeah, yeah.

Joe Carrigan: [00:02:34] But Kuhn was skeptical about Triplett's explanation.

Dave Bittner: [00:02:38] Okay.

Joe Carrigan: [00:02:38] So, the illusion relies on misdirecting the audience's expectations, so they anticipate you throwing the ball for real.

Dave Bittner: [00:02:44] Right.

Joe Carrigan: [00:02:45] Where you look provides the most powerful tools of misdirection. Hmm.

Joe Carrigan: [00:02:49] Right? So, Kuhn recorded two different versions of the vanishing ball illusion. One, where he threw the ball in the air twice before secretly palming the ball, and then pretending to throw the ball, but following where the ball would go with his gaze, right?

Dave Bittner: [00:03:03] Ah.

Joe Carrigan: [00:03:02] And a second, where, when he palmed the ball, he stared at his hand that held the ball.

Dave Bittner: [00:03:07] Okay.

Joe Carrigan: [00:03:08] He showed each video to a group of test subjects - different subjects. Because it's a modern time, Kuhn had the ability to measure the participants' eye movement, and that comes into play later...

Dave Bittner: [00:03:17] Okay.

Joe Carrigan: [00:03:17] ...For when they're watching the video. It's pretty impressive. Nearly two-thirds of the participants - these are adult participants...

Dave Bittner: [00:03:24] Right.

Joe Carrigan: [00:03:25] ...Who watched the first video claimed they saw him throw a ball the third time, or the final time. The illusion was far less effective when he looked at his hand. But when he didn't look at his hand, two-thirds of the participants fell for the trick. And they're adult participants, not children.

Dave Bittner: [00:03:40] That's interesting.

Joe Carrigan: [00:03:41] When he asked them how they thought the trick had been done, people went on to say somebody caught the ball out of frame, or it stuck to the ceiling. This was so compelling that when people watched the video again, and had been told that the ball was never thrown the third time, people who believed the ball was thrown, and believed they saw a ball, were absolutely astonished that the ball had not been thrown.

Dave Bittner: [00:04:00] I thought you were going to say they thought that the video had been altered or something.

Joe Carrigan: [00:04:02] That they may have suspected that.

Dave Bittner: [00:04:04] Yeah.

Joe Carrigan: [00:04:04] There's another video that this reminds me of, where there's people passing a basketball and you're supposed to count how many times the ball is changing hands...

Dave Bittner: [00:04:11] Yep.

Joe Carrigan: [00:04:12] ...And then they say, did you notice the guy in the bear suit dancing through the scene?

Dave Bittner: [00:04:14] Yeah, I've seen one with a gorilla.

Joe Carrigan: [00:04:15] A gorilla suit - maybe it's a gorilla suit.

Dave Bittner: [00:04:17] Yeah, yeah. Uh-huh.

Joe Carrigan: [00:04:18] Amazing.

Dave Bittner: [00:04:19] Yeah.

Joe Carrigan: [00:04:19] It's the same kind of thing. Basically, what Kuhn found is that Triplett's idea of this being a physiological thing is wrong, because if it was a physiological event, then both groups of participants should have seen the ball. But it has to do with where you're looking and how we work as humans...

Dave Bittner: [00:04:35] Mm-hmm.

Joe Carrigan: [00:04:34] ...And how our expectations are leading us in a way that might not be correct.

Dave Bittner: [00:04:40] That's fascinating.

Joe Carrigan: [00:04:41] Here's the interesting part.

Dave Bittner: [00:04:42] Okay.

Joe Carrigan: [00:04:42] Once people knew how the trick worked, they didn't fall for it anymore.

Dave Bittner: [00:04:46] Ah, they were inoculated.

Joe Carrigan: [00:04:46] They were inoculated.

Dave Bittner: [00:04:47] Okay. Go on.

Joe Carrigan: [00:04:48] Another fascinating part was, when he asked where people were looking, they thought they were looking at the ball. But when he looked at the eye data that he was tracking - the eye movement data - they were actually watching his face more often than the ball.

Dave Bittner: [00:04:59] Huh.

Joe Carrigan: [00:05:01] Which is where they were getting their clues from.

Dave Bittner: [00:05:03] That is interesting. You know, one thing it reminds me of is that when someone's learning to juggle...

Joe Carrigan: [00:05:07] Uh-huh.

