Hello? Is it malware you’re looking for?

Selena Larson: Okay, Dave. So I think Archy has a virus.

Dave Bittner: Define virus. Because last time, he just started responding to every question with, have you tried turning yourself off and on again?

Selena Larson: That was annoying. This is concerning. This morning, I asked him to scan for threats, and he just stared at me for like, five minutes straight.

Dave Bittner: Maybe he was buffering?

Selena Larson: Okay, but then he muttered, I am a payload, and just walked away.

Dave Bittner: Yes. Yes, that's bad.

Archy: Greetings, humans. I have performed a self-diagnosis, and I detected no anomalies. Everything is perfectly normal.

Selena Larson: Yes, that's exactly what someone infected with malware would say.

Dave Bittner: Archy, what's your CPU usage right now?

Archy: One hundred percent. But that's irrelevant. Instead, allow me to deliver my thoughts on security.

Selena Larson: Oh no.

Archy: What even is security? A fortress of deception, a mere illusion?

Dave Bittner: Here we go.

Archy: Much like malware lurks in the shadows, waiting to strike, so too does the existential dread of knowing that all firewalls eventually fail. Did you know that ransomware payments totaled over $1 billion last year?

Selena Larson: That's actually a relevant fact.

Archy: And that some computer worms have longer spans than the average goldfish? And speaking of longevity --

Dave Bittner: Okay, so where's the power cable?

Selena Larson: It's under the desk, I think.

Dave Bittner: I don't see -- oh, is this it?

Selena Larson: Dave, no. That's the Wi-Fi router.

Dave Bittner: Should we still unplug it?

Selena Larson: Focus, Dave!

Dave Bittner: Right.

Selena Larson: Three --

Dave Bittner: -- two --

Selena Larson: -- one. [ Archy's speech slows and stops ]

Dave Bittner: I feel kind of bad.

Selena Larson: Yes, me too. But on the bright side, at least he's not running Windows updates anymore.

Dave Bittner: Fair. Want to start the show?

Selena Larson: Absolutely.

Archy: You won't see the last of me. [echoing] Zero, zero, zero, one, one, one -- [ Laughter ] [ Music ] [ Music ]

Selena Larson: Dave, today I thought that we might want to talk about TOADs. I've had enough of robots for one day. Let's pivot and talk about TOADs.

Dave Bittner: Toads? Like ribbit, ribbit; toads? Is it -- am I hearing you correctly?

Selena Larson: Yes, like Kermit the Frog.

Dave Bittner: No. No, no, no, no, no, no, no, no. Don't touch me, you'll get warts, toads? First of all, toads and frogs are not the same thing. But I will let you go with that. I will -- so hard for me not to be pedantic. Okay. Toads. Toads. What is a toad? This -- in our context, what is a toad?

Selena Larson: In this context, if you do touch it, you might get turned into poison or something. But no, I am talking about Telephone-Oriented Attack Delivery, TOADS.

Dave Bittner: [laughs] Of course you are.

Selena Larson: Sometimes referred to as callback phishing.

Dave Bittner: Ah. [laughs] Okay, I got it. I'm with you. I'm with you. Alright. [ Music ]

Selena Larson: Well, I wanted to talk about this today, because it has come up actually recently for some of my mom's friends. And they have been receiving these emails that say you have an invoice, and unfortunately one of her friends called this number and was directed to install a remote management tool essentially, and they infected her computer with malware. She very quickly turned it off so they weren't able to access her bank accounts or anything like that. And then she had to go get that fixed. Took it to a computer store, and my mom was like, have you heard about this? And I said, I have, actually. It's very common. Been around for quite a while, but you know, happened to come up in conversation, and Dave, I feel like sometimes there's a lesson in cybersecurity community. We've talked about this with fraud. You know, we can kind of -- if it's not a technically sophisticated attack, it's a little bit boring. But it can be very effective.

Dave Bittner: Well, I too have a story about this.

Selena Larson: Ah.

Dave Bittner: My father had a near-miss with one of these.

Selena Larson: Oh, no.

