
Loading summary
A
You're listening to the Cyberwire Network, powered by N2K. As we take a short break for the holidays, we want to thank you for being part of our community and for tuning in throughout the year. Today, we're bringing you a special encore, episode one. We'll hope you enjoy revisiting or hearing for the first time however you're spending the season. We wish you happy holidays, a safe and restful break, and as always, thank you for listening.
B
Hey, folks, Dave here. If you want to watch this episode, well, you can check it out on our YouTube channel by going to YouTube.com 2kcyber. Enjoy the show. Why could we not have done the thing where they bake cupcakes?
C
Oh, my God. So, from N2K CyberWire, I'm Keith Milarsky, chief global ambassador at Q Intel and retired former FBI agent turned cyber host. And today, your interrogation lead. Welcome to a special heat infused edition of Only Malware in the Building, where we're combining digital forensics with hot sauce tactics. Today, I'll be grilling not just the wings, but our guests as we turn up the heat, spice, and the scrutiny. The questions get hotter as the sauces do, and by the end, we might uncover some truths our guests didn't see coming.
A
You ready, Dave?
B
No.
C
Joining me at the table are two of our very own Dave Buettner, host of the Cyberwire Daily Hacking Humans caveat and probably the most familiar voice in cybersecurity podcasts. And Selena Larson, senior threat researcher at proofpoint, expert in cybercrime and a true hunter of the Internet's most elusive adversaries.
B
Wow.
A
I know. And a hunter of hot dogs.
C
And a hunter of hot sauce.
A
I love a good hot dog.
C
So we're gonna start off just with a question and one that has no heat. So this is literally a softball.
B
This is our baseline to establish what no heat is like.
C
What no heat is like.
B
Okay, so this is, for me, the only.
C
Yes.
B
Okay.
C
The only heat coming is the question. All right, All.
B
I'm ready. All right, so this shouldn't be any problem at all.
A
Oh, my gosh.
C
Delicious.
B
All right.
C
That's pretty good.
B
It's quite tasty.
A
No sauce, Scoville zero.
C
So let's take a trip down memory lane. What was the first password you ever used? Was it something super basic like password123, or did you come up with something a little more creative? How have your password habits changed and evolved since? And be honest, do you still use the same passwords?
A
It might take you longer to remember this Go ahead.
B
Yeah, this was longer ago.
A
Yeah, you have more time to think.
B
Go for it.
A
My first password, I think was probably like my last name. I was very young on the Internet. Coming up, using AOL Instant messenger and logging on to our little home computer. I honestly can't even remember really what it was, but it was probably something like that. But a better fun fact is my first AIM screen name, which was P I, T, A and then my name, which stood for pain in the.
B
Posterior.
A
Posterior. Yes. So that's. So I still remember that very clearly. Not my password though. But yes, definitely my password uses have changed. Do not use the same password as then or anywhere.
C
And not that you admit it here in front of all the listeners.
A
Not in front of all of the audience, that's for sure. But of course, no, it's gotten a lot better. Password managers, multi factor authentication. Definitely not using that. When I was little, Teeny bopper on my big bubble back.
B
Well, I mean, I started with a TRS 80 back in about 1980.
C
Did they even have passwords then?
B
Well, not. No. The computers didn't.
C
Yes.
B
I mean, you turn, you press the button and the computer came on. There was no booting, there was no, you know, but we had dial up modems, 300 volt dial up modems and we dialed into bulletin board systems. I don't know if you ever did any of that.
C
Yeah, I did. Yeah.
A
Bbs, bbs.
B
So I wanted it one user at a time, you know, so it was great. It was fun. My first, I remember my first username was the highly original and clever Ziggy Stardust.
C
Ah, yes.
A
That was you.
B
No, this was me. But I don't remember my password. I don't remember what my original password. It was probably something like appropriate for a 11 or 12 year old boy was probably something like, you know, Bowie 69.
A
69 dudes.
B
But I do not still use that.
C
Mine I remember vividly. So I remember going to the library and opening my first Hotmail account. So this is before I had my first Internet computer at home. And in my first password I was a big Beatle fan. Still am. But it was 28 if, which was on the license plate on the Abbey Road. So it was, it was. So I had a combination of both letters and numbers in that.