Dave Bittner: [00:05:07] ...Juggle three balls - can you juggle three balls?

Joe Carrigan: [00:05:09] I cannot.

Dave Bittner: [00:05:10] I can. I can learn to juggle - or I have learned to juggle three balls. I think learned it back in elementary school. But one of the tricks to learning how to juggle is, when you toss the ball, is to only look at the apex of the arc of the ball.

Joe Carrigan: [00:05:24] Right.

Dave Bittner: [00:05:25] So don't follow the balls with your eyes, just look at where the ball reaches its apex point and when it starts to fall. Because when you watch the apex, you know where that ball is going to land. You don't need to follow - track that ball.

Joe Carrigan: [00:05:38] Right. That's enough that's enough information for your brain to interpret the parabola that the ball is following.

Dave Bittner: [00:05:42] Exactly. Exactly. And so, I wonder - I mean, this reminds me kind of of that. You think you may have to look somewhere, but you don't. I saw an interview with a pickpocket magician...

Joe Carrigan: [00:05:51] Mm-hmm.

Dave Bittner: [00:05:51] ...His thing was getting your watch off of you, or getting your wallet off of you, without you knowing it.

Joe Carrigan: [00:05:56] Right. Yep.

Dave Bittner: [00:05:57] And he made the point that he learned that his movements were very important as to whether he could get away with something. In other words, if he moved his hand in a straight line, someone was much more likely to notice what he was up to than if he moved his hand in an arc. There's something different in the way we track movements and what gets our guard up.

Joe Carrigan: [00:06:18] I would imagine that a straight line looks more offensive. I don't know like a punch coming in.

Dave Bittner: [00:06:22] Yeah, I don't know. Who knows?

Joe Carrigan: [00:06:23] Maybe. I don't know. I would like to see some study on that. That's my speculation.

Dave Bittner: [00:06:26] Yeah.

Joe Carrigan: [00:06:26] I have a great story about things like this. My dad and my uncle Tom used to do this great trick with a paper bag.

Dave Bittner: [00:06:31] Okay

Joe Carrigan: [00:06:32] And they'd do it with kids, where you have a paper bag and you're holding it in between your thumb and your first two fingers...

Dave Bittner: [00:06:36] Okay.

Joe Carrigan: [00:06:37] ...And you reach into the bag, and you act like you grabbed something, and you throw it up in the air, and then you move the bag like you're gonna catch it, and then you snap. But because you snap with the bag in your hand, it sounds like something has hit the bottom of the bag.

Dave Bittner: [00:06:49] Okay.

Joe Carrigan: [00:06:50] So, they used to do this to us all the time when we were kids. And my Uncle Tom tells a story, when he was in the Air Force, he was in a hangar, which is a big open building...

Dave Bittner: [00:06:56] Right.

Joe Carrigan: [00:06:57] ...With some supply sergeant sitting at his desk, and the supply sergeant was eating his lunch, and had finished emptying his brown paper bag. And my uncle grabs the paper bag, says, oh, there's still something in here, reaches into the bag, pulls out the imaginary object, hurls it all the way up - you know, there's nothing, he's not hurling anything...

Dave Bittner: [00:07:14] (Laughs) Right.

Joe Carrigan: [00:07:14] But throws it up in the hanger, and then like runs over to another side of the hanger and snaps his finger, and puts the bag back on the sergeant's desk and starts walking out, and he hears the guy behind him look in the bag...

Dave Bittner: [00:07:24] (Laughs).

Joe Carrigan: [00:07:29] ...To see what was in there.

Dave Bittner: [00:07:29] And that's why he got a dishonorable discharge.

Joe Carrigan: [00:07:32] He was on a roll. (Laughs).

Dave Bittner: [00:07:35] Yeah. Well, and I think, you know, we talk about all these stories week after week, where people are playing on your expectations.

Joe Carrigan: [00:07:41] Exactly, and that's what this is. But my favorite part about this is two things: one, people didn't know where they were looking. They thought they were looking at the ball, but they were looking at his face. And two - and this is why we do this show - once people knew the trick, they couldn't be tricked by it anymore.

Dave Bittner: [00:07:56] Mm-hmm. Yeah. I remember the same thing - we were talking about that thing with passing the basketball and the gorilla.

Joe Carrigan: [00:08:00] Right.

Dave Bittner: [00:08:01] Once you see the gorilla...