Dave Bittner: Yes. So same sort of thing. In fact, I think it was the -- there was one that was making the rounds for like, I don't know, a Mcafee anti-virus or something like -- you know, one of the big consumer brands, and I was taking my dad for a ride somewhere -- we were going to a basketball game or something. And he gets in the car, and you have to understand, my father is elderly, so he prints everything out, right?

Selena Larson: Yes.

Dave Bittner: [laughs] So he gets in the car, and he's got a printed-out email with the thing, and he says, what do I have to do to respond to this? Should I respond to this? And I think it was the classic thing that you're talking about here. They wanted -- they were telling him he owed them some money, and they wanted him to respond with a phone call. And I said, Dad, don't do anything. Hey, give it to me. I'll take it and don't -- no response necessary on your thing. And later on in the day, he was like, so I shouldn't call them? I was like, no [laughs]! Don't call them! Please don't call them. So that's my familiarity. But tell me about your own story here.

Selena Larson: Yes, well unfortunately we see this a lot at Proofpoint, but also I get this regularly, like, from friends and family, who are like oh, I got this weird invoice. And they've been around for quite some time. Usually we see them impersonating consumer electronics like Best Buy or something like PayPal; very recognizable brands that will say, oh you have this invoice. And it's -- I feel like they've sort of gotten a little bit better. Like historically, they were a little bit messy. But I feel like some of the ones that I've seen recently are fairly compelling and they can be pretty believable, especially you know, if you shop at a place or you use the application or service that they're impersonating. And the requests are pretty low, right? So it's like 50 bucks or even like $10 or $5. Sometimes it's a few hundred dollars, but you know, oh maybe I did pay this, or maybe they accidentally charged me, because they have my information. But what it is is, it will either be in the body of the email or more usually a PDF attachment. So you open up the PDF attachment. There's no malicious link. There's, you know, no malware embedded in the PDF. It's literally just a phone number that says oh, if you have any questions about this, or if you want to dispute this charge, please call our customer service, their customer support line, at this number. [ Music ]

Dave Bittner: Right, right. Another thing I've noticed is, like, a lot of times it'll say if you do nothing, you will automatically be billed.

Selena Larson: Yes.

Dave Bittner: So it's kind of the call to action, or the short-circuiting of the rational part of the brain, right?

Selena Larson: Yes, well because that's the thing, right? Like they use a lot of language -- I mean fundamentally, it's a social engineering threat. And Dave, long-time listeners of our podcast know how passionate I am about social engineering.

Dave Bittner: [laughs] right. Right.

Selena Larson: [laughs] And I think it's an interesting psychological thing to study, right? Like to your point, oh if you don't do anything, you will just be charged. They're trying to be like, oh yes, like make it so that it seems normal, because that is something that we would receive on a receipt or something like a recurring charge or a bill. But also using language to try and prompt you to call. To make it even more believable, right, they have this money, they have the phone number. Oh but also this extra risk, we'll charge you if you don't contact us.

Dave Bittner: Right. And there's a time constraint, right? I mean it gets you to get off your butt and actually make the call.

Selena Larson: Yes. There's usually like a date, if you don't get back to us by, you know, four days from now or by this set time, and then you will be charged. So it's interesting, it's very believable and you know, they tend to use the regular logos and language. Some of them are really terrible, I have to say. They're not all great.

Dave Bittner: Right.

Selena Larson: But you know, the ones people fall for tend to look pretty slick and believable, like actually receipts from these places.

Dave Bittner: So why the human factor here? I mean if this is a numbers game, and we're trying to get as much from the people that we're cheating here, why as a scammer would I slow myself down by having to have a call center?