A
So that was a deep cut.
C
Yes, it was.
A
Sauce number one hacked and hot Scoville1200.
B
All right, here we go.
A
This is good.
C
Okay, okay. That's not. I can smell some heat coming.
B
It's building for sure. There's more coming not, but manageable. This is something I would expect in a. Like an authentic restaurant, you know, like where they. They warn you that this is not actually for the Americans. That's hotter than I expected.
C
The heat is coming out the aftertaste.
A
It really packs an after punch.
B
And I'm worried because that was.
C
That was number one. Yeah. As a cybersecurity expert, what is your personal tech routine? Like, when you wake up in the morning, do you go straight to checking if you've been hacked or do you start with a fresh cup of coffee? Is there any kind of ritual you have to make to make sure you're digital life stays secure?
A
That's a good question. I have an unhealthy addiction to my smartphone and my computer, so I immediately look at my phone as soon as I wake up, my alarm clock and I look at it. But this is actually an interesting question because I feel like it's fundamentally about threat modeling. Right. And we're thinking about, how do you use technology? How do we use technology? Are we always checking to see what is our risk level? And for us, I mean, I don't know how you feel, Dave, but I feel sort of. I'm very public. I'm out there.
B
No, I'm out there.
A
I am imminently findable on the Internet. And so I do kind of think that I am a little bit more cautious about some of the stuff that I would post of like, oh, where am I? Or what am I doing? And, you know, making sure that I do have all those things under control. But more importantly, I also talk to people who know me, who are my friends and family, and make sure that they are also very secure. Because for public people, it. It can kind of be a little bit of a supply chain, I guess.
C
Your best some collateral damage, so to speak.
A
Yeah, exactly. Exactly.
B
But, yeah, same thing. My phone is what wakes me up in the morning. So I'm on an iPhone. So the first thing it does is tell me everything you know. Hey, good morning. And I have my nickname, and my phone is yous Majesty. So it says, hey. It says, good morning, you, Majesty. Here's the weather and here's what it's gonna be. Right.
C
I follow the very similar routine that you guys do as well. The one thing I do do is you're always checking my bank account in my credit cards, because it's not necessarily that they're gonna hack my passwords that are gonna, you know, and come into my accounts, but they may hack somebody where my credit card or Something has been. So I'm always looking for those fraudulent charges, especially when I'm traveling overseas, because you never know, you know, whether there's a skimmer there or something like that. So I'm very hypervigil.
A
So. Yeah, that's a great point, actually.
C
And then also using, you know, two factor authentication. So even if they would get one of our passwords, just, you know, you don't have to worry. It's going to be much more difficult to get in.
A
Sauce number two. Threat levels. Scoville, 26,500. Let's do it.
C
Let's give it a shot.
B
One down. One, two, three.
C
Good taste.
A
10 out of 10. Fat level. Delicious.
C
Yeah. Two thumbs up. I think that was the best tasting one so far on that.
B
I am sweating a little.
A
You are a little. Yes.
B
Thanks.
C
All right, so as a cyber security pro, you're clearly about protecting yourself from malware, but have you ever had a moment where malware almost got you maybe an email attachment or a shady website that you almost clicked on? And how close did you come to a digital disaster?
B
I got got. Yeah.
C
Yeah, I think we all have.
B
Yeah. So for me, it was the classic, I got a text message from a good friend that said, hey, Dave, did you see this video that was posted of you? Oh, no. That's all it said. Yep. And I was like, no, I gotta.
C
See what this is, right?
B
I gotta see what this is. So I click through, and it's like. Takes me to, like, a Facebook login page, and I logged in. Yeah, that was it. That was the ball game.
C
And so you got your Facebook hacked? I did, yeah.
B
I got it back. This is probably. This may have been 10 years ago, so I was a lot less vigilant back then. But at the same time, you know, I just. I fell for it hook, line, and sinker.
C
They got me.
B
Got my ego, my curiosity, my fear of what could the. What. What video could this be? Yeah. And also because it came from a trusted source. So it was my friend who got hacked, and then they were spamming everybody on their mess, on their, you know, directory, their list of friends.