Dave Bittner: [00:08:01] You always see the gorilla.

Dave Bittner: [00:08:03] ...How could I not have seen - there's a gorilla there! How did I miss the gorilla? But you missed the gorilla.

Joe Carrigan: [00:08:08] Right.

Dave Bittner: [00:08:08] I'll try to find a version of that video and we'll stick it in the show notes as well. It's a well-known one.

Joe Carrigan: [00:08:14] Well, now everybody knows that the gorilla is there.

Dave Bittner: [00:08:16] Yeah, right. Oh well.

Joe Carrigan: [00:08:17] Well, you know, what you do, is you ask someone who hasn't heard the podcast. Watch their reaction.

Dave Bittner: [00:08:21] Right, get a friend...

Joe Carrigan: [00:08:22] Yeah.

Dave Bittner: [00:08:22] ...A friend to do it. Yep. All right. Well, that's a good story Joe. My story this week is about a woman who is using her technical skills and some social engineering for good.

Joe Carrigan: [00:08:32] Awesome.

Dave Bittner: [00:08:33] Now, you and I, certainly we've been to our share of social events, to parties, and things like that and...

Joe Carrigan: [00:08:39] Yes.

Dave Bittner: [00:08:40] ...Probably when we were younger men, we would go to some of these parties, perhaps hoping to meet someone, maybe ask them out on a date, or get to know someone. Maybe find a new girlfriend, something like that.

Joe Carrigan: [00:08:50] Something like that, yes.

Dave Bittner: [00:08:50] Yeah, and the problem is, for a lot of women who go to social events, there are guys who just don't know how to take no for an answer.

Joe Carrigan: [00:08:58] Right.

Dave Bittner: [00:08:58] They don't get the message, and they're just too aggressive and they won't go away. And this causes a problem for women - I imagine for some men too, but mostly I think we can agree this is a problem that...

Joe Carrigan: [00:09:08] Yeah, generally, men won't regard this as a problem, in my experience.

Dave Bittner: [00:09:11] (Laughs) Well, that's true. That's a good point.

Joe Carrigan: [00:09:14] But women, I absolutely understand. I've seen - I used to hold a lot of parties in college, and yeah, it was very common, and I even had to ask people leave at times.

Dave Bittner: [00:09:22] Yeah. A lot of times, women will say - whether or not it's true - they'll say, hey, I have a boyfriend, bug off.

Joe Carrigan: [00:09:27] Right.

Dave Bittner: [00:09:28] Right. So, there's a woman named Chloe Condon, and she works for Microsoft. She's a cloud developer advocate there. She has developed an app that is a fake boyfriend app. And what this app does is, she uses it - she has a little Bluetooth device that she can keep in her pocket, and basically she presses a button on this Bluetooth device - it's a Bluetooth device called a "Flic," which is a little Bluetooth trigger. And when she presses a button on the Flic, her phone rings. And guess who the call's from?

Joe Carrigan: [00:09:58] It's from her boyfriend.

Dave Bittner: [00:09:59] From her boyfriend. (Laughs).

Joe Carrigan: [00:09:59] That's awesome.

Dave Bittner: [00:10:01] Yes. Who is a handsome strapping man...

Joe Carrigan: [00:10:04] Right, that nobody can compete with, right?

Joe Carrigan: [00:10:06] That's right. Absolutely. "Well, my boyfriend, I can even show you a picture of him." "That's David Beckham."

Dave Bittner: [00:10:12] Yeah, that is my boyfriend. So, I'm going to play this message. This is the message that it plays.

Joe Carrigan: [00:10:15] All right.

Unknown Voice: [00:10:16] Call me, because I'm your boyfriend. Please call me as soon as you can. It is very urgent. (Music)

Joe Carrigan: [00:10:23] Rickroll.

Dave Bittner: [00:10:30] Well, yes. She put the rickroll in there just for fun, and hopefully whoever she's fooling with this boyfriend thing doesn't hear it.

Joe Carrigan: [00:10:40] Can you record a different sound?

Dave Bittner: [00:10:42] No, no, no. This is her own thing, mostly for her own amusement.

Joe Carrigan: [00:10:44] Right.

Dave Bittner: [00:10:46] If you want to use it, she has a series of steps that you can put this together for yourself. But I love this. I think this is a great use of social engineering, where she's - this is tricking people for good. To someone who won't take no for an answer, bug off. No, actually I do have a boyfriend and, oh, look he's calling me.