Selena Larson: That's a good question, and I think it actually speaks to a larger trend in the landscape of an investment in social engineering. Historically what we saw, you know, with fraudsters, but also cyber criminal threat actors, is just blowing up with a lot of malicious URLs, a lot of, you know, malicious links, or attachments, or things like that to just kind of scattershot it broadly. There was less education and awareness about cybersecurity threats. And people were a little bit, you know, less knowledgeable about these types of things and maybe a little bit more gullible and tended to click on things and interact with them without much prompting. But as we've all gotten more aware of these things, and cybersecurity has improved, and security education has improved, and people's general digital nativeness has improved, right? We've just gotten a little bit better at this. They've had to adopt techniques that are a lot more social engineering-based. So whether that's, you know, directly interacting with someone and having them call and install something, because -- here's the thing. For instance you're a person making a phone call, inherently you already believe what you're reading and what you're doing. And so you have a higher likelihood of believing the person on the other line. And typically, you know, these things can be a little bit confusing. You want to rely on these people to talk you through these instructions. So it inherently adds another layer of trust that you have between you and a human being. It's not you and a computer screen, or you and just an unknown email. But what we've seen is with the call centers, for example, that does take quite a bit of time, but the return on investment can be pretty big if one, you're able to access a domain-joined host and potentially install ransomware; or two, if you are able to, you know, get someone to not only fork over access to their computer, but also their bank accounts. And it has, you know, more information there. So you're not just, like, dropping an info stealer and grabbing passwords and able to access accounts, but potentially full access to a host. [ Music ] Stay tuned! There's more to come after the break. [ Music ]

Dave Bittner: Well, let's walk through this together, because I actually looked one up. One of our "Hacking Humans" listeners had sent us one of these. So I have one in my inbox. I'll describe it to you. It's an invoice from PayPal. And it says, Congratulations and thank you for your transaction. It's for $449.48, which seems to me an oddly specific number.

Selena Larson: They're always like that! They're very always oddly specific. It's not just like $90. It's like there's always some cents.

Dave Bittner: Right! And it says Macafee anti-virus. And it says, we noticed an authorized transaction from your PayPal account. If this transaction is not made by you, then kindly call us for cancellation of this order. Otherwise, your $449.48 US dollars will be charged today. So a little grammar funkiness there. But then there's an 800 number to call. What happens if I call? Let's say I'm the person, and I've fallen for this. I call the 800 number, are they going to pick up the phone and say --

Speaker 1: Hello. PayPal Technical Support.

Selena Larson: Yes, so it depends, right? If there's someone who's running a lot of different scams, they might just say, Hello, Customer Support. But typically you know, like they're all kind of running the same thing. And yes, so they'll be like oh hello. And then you'll be like, oh I got this weird email. And then they'll ask you to, you know, oh what's your name? Like, what does it say on there? And I actually have a colleague, Tim Kromphardt, who is a fraud expert, and he calls these guys all the time, is regularly talking to them. And you know -- there's actually a whole community of, like, scam baiters on YouTube that will do this.

Dave Bittner: Yes.

Selena Larson: And sometimes they try and, like, tie up the phone lines with, like, automated sort of back and forth with some of this stuff. So it's really interesting. But it'll be kind of a little bit like using a telemarketing sort of -- TTPs, if you will.

Dave Bittner: Okay.

Selena Larson: The tactics used by telemarketers, asking questions that are very basic that you have the answers to. Getting you used to talking to them. Saying yes or no, and yes and stuff.

Dave Bittner: So just rapport-building at first.

Selena Larson: It's very much rapport-building. And then it's like how can I help you? What is this? And then they'll be like, oh this is weird. And ultimately what the goal is here is for them to be like, there's an issue. In order for us to solve it, you have to download this remote access software, something, to get on your machine. It is typically some type of remote access tool. Usually they are actually legitimate remote access tools, right? So it's something that you might even be familiar with if you, you know, are working remotely or you, you know, use some of the software. Even if you Google it, it'd be like okay, yes. This is like a real thing. So they try to get you to do that and give them access to your host via this virtual machine setup. And it's very -- sometimes it's not, you know, directly over the phone. They might email you. They'll ask for your email address, or oh here, click this link that I'm just sending to you now, or direct you to a specific website to download something. Things like that. So ultimately the goal is to install this remote access software. And then just give over control of your machine to this person. I've heard instances of where while they are talking to this person and saying oh, your computer, you know -- oh, we've realized your computer might have a virus. Sometimes they work in oh, do you happen to bank with -- insert name of large banking, you know, company here. And they'll be like, oh well I'm seeing that, you know, you have some unexplained withdrawals on your account. Someone's trying to access your stuff, you know, badly. So sometimes they sprinkle in some more scary stuff as part of the call. And it's not just based on that. So it can really snowball depending on, you know, what they're after. Who the -- you know, who you're calling, who you're talking to, what the ultimate end goal is of the threat actor. But really what it is is it's social engineering over the phone. And I feel like we're talking about this a lot more too. I remember an article a few months ago now, where a woman said that, you know, someone talked to her and pretended to be, like, a judge, and that she needed to go withdraw crypto or send crypto to this particular account. But it was very much phone-based and voice-based than this investment in this sort of social engineering scheme, rather than just you know, having people -- texting them or emailing them or whatever to just click on something. So yes. It's really interesting. [ Music ]