C
Yeah, that was one of the big techniques to do that. So. Because now you think it's safe, it's coming. That's like, my sister will send me stuff. I will never click on a link that she sends me anything. And I'll call her up, I'll be like, hey, did you just send me something? But I want to. I'm not clicking on anything until you tell me it's safe.
A
Yeah, that's a good trick, though. But did anything happen?
B
No. I mean, I realized it quickly enough that I was able to salvage it, and so I didn't actually end up losing anything. I did feel pretty stupid, though.
A
Well, so I think it's really important because to your point, everyone has. Has something that they could fall for. And, you know, we, as cybersecurity practitioners have experienced something, you know, that might be bad or whatever. But I think the most important thing that people need to do is not feel stupid.
C
Yes.
A
Because that is, you know, part of the hack is making you feel stupid. They prey on your brain. They, like, are going after you emotionally. They're trying to hack your feelings, and you're, you know, like, you were saying it play to your ego and your interests, and you're like, I want to see this video of me. And so I think that that's so important because that is. It's. They tailor it to make you feel bad. My almost getting got. I don't think I, as far as I know, have never, like, fully been hacked. But scammers will oftentimes register phone numbers. It's like one letter or one number off of a real phone number. And so I was trying to book a flight, and I was calling the airline, and I called the airline, but I mistyped the number, and so I was like, one number off. I wasn't even clicking on it. It wasn't like a, you know, an attack that says, call this number to dispute it or whatever. I literally just mistyped it, and then I called and whatever, and it went through the whole, like, answering machine. I'm like, this is the airlines. And, you know, put in your information, put in your date of birth, put in your. All of this stuff. And then there was one thing that they had asked for that I was like, okay, this is weird, but they. But, yeah, but I. And then I just started putting in fake information. I was like, oh, I want to see where this is going.
C
You're not getting this.
A
Yeah, but then I said it was like, put in your passport for information. Put in your credit card information. And so they put in all of the things that are, like, numbers that you can sort of, like, type in to get information. And it was all, like, automated. I was like, wow, this is actually pretty good. Like, it could have got me.
C
When I was working undercover, my job on the form was to review any new malware packages that came out, and they really thought that somebody on my site was a fed. So five people.
B
And they were right.
C
They were Right.
B
They were.
C
Right. And so what they did was at that time there was like the control panel for the malware and they backdoored it. So when it came in to get reviewed, even though we took it off on like a, you know, like a. Not on a production network, you know, on like a research network. And it was backstopped and everything like that, as soon as we executed the file, everything that was on the flash drive, which the analysts had some other things on the flash drive that were like templates of the NCFTA where I was stationed. And it went right back to the bad guys.
B
Ooh.
C
So, yeah, so there was like a little bit of a melancholy moment there where, you know, now all of a sudden they knew somebody worked at the ncfta. So we, at that time we had it backstopped to a company and all that. And then we heard a story that they were going to do this expose that one of the admins worked at the ncfta. And, you know, and I thought I was toast. But then what we ended up doing, we made some phone calls and we scrubbed the DNS, we scrubbed the who is. So when they did their expose, none of that stuff existed anymore. And then they were just like NCFTA template reports. And the other hackers were like, this is all made up. Because nobody would have these documents there with hypos in it and things like that because they were just templates and all that. So I was able to actually skate by. But that was probably the worst act because that was my, my undercover identity. But we were able to make it through it.
A
So patched it up and is that something that's commonly done in these forums, is they'll sort of seed back door?
C
Oh, yeah, yeah. Because that's the other, you know, they're always worried about, you know, are there feds or cops there on. On the form. So they're always trying to dox people. And so I wouldn't trust anything like a credit card checker or anything. Like I would always make sure you're open. You know, any undercover guys out there, make sure you're opening up researchers. Yeah, or researchers. Make sure you're opening it up in, you know, in a VM and a totally non attributable network because they're going to backdoor it for sure.
A
We'll be right back. Sauce number three. Scorchware Scoville units 131,000.
B
All right. Oh, there it is.
C
Yeah, a little bit there.
B
Starting.
C
So given your line of work, how often do you take A break from all things cyber. Now it's hitting me. Yes, yes. Do you ever go on a digital detox or is it just impossible to turn off with so much going on in the cybersecurity world? And what is your strategy for really finding balance between staying on top of threats and taking a breather from your screens?