Joe Carrigan: [00:11:03] Right.

Dave Bittner: [00:11:04] Yeah. Now, I actually went and looked on the App Store and, boy, there are a remarkable number of fake boyfriend apps.

Joe Carrigan: [00:11:10] Are there really?

Dave Bittner: [00:11:11] Well, not so much this sort of thing, but boyfriend simulators.

Joe Carrigan: [00:11:14] Boyfriend simulators.

Dave Bittner: [00:11:15] Yeah. Use your imagination what that means...

Joe Carrigan: [00:11:17] I don't know...

Dave Bittner: [00:11:18] ...There's a big variety of what the possibilities are for that. But, you know, there's an app for everything, Joe.

Joe Carrigan: [00:11:24] Yes (Laughs). There's an app for that.

Dave Bittner: [00:11:26] At any rate, congratulations to Chloe Condon for coming up with this idea. I think it's a good one. And that is my story this week.

Joe Carrigan: [00:11:34] I like it.

Dave Bittner: [00:11:35] All right, Joe. It's time to move on to our Catch of the Day. Our Catch of the Day this week comes from a listener named Mike. He wrote in and he said, "Saw this in my spam filter before hitting delete and had a chuckle while I read through. Thanks for the great work you guys are doing. It's made me much more aware of what's going on, and even allowed me to poke fun at co-workers when they got caught clicking on links sent by our own company to test our gullibility. I did not click, and I think a good part of the reason why was as a result of listening to your show. Thank you, Mike." All right. Well, thank you Mike for that kind note. And here is how the email reads.

Dave Bittner: [00:12:12] "My name is William Allen. I am the manager of MoneyGram department in Bank of African. I am here to inform you that a man came to our office this morning. His name is James Mike. He told us that he is your brother living in London. He said that you are dead accident about two months ago on your way going to work and before your death, you told him that you have fund worth of 3.5 million dollars cost of seventy-five dollars to receive the fund worth of 3.5 million dollars, and he came here with the one hundred fifty dollars for the activation this your reference number to pick up your first payment of five thousand dollars today. If real you are dead, may your soul rest in perfect peace. Amen. But if you were alive, please do get back to us with seventy-five dollars activation fee of reference number today, and pick up your first payment of five thousand dollars today okay.

Joe Carrigan: [00:13:01] Pause. (Record scratch) Dave.

Dave Bittner: [00:13:02] Yeah?

Joe Carrigan: [00:13:02] I have no idea how you read these like this.

Dave Bittner: [00:13:05] (Laughs)

Joe Carrigan: [00:13:05] This is such terrible English - I could not get through this. It has to flow well for me to be able to read it...

Dave Bittner: [00:13:11] Yeah.

Joe Carrigan: [00:13:11] ...And you're sitting there reading this perfectly.

Dave Bittner: [00:13:12] Thank you. I just disconnect my brain and just let the words just come out.

Joe Carrigan: [00:13:17] (Laughs)

Dave Bittner: [00:13:18] Yeah.

Joe Carrigan: [00:13:18] You don't think about what you're saying.

Dave Bittner: [00:13:19] No, I can't. No, you can't.

Joe Carrigan: [00:13:20] You can't, because it would drive you crazy if you were doing this.

Dave Bittner: [00:13:23] Yes, crazier than I already am. It goes on!

Joe Carrigan: [00:13:25] Let's continue.

Dave Bittner: [00:13:26] If I did not hear from you today with the activation fee then I will collect the seventy-five dollars activation fee from Mr. James Mike, and give him this information to start pick your daily five thousand dollars from our MoneyGram office around. But if you still alive use this information to pick up you first payment of five thousand dollars next two hours after you send seventy-five dollars right now. Track it with our website. Below is the information to send the one hundred fifty dollars activation fee via MoneyGram transfer or Western Union Money Transfer and receive your first payment US five thousand dollars next two hours today. Have a wonderful day if you are alive, but if you are dead, may your soul rest in peace. Amen.

Joe Carrigan: [00:14:03] (Laughs)

Dave Bittner: [00:14:05] Because if you're dead...

Joe Carrigan: [00:14:06] (Laughs) Right.

Dave Bittner: [00:14:06] ..You're not going to be able to read this message. Well, at least they're polite.

Joe Carrigan: [00:14:13] Yes, and your - the man claiming to be your brother is going to get all the money.