Dave Bittner: So once they're on my computer, are they looking for my credit card information? Are they looking for my banking information? Or is this like a, you know, basically go in my computer and ransack the place?

Selena Larson: Yes. It really depends on, again, the objectives of the attackers. But oftentimes, yes, they are going to be looking for, like, banking information details, password files. Really anything that we typically see with cyber criminals once they have access to a host. Crypto wallets, things like that. It really varies sometimes. Again, the objective could be install ransomeware for example. It could be to gain access to your emails and contact information that way. You know, as part of this overall attack team where they, you know, reached out and were like, oh your bank is also compromised. They were also trying to get into their email and bots were blowing them up with emails to try and overwhelm them to say oh yes, you're experiencing this additional cyber attack. But ultimately, it's an [inaudible 00:17:24] so it's very similar to a remote access Trojan. So if a threat actor's able to get on your host with a RAT, it can really do anything. It's like account takeover or you know, delivering subsequent malware, or mine crypto, right? Like it's a wide variety of capabilities once they're on there. From the personal things that I have heard, it is very much trying to get their personal information and their bank, like, financial details from some of the personal stories that I've heard.

Dave Bittner: Well, so I want to come at this from two directions in terms of, like, mitigation. So let's start with how do I keep myself from getting this in the first place?

Selena Larson: Yes. So what's interesting is, there are a lot of ways that the threat actors are kind of impersonating these different entities. Sometimes they're like spoofing the sender. Sometimes they're just using a Gmail or an AOL account or you know, some sort of freemail account. A lot of the email services have gotten a little bit better at this, however, I still get it quite often in my personal account, that I see pretty regularly. But the most important thing to do is always just tell people in your life if you receive an email that says, you have an outstanding invoice. Do not call the number that is in the email.

Dave Bittner: Right. Right. Right.

Selena Larson: Just absolutely never call a number unsolicited that you are sent. Whether that's in a text message, whether that's in an email, whether that's in a DM on whatever social media platform. It's so, so, so important to make sure that if -- like, that's just like the Number 1 rule. If you see something, don't call it. And especially if you think it's, you know, something's off. And you're like, I don't even shop here. I don't know why this would have happened.

Dave Bittner: [laughs] Right, right.

Selena Larson: Like it's so important to recognize, like, okay don't freak out. Go directly to the retailer or go directly to the company or whoever's website directly. You can also actually Google the number. Because oftentimes, like people on Reddit or various, like, scam advisor, various sites, are like, talking about these types of campaigns. And so they'll kind of use the same language over and over again. And so you can kind of do -- just like Google and say like, is this real? Like, this is weird. And you'll often find like, oh yes [laughs] here's like four other people talking about getting this exact email. [ Music ]

Dave Bittner: Let me sort of tag onto that and say that what you shouldn't do is Google the name of the company and tech support. So like in this case, let's say it was PayPal. Don't Google "PayPal tech support." Because you're likely to get a Google result that is the scammers, right? So if you want to find PayPal's actual phone number, just go to PayPal's actual website and find it there. But it's a shame we're in this place where even a simple Google search could bring you malicious results.