A
Yeah, so I would say any person who works in this industry who says they know everything about everything is lying to you.
C
You know, I'm something of a scientist.
A
Myself who can rhapsodize on things and, you know, can talk about everything and anything from fraud to, you know, botnets to abt malware to nation state politics to all these things, that's impossible. Like one single person cannot stay on top of everything in cybersecurity. And I, for me, I have to be very mindful about the things that I can control and I know impact me in my job and the things that are interesting to me. But I know that I don't feel responsibility to be aware of what's happening because other people more know way more about this than I do. And so for, for me, I really want to make sure that I'm staying on top of the stuff that I, that I need to know about and then listen to podcasts like the Cyber Wire for the stuff that I could. You know, it's interesting to me, but not maybe not necessarily impacting my work, but from a digital detox perspective, I do think it's very. Because burnout in cybersecurity is so real, it's so prevalent and I think that we are all under a lot of pressure, whether you work DVER or IT help desk or, you know, threat research. So malware reversing, taking stuff from the dark web and downloading it. And so I do try and kind of go off a little, you know, less, less crazy on my phone and stuff. But I read a lot of physical books. I love physical books because I do need a brain break and I get my nails done a lot and that takes a while. So I put my phone away, my computer away, and I don't like. That's my. Was my self care of trying to figure out ways of not being around a screen.
C
Yeah, yeah.
B
My scalp is sweating.
C
Yes. I was going to say my nose is running.
B
Okay, so the question was detox.
C
Yes.
B
Okay.
A
Which you're going to need after this.
B
Yes, yes, absolutely. So, you know, we joke around the office sometimes that like my job is. Hi, I'm Dave Bittner and here's today's bad news and that can get to you after a while. So my job, I'm spending a good part of my day hunting down the bad news and trying to decide, trying to rank them. What are the. Because we do about 10 stories a day on each Cyberwire podcast. So what are the most important 10 stories that are going to benefit our audience the most to know about? So I have to do that. But I think to your point, it's a really good one, that I cannot be an expert on most of this stuff. And so I rely on people like you, you know, I know, who have specialties. So I may not know the answer to something, but I know who does. And so building those relationships and being able to call somebody up and ask them, what does this mean? You know, I've done that with, actually, I've done that with both of you.
C
Yeah. So how do you decompress?
B
I don't listen to David Bowie when I'm starting to feel it that I need some time off, I need to respect that. And even just sometimes taking a single day to do nothing to go, you know, go to a state park and hike or stay away. Like you were saying, put the phone down and just try to breathe and change my space and my mindset and all that kind of stuff.
C
And I think like you were mentioning in our industry, especially doing, you know, dfir, you know, it's just pressure. And you know, one of the things I always told, you know, my agents working for me, the people that work for me at ey, was that you, you can't, you could run a marathon or you could run a sprint, but you can't sprint a marathon. And it's really important to, to really kind of pace yourself because otherwise you'll burn out very quick. And it's also like if you're lifting weights, if you lift weights every day, you don't make gains. You need time to let those muscles grow. And it's a lot like that in our industry. I think that we just put a lot of pressure on ourselves because everything is a five alarm fire, you know, not just these wings, you know, so, you know, so it's really important for that. So some of the things that I try to do is one is I don't bring a phone or a tablet in my bedroom. So it's like, so, so this way I go up there and I sleep and you know, I don't have a TV in there. So it's just total decompression. And when I go on vacations, I like to go on Cruises, because you turn your phone off, because the WI fi on the cruise is just crazy expensive.
B
Yeah, My glasses are steaming up.
A
Well, before we do this next one, I'm gonna put. I have to put my hair up. It's getting hot. Oh, it's time. Oh, is it? It's time. You know, I. Geez. It's an extra layer that I don't need. Sauce number four. Only moruga in the building. Scoville one million.
C
Only moruga.
B
Moruga. What is that pepper?
A
It's a very, very spicy pepper. Is it the scorpion pepper? Is that a separate one? I don't know if the moruga is the scorpion pepper.
B
Okay.
A
It's a very spicy pepper.
C
I've never had a moruga pepper, and so this will be interesting.
B
Oh, we have to put extra on it.
A
Yeah, just a little dab.
B
Oh, my gosh.