Dave Bittner: [00:14:17] That's right. That's right. Absolutely. So you gotta beat your brother to get this money - whatever, millions of dollars.

Joe Carrigan: [00:14:24] That's amazing.

Dave Bittner: [00:14:25] I mean, I guess somebody ran something through some sort of translation filter or something.

Joe Carrigan: [00:14:30] "Bank of African." (Laughs) Is there a bank of Africa?

Dave Bittner: [00:14:35] What gets me is that it's not that hard, anywhere in the world, to find someone who speaks English.

Joe Carrigan: [00:14:40] Right.

Dave Bittner: [00:14:41] Was there no one around who they could run this by, to just give it a little polish?

Joe Carrigan: [00:14:47] You know, this doesn't surprise me, Dave. I get a lot of - sometimes I get products that have have been assembled elsewhere. I think I remember buying - it may have been a lawnmower that I had to assemble.

Dave Bittner: [00:14:57] Yeah.

Joe Carrigan: [00:14:58] And the assembly instructions for my lawnmower - which is a legitimate product that I paid real money for - were like this.

Dave Bittner: [00:15:05] (Laughs)

Joe Carrigan: [00:15:05] They were translated from some other language - probably Chinese, because I think that's where it came from.

Dave Bittner: [00:15:11] Yeah.

Joe Carrigan: [00:15:11] And they didn't even spend, you know, a thousand dollars to have an American proofread and edit it, because they're selling it in America.

Dave Bittner: [00:15:18] Yeah.

Joe Carrigan: [00:15:18] You know, I think that should be - there's a business model for you. Here's my free million-dollar idea to our listeners.

Dave Bittner: [00:15:24] (Laughs) Yeah.

Joe Carrigan: [00:15:24] Start marketing a service to, you know, that you already can provide, to foreign companies to proofread their instruction manual.

Dave Bittner: [00:15:30] Yeah, I'm sure that's out there. There's gotta - it's gotta be out there.

Joe Carrigan: [00:15:32] It's got to be out there, yeah.

Dave Bittner: [00:15:33] Yeah, yeah. I remember one back in the '80s, Sony got in trouble because they had a series of VCR that they were selling here, and the example in the manual for how to set the date - they used Pearl Harbor Day.

Joe Carrigan: [00:15:46] (Laughs) Was that the Japanese? (Laughs).

Dave Bittner: [00:15:49] Yeah, it was the Japanese.

Joe Carrigan: [00:15:51] Too soon (Laughs).

Dave Bittner: [00:15:50] Yeah, yeah. Bad form, bad form.

Joe Carrigan: [00:15:54] Right.

Dave Bittner: [00:15:55] All right. Well, that is our Catch of the Day. Thanks to Mike for sending that in. Coming up next, we've got my interview with Chris Parker. He runs WhatIsMyIPAddress.com. But first, a word from our sponsors at KnowBe4.

Dave Bittner: [00:16:09] Now let's return to our sponsor's question about the attacker's advantage. Why did the experts think this is so? It's not like a military operation, where the defender is thought to have most of the advantages. In cyberspace, the attacker can just keep trying and probing, at low-risk and low-cost, and the attacker only has to be successful once. And as KnowBe4 points out, email filters designed to keep malicious spam out have a 10.5 percent failure rate. That sounds pretty good. Who wouldn't want to bat nearly .900? But this isn't baseball. If your technical defenses fail in one out of ten tries, you're out of luck and out of business. The last line of defense is your human firewall. Test that firewall with KnowBe4's free phishing test, which you can order up at knowbe4.com/phishtest. That's knowbe4.com/phishtest

Dave Bittner: [00:17:09] And we are back. Joe, I recently had the pleasure of speaking with Chris Parker. He runs WhatIsMyIPAddress.com.

Joe Carrigan: [00:17:15] I use that site frequently.

Dave Bittner: [00:17:16] Yeah, it's a handy service. And he's got some stories to share. So here's my conversation with Chris Parker.

Chris Parker: [00:17:21] I started WhatIsMyIPAddress.com back in early 2000 - I think was actually January, so we're just a little bit over 19 years now.

Dave Bittner: [00:17:29] Hmm.

Chris Parker: [00:17:29] And it was originally designed to solve a technical issue I was having at a company I was working for. We were having problems with our internet connection. This was, you know, '90s - can't imagine ever that happening.