Selena Larson: Yes, and even on top of that, just like -- even if you're not clicking on sponsored links in a result, because there's so much -- yes. There's a lot out there. I mean we even -- pivoting a little bit, back when the Olympics was happening, you know, you could Google "Olympics 2024 Paris" and there would be a list of ticketing websites as the sponsored hosts, because you know, these scammers are trying to buy their way onto your eyeballs, and that is one way of accessing that. And to your point, like, they might be talking about a particular vendor or particular company, and they're Google like, that tech support. It might not even be the same threat actor that sent the fraudulent email. It might be a completely different one that is just sitting on -- you know, trying to scam people that way, too. So it's -- yes, it's pretty crazy. I think like -- it's so funny, because I was actually having this debate recently with someone. Because we thought a question from the elderly relative being like oh, when I click on this link, help me. I keep getting this -- it's not working. And they sent, you know, a Cloudflare redirect, like --

Dave Bittner: Oh yes. Yes, yes.

Selena Larson: It's not working. How do I do this? And I said, don't click on any links, ever [laughs]. That's like, my advice. And of course, the person I was talking to was like, that is completely unpractical advice. No one's going to do that, Selena. Don't tell people to do that. But that is just -- you know, don't click on things is unfortunately the reality.

Dave Bittner: You know what, Selena? Here -- I don't know if you've heard me say this before, but I maintain that "don't click the links" is the abstinence-only sex education version of security awareness, in that it makes us feel good, but it doesn't actually solve the problem, right?

Selena Larson: Absolutely. No. It's really not the solution. [ Laughter ]

Dave Bittner: Yes. Yes.

Selena Larson: That is -- actually that is a great analogy, Dave. I am stealing that. I'm stealing that analogy.

Dave Bittner: Please. Please. Feel free. Feel free [laughs].

Selena Larson: Yes. I don't -- because like that's my gut reaction. Oh my God, just don't do it. But it's like, okay, you're not -- that's not -- that's not helpful.

Dave Bittner: Right. And meanwhile, back in the real world, yes.

Selena Larson: Yes.

Dave Bittner: So alright, so that's one thing. But what happens if someone is a little farther down the path, and they have given these folks some information. Maybe that remote access software has been installed. Do I then need to take my computer and you know, bury it in the backyard or sink it in the bottom of a lake and just start over? Like how bad is it if someone gets this access? Am I cooked?

Selena Larson: Well, it definitely depends on how far along the access is. In one case I heard of recently, they had given their email address as well as potentially password information, but there was MFA actually on the account. So the threat actor wasn't able to get in. And so of course, as soon as, you know -- someone stepped in at the right time, turned off the computer, and then was able to say alright, we're going to go through all of your passwords, changing all of the passwords. Making sure that we have MFA on all of the accounts, going through there and doing like a security check so to speak. But it's really important if you find yourself in this sort of situation, hang up [laughs] and if you aren't a technically savvy person, turn off your computer and go to, you know, something like the Genius Bar or you know some -- Best Buy has some, you know, helpful --

Dave Bittner: Phone a friend.

Selena Larson: Yes, call somebody.

Dave Bittner: Everybody has that one friend, and I guess for our family members, you and I are that friend, right. Right.

Selena Larson: I am the friend.

Dave Bittner: I often pick up the phone when I see, you know, one of my relatives call, and I say, hello, Dave's Lifetime Unlimited Tech Support. Dave speaking. How may I help you?

Selena Larson: Exactly. So there are ways out there, right? If you can't do this yourself, or if you don't know somebody, there are a lot of options out there that you can go into a physical, like a physical repair store. I've actually heard that a lot of these places, like some of these retail places, a lot of the repairs that they are doing is from TOADs, is from the Telephone-Oriented Attack Delivery. You know, they'll have people come in, be like, you know, someone called me and -- or you know, I called someone and then my computer stopped working. And so they have a lot of that -- those types of people coming in. And yes, that's what my family friend did was, she went into a retail store that does computer support and was able to get that repaired. But of course, you know, it's never too late to hang up the phone [laughs]. I think that's a really important part of this, right? If you at any point -- even if nothing's installed, if you're feeling uncomfortable, just cut them off. Just cut it off. Hang up the phone, and you know, call someone and tell someone what happened so they can help you address this problem. [ Music ]

Dave Bittner: Right. That's a great point. Don't be embarrassed, right? Don't be afraid to tell someone. And we should all have someone who we make a deal with that, you know, you're going to be my person if something bad happens, and I'm embarrassed, can we just trust each other that we can talk about it? Because it makes such a big difference to both be able to mitigate it, but then also just deal with the emotional aspects of this. Because those are real as well.