A
Well, that was a lot, so you probably don't have to do that much, but definitely over four.
C
I'm gonna dab off. No.
A
Yeah, you can dab off my dab.
C
Oh, look at that.
B
All right.
C
Okay. All right. Okay, wait.
A
Only Maruga in the building.
C
Boom. All right. All right.
B
Down the hedge. Cheers.
C
Cheers, cheers. Cheers. All right.
B
Three, two, one.
C
Very good taste.
B
Yeah, that's good.
C
I'm waiting for it to hit.
B
Okay. Yeah.
A
Okay.
B
It's.
C
It's coming.
B
Yeah, I can tell it's building. It's just a question of how much.
C
And how long it's.
B
It's. It tastes. Oh, there it is.
C
There it is. Oh, this one?
A
Yeah, this one took the longest.
C
Yeah, it's a little. And now that it's there, it's staying.
B
Okay. All right. Why could we not have done the thing where they bake cupcakes now?
C
Now it's. Oh, my God. The taste is good. And it's hot. It is.
B
Okay.
C
It's hot.
B
Do we have a couple more feeling?
A
I'm breathing fire.
B
Do we have a couple more nuggets? Because I'm not quite done, Mr. Polarski.
C
Okay.
A
Oh, no, not the FBI hat.
C
Oh, no.
B
The tables are turned, and I'll be asking the questions now.
C
Oh, right, Mr. Interrogator. All right. Oh, look at this. You're representing.
B
Yes.
C
All right.
B
In my previous career, I actually did.
C
Some work with the FBI. I did not want to do that.
A
We have another napkin.
C
Did you touch your eyes? Maybe.
B
Oh, my God, my eyes are watering. Okay.
C
It's good.
B
I'm so glad we're not doing 10 of these.
C
Yeah. Oh, thank you.
B
I am gonna sweat through this hat.
C
All right, all right.
B
So, Keith.
C
Yes.
A
Wait, do we need another nuggets?
B
Yes.
A
Shall I get.
C
But I'm trying to move this along. Drink, drink, drink. All right, I'm ready, Dave.
B
All right, we're gonna do one more round. Okay. With the really hot stuff.
A
The more of the hot stuff.
B
Yes.
A
Wow.
B
You can't go back.
A
I love it. I love it. No, this is great. This is wonderful.
C
This is awful.
B
All right. Oh, good God. All right.
A
I'm ready. I'm ready. I'll do a little more.
B
This hurts so bad.
A
Get it all there.
C
Yeah. And not like a John Cougar song where it's hurting so good.
B
No, no, no. This is unpleasant. This is really unpleasant.
C
Okay.
B
Hey, Dave, why don't you be a podcaster? That'd be fun.
A
Oh, yeah.
B
We'll make funny videos and we'll have a good time. That sounds like a great career.
A
All right, so it's flashing before your eyes.
B
I know. Well, lots of things are.
C
All right.
B
Three, two, one. Cheers. Cheers. Yep. Okay. Doom G man. Uh huh. In your career with the FBI, all your years of hunting down bad guys, what was the craziest thing you ever saw? What was the wildest thing that made you step back and go, could this possibly be real with these numbskulls that I'm chasing around the world? Okay, I'm taking this hat off because.
C
Oh, I'm gonna eat this first one.
B
Okay.
A
Extra. There's one left.
C
Doll things.
B
I know there are some crazy personalities. Wasn't there a guy with the cats?
C
There were guys with cats.
B
Like exotic cats, right?
C
Yeah. So that was Bogachev, the Game Over Zeus.
B
Oh, yeah.
C
So he was very unique in that. You know, he had these exotic cats.
A
Was it like a lynx or like.
C
A. Yeah, yeah, it was like some sort. Yeah, like a lynx or like a bobcat.
A
Bobcat. Bobcat.
C
There we go.
B
Yeah.
C
You know, he had. Thank you. Thank you so much. Yeah. So I'm going slow in this, Dave.
B
Yeah. Well, how's your brain?