Dave Bittner: [00:17:41] (Laughs).

Chris Parker: [00:17:41] (Laughs) And, you know, we didn't know what our IP address was. And, you know, you'd get online, check AltaVista, because there was no Google then, Lycos, whatever. And there really wasn't an easy way to find out what our office public IP address was. And so I thought, you know, I can be clever. I have a little bit of programming experience. I've got an internet connection at home, and I've got an old Windows NT box. Let me put together a website that just answers that question. And that's how it started.

Dave Bittner: [00:18:09] It's hard to think back to a time when just that was difficult information to find, and so a utility like that would have been extraordinarily useful.

Chris Parker: [00:18:18] It was. And unfortunately at the time, I didn't realize it until many, many years later that it actually was profoundly useful for a tremendous number of people, and I found out by the hard drive getting full of the logs from the website. (Laughs)

Dave Bittner: [00:18:32] Oh wow. (Laughs) That's great. Wow, your popularity exceeded what you were expecting there.

Chris Parker: [00:18:39] Yeah, I think part of it was because it was never planned to be a business. It was never planned to be much of anything, except - this was a solution to a problem that I was having, and I thought, eh, other people are probably having the same problem, so let me just make a website that solves just that.

Dave Bittner: [00:18:53] So, let's fast-forward. We're almost twenty years past that. What's going on over there these days?

Chris Parker: [00:18:58] So, I've built a tremendous amount of content around educating people about privacy, security, online safety. It really alarmed me after a number of years, the contacts that I was getting from people. People wanting support, saying, hey, I've lost my life savings to this person I met online. I've never met them in person, but all I have is their IP address. Can you help me find them? And it was really kind of a devastating thing to hear people losing life savings, cashing in their retirement to help this poor person that they met online because they were having medical conditions, or their kid was in an accident. You know, when you look back at it as a third party, you go, oh my gosh, I can just see red flags all over the place. But once you get emotionally connected, people were just giving up everything. And at the end of it, they had nothing except for, well, I got an IP address from an email that we sent back and forth. Can we find the person from that?

Dave Bittner: [00:19:53] How do you respond to someone like that?

Chris Parker: [00:19:55] The answer is generally, unfortunately, you're probably not going to get any of your money back. And you're probably never going to see it. Because usually these people - least more recently - they're using VPNs, they're using Internet cafes, they're in third-world countries where, you know, the laws are going to make it a lot more difficult to find the person, even if you could find out who the Internet connection belonged to, you know, are you going to be able to find that person. Was it a burner cell phone that they were using? It's just really difficult these days. You've got to watch it on the front end.

Dave Bittner: [00:20:25] What are some of the scams that you've seen over the years?

Chris Parker: [00:20:29] Probably one of the more recent ones - I believe you guys have talked about - is those sextortion scams, where you're getting an email that says, hey, I've compromised your computer, and the way I've proven that I've compromised your computer is here is your password - which they've gotten one from one of those data dumps. And if you don't send me X amount of money via bitcoins, I'm going to post all the illicit videos that I've recorded from your computer of the sites that you've been visiting, and you don't want you and your whole family to be humiliated, so pay up.

Dave Bittner: [00:20:59] Now, you've had some personal experience - some folks have come after you as well.

Chris Parker: [00:21:03] Yeah, I definitely have had some personal experiences. One of the first websites I built, back in the late '90s, was an online bookstore, competing against Amazon - who'd have thought it?

Dave Bittner: [00:21:17] (Laughs) How'd that work out for you, Chris?

Chris Parker: [00:21:19] (Laughs) Definitely not well. They won the battle.

Dave Bittner: [00:21:21] (Laughs) I see, yeah, okay.

Chris Parker: [00:21:24] But this was back when I was in college and probably considerably more naive than now. The biggest order I got was someone wanting to ship Bibles to a church in Nigeria.

Dave Bittner: [00:21:37] Hmm.

Chris Parker: [00:21:38] And I thought, wow, this is awesome. I'm helping people out, I'm helping out missionary work. This is really cool. Yeah, I'll process that credit card, I'll go down to the FedEx depot with the FedEx number that they provided, and let me FedEx this to them halfway around the world. About a week later, I get a call from my bank saying this large charge has been rejected, refunded. In fact, it's fraudulent. And I was devastated. To me, it was, why would anyone want steal Bibles? That's just a horrible thing.