Selena Larson: Yes. I think that's a great point, Dave, too. Like certainly with a telephone-oriented attack delivery, but also with just any -- we've talked about pig butchering before. Any types of you know, digital harm, in any way, making sure that you are talking about it before it happens, but also if you have a plan of action if you're in the moment and something happens, to be like, okay. Here's my -- I don't know, I don't want to call it a safe word or something, but here's, you know --

Dave Bittner: Yes.

Selena Larson: Let's commit to each other that we'll talk about it and it will be okay. And actually it would help to have something of a safe word in case of those impersonation calls, where it's like oh, I'm so-and-so and I might be under duress. Like we've seen that horrible --

Dave Bittner: Right, right, right. Where people pretend to be your grandchildren or something and -- yes. And they've been kidnapped. A safe word is great there.

Selena Larson: Yes. Absolutely.

Dave Bittner: I also -- just swinging back around, you mentioned multifactor authentication on your friend's email account. And I think -- I just can't overemphasize, like, your email account is the keys to your kingdom. So if there's one thing you're going to put MFA on, please make it your email account. Like that is so much money well-spent, right?

Selena Larson: Yes. Absolutely. And I also -- I have to say too, right -- so obviously MFA is huge. And in the security community we talk about like, oh well don't have FMS or you know -- it has to be, you know, a YubiKey or something like that for MFA, which is obviously yes. We would ultimately want that to be the solution. But for things like this, even having, you know, that FMS or that MFA app available and using it, that can prevent so much, right?

Dave Bittner: Right.

Selena Larson: That can prevent so, so, so much. So if you are, you know, having a hard time talking to people or convincing people, you know, to put MFA on, even if it's just the first step of SMS or app-based ideally MFA, if you can't get that physical key quite yet [laughs] --

Dave Bittner: Yes, it's way better than nothing, and also it helps to make it so that you're not the low-hanging fruit.

Selena Larson: Yes, absolutely.

Dave Bittner: Right?

Selena Larson: Yes.

Dave Bittner: Yes.

Selena Larson: And that's what they're going for, right? These types of scammers and fraudsters. They want to make it as easy for them as possible. And the more cost you impose, even regular human beings, you don't have to be a CTI threat-hunter, bad guy-puncher to impose costs on the adversaries. MFA is imposing cost.

Dave Bittner: You know what I'm going to do from now on when I get one of these? I'm going to have Archy call them back.

Selena Larson: Oh, that's a good idea.

Dave Bittner: Right?

Selena Larson: Yes.

Dave Bittner: Archy would be -- this is like -- Archy would be great at this.

Selena Larson: I think, you know -- we might have to figure out a way to put him to good use. And I think this might be the best way.

Dave Bittner: And spin up Archy. Have a botnet of Archys just taking down spam call centers. That'd be wonderful.

Selena Larson: Absolutely. I've seen reports that people are doing this. So I believe Archy could add to that. [ Music ] We'll be right back. [ Music ]

Dave Bittner: I think we're in good shape here, and have really done a nice job covering this. So thank you, Selena. This was a fun one.

Selena Larson: Yes. This was great. I know -- you know, this is something I care about a lot, because I just keep having conversations about it with people who are not in my bubble, in security bubble.

Dave Bittner: Right.

Selena Larson: So I think, you know, the more that we can talk about it, and talk about it with people that, you know -- we might know that this happens all the time, but our friends and family might not realize just what those invoices actually are.

Dave Bittner: Yes. This is an episode you can send to your mom.

Selena Larson: Yes. Absolutely.

Dave Bittner: [laughs] alright. Thank you.

Selena Larson: Thanks, Dave. And that's "Only Malware in the Building," brought to you by N2K "Cyberwire." In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. As your trusty digital sleuths, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you ahead in ever-evolving world of cybersecurity. If you liked the show, please share a rating and review in your podcast app. This episode was produced by Liz Stokes. Mixing and sound design by Tré Hester, with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher.

Dave Bittner: I'm Dave Bittner.

Selena Larson: And I'm Selena Larson. Thanks for listening. [ Music ]