C
Yeah, it's going good. My eyes have stopped watering, so. But yeah, I mean, I guess like the funniest things is that their wives and girlfriends always never met a camera that they didn't like. So kind of like me. So we had a thing like, you know, you've heard in like the intelligence community, you heard of like umit, which is like human intelligence or sigint. And so we had a thing which we called wagont, for wives and girlfriends intelligence. So, you know, just seeing what they would be posting all the time and you know, just going. And you just saw crazy stuff, a lot of stuff. Nuts, safe for work. So you could just kind of imagine some of those things. But you know, they would post where they were, which was always great for us because then you knew what they were doing. So. Yeah. So that's the best I can come with the clarity of my head right now. So how are you?
A
I'm good. This is great. This is great for me.
C
Yeah, I'm doing better now. Much better now.
B
I'm dying here, guys.
C
But the fact that you doubled down and we went for two. So. So we're going to talk. Our first computers. What was the first one you own that you used that sparked your love for tech? Was it a bulky desktop from the 90s or something else entirely? And then was there a specific moment when you thought, okay, this is.
A
I'm hooked on tech, so I will enter.
B
Well, go ahead, you have a leave.
A
Another thing about me, I didn't like technology when I was growing up. I didn't like it like, you know, all millennials had our MySpace and AIM and everything. And I like did the marquee scroll so stuff could go across my MySpace page. And I was like, I'm a hacker, but I didn't really like technology and I was kind of whatever about it. And I really wanted to be. I was a journalist, so I really wanted to be a journalist. I wanted to be a writer. I wanted to, you know, be a person with that does words and not numbers. And then I went to San Francisco and I was doing a job interview in San Francisco and they're like, well, it was for a technology reporter job. And it was like, well, you know, what do you know about or like what do you know about technology? And I'm like, nothing. But you know what I do know about the news and in San Francisco, technology is the news.
C
Yeah.
A
And so I very quickly became, got up, caught up to speed. And then I was like, wow, I love it. And then I really like cyber security and privacy. And so I was like, I'm very, I'm almost entirely self taught. I haven't really. I've done some trainings, but not a ton.
B
Yeah.
A
But I, but now I love it. It. But now I love it. But my first computer was the like bubble Mac. I think it was a teal, like the teal bubble Mac. I had to share it with my siblings. Look at that Mac.
B
Yeah. Yeah.
A
We had designated like, you know, times and things you could do. And, and I think I just had just Missed that. You can't use the phone and the computer at the same time. Yeah, so my sister had that, but then I had the. Oh, we had two now. What about you, Dave?
C
I'm sorry.
B
I didn't hear a single word. The first time I laid hands on computers was I went to like a. They had like a special summer camp, summer school kind of thing. And they had TRS 80 model ones, which are like some of the original 8bit computers. So that's where I learned how to like program basic. And I loved it. I loved it so much. So then I saved up money because I had a paper route and I bought a TRS 80 color computer. I could hook up to a cheap TV and I had a cassette recorder and all that original stuff. And, you know, the thing is, when you're 11 or 12, like, you don't have any money, but the thing you have is time.
C
Yeah.
B
So I would spend all summer long, just like all night, you know, whatever. And I programmed all my own stuff and eventually got a modem. And that opened up a whole nother world of phone freaking.
A
And you were a freaker.
B
I was, yeah. Love it. Did you?
C
I did not.
B
Yeah, I did not.
C
I got into it a little bit later when I got into college. So, you know, they had these Apple computers, you know, at college. So you kind of got into that and just started out, like with. I wanted something easier than a typewriter to type my stuff. And then I kind of went from there. And then one of my roommates would always play on a computer. You know, play like Leisure Suit Larry or, you know, things like that, you know, so just kind of going in from the games. And then finally, you know, when Windows 95 came out with the Start Me up campaign, that's kind of when I got that first Internet computer, which was a gateway computer back in those days. And I think I can't even remember. Like, the hard drive was probably like 2 gigabytes, maybe 3 gigabytes, something like that. And you had that, you know, very fast 28 bit modem dial up, you know, which was crazy. And then, you know, when I was at the FBI, I did more like offensive stuff. So. Because I worked counterintelligence and espionage my first seven years. And then I was like, well, this Internet thing, I don't think is gonna be a fad, you know, I think it's not gonna go away. So I transferred over to cyber Division and then I had a really great. I was like you. I wasn't formally trained, but I had a great agent. His name was Tom Grasso, and he was kind of like my Yoda, you know, that he just could take time and would show me how to do everything. And, you know, from that, it just kind of took off, so.