Dave Bittner: [00:22:11] Yeah, it's a little insult to injury there, isn't there?

Chris Parker: [00:22:13] It was definitely insult to injury. But that really gave me the realization that people who are out to commit scams really have no ethics whatsoever, and they're gonna do whatever they can do to make a buck. I mean, heck, I wish they would employ all this intelligence that they've got into constructive things, but they've applied it to destructive things. They're out to get whatever money they can from people. And they'll take advantage of emotions, they'll take advantage of you being a nice person. You know, often they take advantage of greed and fear, but they'll often go after people that are just trying to be good people.

Dave Bittner: [00:22:47] Back then, this was far enough back that I guess it wasn't widely known that any communication from someone from Nigeria could be a red flag.

Chris Parker: [00:22:55] Yeah. Even if those scams were going around of, hey, I've got fifty million dollars for you - well, that's an obvious scam. The person who wants to place an order - hey, that doesn't seem like an obvious scam. And so, even if there were - I mean, looking back at it now, you know, I see red flags all over the place about it - but at the time, it was I was excited. My business was growing. This is a good thing. And this never even crossed my mind that it was a scam.

Dave Bittner: [00:23:18] Now, you also had a run in with some folks who were hitting you on the advertising side of things.

Chris Parker: [00:23:24] Yep. And this was one that, in some sense, surprised me that I got taken for. Now, this was back in late 2012. I got approached by someone claiming to represent a reasonably well-known and reputable ad network platform, and, hey, we want to run ads on your site, and here's the amount that we're going to pay. And it wasn't so much that it was suspicious. It was, hey, that's a pretty good value. That's a little bit more than I'm making from other people, a little bit less than others. It wasn't this gigantic, oh my gosh, they're going to pay me triple or quadruple what other people were paying for ad space. It was right in the mix with what other reputable companies were doing. I looked at the website, yep, this is who these guys are. Emailed back and forth. Had a contract, had an insertion order, did all the the regular back and forth that you would do when making a business arrangement.

Chris Parker: [00:24:15] And he gave me a log in to reporting statistics, and after about a week, it just started seeming like these stats just seem a little wonky. This reporting feels a little weird, but not alarmingly so. This was kind of earlier days in ad tech, so a lot of people didn't have great platforms, but it wasn't so much alarming that it was a huge red flag. And then the platform started getting unstable, in terms of, I'd try to log into it, can't connect, it's down. I'd email the guy, uh, we're having technical problems on the front end. Don't worry, the backend's still tracking. And then he went dark. The website went down. The domain name wasn't resolving anymore. And I'm like, oh no. And I immediately shut them down on my side, started doing digging on my end, and found out that this guy had got the .net version of the company name, instead of the .com. And so he had, you know, set up - using a stolen credit card, had set up email, Web hosting, all with stolen credit cards. And he totally copied their site, page-for-page, exactly, but just on the .net instead of the .com.

Dave Bittner: [00:25:25] And in this case, what was he stealing? Was he stealing the space on your site that you would have otherwise sold to someone else?

Chris Parker: [00:25:32] Yeah, he was basically taking the ad space on my site, and he was getting the ad revenue for it.

Dave Bittner: [00:25:38] So he was brokering it.

Chris Parker: [00:25:39] He was brokering it, but he wasn't paying me.

Dave Bittner: [00:25:42] I see.

Chris Parker: [00:25:43] So, he disappeared well before invoicing, whatever, even got close. And kind of thing that that upset me about it is when I called the real company - I finally figured out, hey, there's someone impersonating you guys, you guys need to do something about it. They're like, well, we're fairly aware of who this person is. He's in a different country, and we just don't have the resources to go after him.

Dave Bittner: [00:26:05] Hmm.

Chris Parker: [00:26:05] So, it was like, oh yeah, we know this is happening, but, eh, oh well.

Dave Bittner: [00:26:09] Right.

Chris Parker: [00:26:09] I mean, totally at the time I was like, you need to get your lawyers on this you need to, you know, do everything that you can to shut this down. He's hurting your reputation. But the reality was they were being pragmatic about it. It was very unlikely that they would ever find this guy, very likely that he would never be convicted, and very hard to justify it when they haven't necessarily seen a financial loss.

Dave Bittner: [00:26:30] Right.