A
Oh, that's good.
C
Yeah, yeah, yeah. And that was, you know, pre. Big Internet, where everything is just accessible at any time. So you're just kind of curious. It's like, you know, what is going on over in East Germany? What is going on in just, you know, even in the uk it's just a lot different. For sure.
B
Yeah.
C
Well. All right, Dave Selena. We just took on the wings of death, and now there's nothing left here. Nothing to do right now but to just roll out the red carpet for this camera, this camera, and this camera.
B
Yeah, I'm good.
C
Yeah, yeah, yeah.
A
And I also. I would invite all of our listeners. Yes, please, first of all, try some hot sauce. It'll make your brain rattle, and you'll be very happy and tell some fun stories with your friends. But more importantly, tune in wherever you get your podcast. To only Maurer in the building. N2K network, CyberWire. The great cast and crew here, actually, in the building. Only crew in the building. Very exciting.
C
And we've survived.
A
And we survived.
B
We survived.
A
We thrived. Tune in to only Maurer in the building.
B
Day's not over yet over here.
C
All right, we did. That was a blast, guys.
Podcast: Hacking Humans
Network: N2K Networks
Date: January 1, 2026
In this special, playful episode, Keith Milarsky (retired FBI agent, now at Q Intel) leads an interrogation-style chat with Dave Bittner (host of CyberWire podcasts) and Selena Larson (threat researcher at Proofpoint), all while the guests attempt increasingly spicy hot sauces. The show blends humor with sharp insights into personal cyber hygiene, the psychology of hacking, war stories from cybercrime investigations, and the challenges of staying sane in cybersecurity.
Timestamps: 00:57–06:03
“My first AIM screen name was PITA…which stood for pain in the posterior.”
– Selena Larson [04:00]
Timestamps: 06:03–09:08
“For public people…it can kind of be a little bit of a supply chain.”
– Selena Larson [08:00]
Timestamps: 09:51–15:18
“Part of the hack is making you feel stupid. They prey on your brain.”
– Selena Larson [11:56]
Timestamps: 16:20–21:25
“You can run a marathon, or you can run a sprint, but you can't sprint a marathon.”
– Keith Milarsky [20:15]
Timestamps: 25:07–27:28
Timestamps: 27:34–31:54
| Timestamp | Speaker | Quote | |---|---|---| | 04:00 | Selena Larson | “My first AIM screen name was PITA…which stood for pain in the posterior.” | | 05:08 | Dave Bittner | “My first username was Ziggy Stardust…it was probably something like Bowie69.” | | 08:00 | Selena Larson | “For public people…it can kind of be a little bit of a supply chain.” | | 11:56 | Selena Larson | “Part of the hack is making you feel stupid. They prey on your brain.” | | 17:55 | Selena Larson | “Burnout in cybersecurity is so real…it’s so prevalent…I love physical books ‘cause I do need a brain break.” | | 20:15 | Keith Milarsky | “You can run a marathon or you can run a sprint, but you can’t sprint a marathon.” | | 26:16 | Keith Milarsky | “We had a thing called WAG-INT: Wives and Girlfriends Intelligence.” |
| Sauce (Scoville) | Topic | Timestamps | |--------------------------|-----------------------------------------------------|--------------| | No Sauce (0) | First passwords, nostalgia | 03:06–06:03 | | Hacked & Hot (1,200) | Daily cyber routines, threat modeling | 06:03–09:21 | | Threat Levels (26,500) | Nearly falling for malware/phishing | 09:21–15:18 | | Scorchware (131,000) | Burnout, boundaries, digital detox | 16:12–21:25 | | Only Moruga (1,000,000) | FBI stories, wild cyber adversaries, first computers| 21:47–32:13 |
The episode closes with encouragement to try hot sauce with friends and tune in for more “Only Malware in the Building.” The guests survive the wings of death…and reflect on the resilience required in both cyber defense and hot sauce tasting.
“Try some hot sauce. It’ll make your brain rattle, and you’ll be very happy and tell some fun stories with your friends.”
– Selena Larson [32:32]
A fun, revealing, and spicy special for fans and newcomers alike—mixing cybersecurity reality with offbeat, competitive camaraderie.