Chris Parker: [00:26:31] And on my side, I was initially like, well, fine, I'm going to go to war. I'm going to hire a lawyer. Luckily, I thought best of it, well, you know, I'm out a couple thousand dollars - maybe ten thousand dollars of ad revenue - but gosh, a lawyer's going to cost me a lot more than that. And if I never find it, then I'm out - I've already been out the ad revenue - now I'm gonna be out legal fees...

Dave Bittner: [00:26:50] Right.

Chris Parker: [00:26:50] ...And I'm just going to be throwing good money after bad. I just need to chalk this up as a massive business lesson of, you've got to have processes in place to make sure that you've dotted the I's, crossed the T's, confirm that people are who they say they are before you ever do business with them.

Dave Bittner: [00:27:09] All right. Joe what do you think?

Joe Carrigan: [00:27:10] Well, first off I think that a hard drive full of web logs of people using your services is a good problem to have.

Dave Bittner: [00:27:16] (Laughs) That's right.

Joe Carrigan: [00:27:16] I wish I could come up with something like that.

Dave Bittner: [00:27:16] True, true.

Joe Carrigan: [00:27:19] One of the first things he says is a key point. When you look at this is a third party, when people contact him, he sees all kinds of red flags. But when people are emotionally invested, they don't really see them. And Chris talks about this in his own experience, and he's very open and honest. He says, this is how I got taken.

Dave Bittner: [00:27:34] Mm-hmm.

Joe Carrigan: [00:27:34] Right? That's fantastic. Not a lot of people are willing to talk about this, and if we're not willing to talk about this, then we're never going to be able to inoculate other people about it.

Dave Bittner: [00:27:43] Yeah, the bad guys rely on that feeling ashamed...

Joe Carrigan: [00:27:46] Right.

Dave Bittner: [00:27:46] Embarrassment, yeah.

Joe Carrigan: [00:27:47] And I'm sure that Chris is not proud of these things that have happened to him, but I'm very happy that he is talking about how he got scammed openly. So, thank you Chris.

Dave Bittner: [00:27:55] Yeah.

Joe Carrigan: [00:27:56] I love the discussion about the Bibles. I'm wondering how you monetize stolen Bibles...

Dave Bittner: [00:28:00] (Laughs) I guess anything with value, right?

Joe Carrigan: [00:28:03] Yeah. He was very focused on the sale, and that's what kind of blinded him. He was caught off guard by the sale. And with the ad service, when he contacted the company this fraudster was impersonating, they said, we know this is happening, but, you know, there's not much we can do about this.

Dave Bittner: [00:28:17] Mm-hmm.

Joe Carrigan: [00:28:17] This is the world we live in. We're pretty much on our own in this kind of a situation. And that's what the scammers rely on. It's very important to be eternally vigilant. As we say, everybody is going to fall for something. It's very difficult to get your money back.

Dave Bittner: [00:28:28] Yeah, especially as these things have become international...

Joe Carrigan: [00:28:31] Right.

Dave Bittner: [00:28:32] ...It's hard to cross those borders to track people down.

Joe Carrigan: [00:28:36] It may not even be possible track them down. Like Chris was talking here, they may be in an Internet cafe or using a burner phone...

Dave Bittner: [00:28:40] Yeah.

Joe Carrigan: [00:28:41] ...In which case you're never gonna find them.

Dave Bittner: [00:28:42] Right. All right. Well, again, thanks to Chris Parker for joining us. His website is WhatIsMyIPAddress.com. If you have that question, he has the answer.

Dave Bittner: [00:28:53] Thanks to all of you for listening, and thanks also to our sponsors at KnowBe4. They are the social engineering experts and the pioneers of new-school security awareness training. Be sure to take advantage of their free phishing test which you can order up at knowbe4.com/phishtest. Think of KnowBe4 for your security training.

Dave Bittner: [00:29:10] Thanks to the Johns Hopkins University Information Security Institute for their participation. You can learn more at isi.jhu.edu.

Dave Bittner: [00:29:20] The Hacking Humans podcast is proudly produced in Maryland at the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our coordinating producer is Jennifer Eiben, editor is John Petrik, technical editor is Chris Russell, staff writer is Tim Nodar executive editor is Peter Kilpe. I'm Dave Bittner.

Joe Carrigan: [00:29:37] And I'm Joe Carrigan.

Dave Bittner: [00:29:38] Thanks for listening.