Loading summary
Maria Varmazes
You're listening to the Cyberwire Network, powered by N2K.
Dave Buettner
Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner, and joining me is Joe Kerrigan. Hey, Joe.
Joe Kerrigan
Hi, Dave.
Dave Buettner
And our N2K colleague and host of the T Minus Space Daily podcast, Maria Vermazes. Maria.
Maria Varmazes
Hi, Dave. And hi, Joe.
Joe Kerrigan
Hello, Maria.
Dave Buettner
We've got some good stories to share this week, and we will be right back after this message from our show sponsor. And now a few thoughts from our sponsors. At ThreatLocker, the tactics used by cybercriminals are becoming more and more advanced every day. The shift from a default allow approach to a default deny is more critical than ever. This is where ThreatLocker comes in. Stay tuned for how ThreatLocker allow listing and ring fencing has your back. All right, we are back and we have some follow up. Joe, what do we got?
Joe Kerrigan
We do. Dave, another Dave wrote in with a request for help. He says, hello, Dave. Joe, I hope you're well, or at least better than a good friend of mine who fell victim to a dream job scam via social engineering. Lost about $70,000. Oh, yeah, that's terrible. My friend is very intelligent, but having listened to most of your podcasts, I know that very well that no one is immune to these scumbags.
Maria Varmazes
Exactly.
Joe Kerrigan
That is 100% correct. Your friend did not fall for this because he was stupid, but because he is human and. And these guys exploited that. Remember, these people that do this are the bad guys, not the victims. I'm reaching out to you in the hope that you can recommend a scam victim support group. I'm helping my friend understand what happened to them and how common it is. But what they require is immediately is some people to talk to. We're in Australia. I'm currently going through every bit of information they have collected concerning the scam and looking into it all for them doing the investigation. Are you aware of any groups for scam victims?
Dave Buettner
Yes.
Joe Kerrigan
Okay.
Dave Buettner
And I'll have a link in the show notes for a article that the Washington Post did on this very topic on scam victim support groups, and there are many of them out there. I don't know specifically about Australia, but I would imagine this being the era that it is, that probably a lot of them take place online. I understand. You know, time of day between the US And Australia can Be challenging, but I suspect there are local groups as well, but specifically here in the US aarp, which is the. What is it? American association of Retired People. Is that what it is?
Maria Varmazes
Retired person.
Joe Kerrigan
Retired persons, yes.
Dave Buettner
Got it. Got it. Yeah.
Joe Kerrigan
Now it's just aarp. They took that out.
Dave Buettner
Oh, okay.
Joe Kerrigan
Because once you turn 50, they start sending you the mail.
Dave Buettner
Yes.
Maria Varmazes
I started getting it at 29, if that makes anyone feel better.
Joe Kerrigan
Really? That somehow does actually make me feel a little bit better.
Maria Varmazes
Yeah. You know, when I was. When I was like, you know, 30s, coming around the bend and I get the AARP letter, I'm like someone playing a sick joke.
Dave Buettner
Okay? You're just an old soul, Maria.
Joe Kerrigan
That's what it is.
Maria Varmazes
I've been accused of that before.
Dave Buettner
I got them. Yeah, I definitely started getting them around 50. And anyway, they go right in the.
Joe Kerrigan
Trash, don't they, Dave?
Dave Buettner
Well, you know what? I've also learned that I want to say at like, 55, you can start getting discounts at 50 fast food places. Some places will give you discounts, so I'm not too proud for that.
Joe Kerrigan
Yeah, yeah. What's the senior discount? I do know this for a fact, that if you go into a Roy Rogers, there's not that many of them left. But if you go into the Roy Rogers with a cowboy hat on and ask for the cowboy hat discount, you will get one.
Dave Buettner
Really?
Joe Kerrigan
Yep.
Dave Buettner
Totally you, Joe. Totally you.
Maria Varmazes
Jesus.
Dave Buettner
You know what? Stop. Okay? How did you find out about this? So how did you find. How did you learn about. Because here's what I'm about imagining. I'm imagining you turning into a Roy Rogers wearing your cowboy hat and saying, announcing proudly, hey, partner, can I have a cowboy?
Maria Varmazes
I want a video of this.
Dave Buettner
And the person behind the counter going, oh, for God's sake.
Joe Kerrigan
Well, you're very close. It's almost like you were there. Because that is exactly what happened. Because I. I do enjoy wearing a cowboy hat.
Dave Buettner
Yes.
Maria Varmazes
Do you really?
Joe Kerrigan
I do.
Dave Buettner
Yeah. You look good in a cowboy hat. You can. Not everyone, like, I don't think I can pull off a cowboy hat, but I think you can.
Joe Kerrigan
And one of my favorite things, this particular cowboy hat is it's a working hat. So it's like one you wear when you're doing yard work.
Dave Buettner
Okay.
Maria Varmazes
Damn.
Joe Kerrigan
It prevents you from. Yeah, I. I actually have multiple cowboy hats.
Maria Varmazes
This is like a geek guy rule. It's the fedora. It's a bowler. A cowboy hat. You gotta have a hat.
Joe Kerrigan
Right, the cowboy hat.
Maria Varmazes
I married a fedora guy.
Joe Kerrigan
So it's all right, well, that's my preferred distro of Linux, if that counts.
Maria Varmazes
You know, I walked right into the Linux. It's fine. It's fine.
Joe Kerrigan
So the reed cowboy hat, they're not expensive. You get it for less than 100 bucks and you wear it outside and like when you're about to pull on a branch and you start tapping the cowboy hat with your branch, you go, oh, that's a little close to my head. Don't want to pull on that. Or you can. It has saved me from bonking my head. It's almost as good as a hard hat. It provides a lot of warning. It doesn't provide any of the protection that a hard hat would provide, but it lets me know because my head's getting close. Exactly.
Dave Buettner
Which can also, if you're like walking on a trail, help with spider webs.
Joe Kerrigan
Yep. It helps with. That helps with branches. It does a fantastic job of keeping the sun off your head.
Dave Buettner
So I walk in the White House. What a hatchet, please.
Maria Varmazes
Yep.
Joe Kerrigan
I walk in there and I've been doing some work. I was in Westminster. I don't know why I was up there, but I had my cowboy hat on. And I walk in and I'm like, there's a picture of Roy Rogers on the wall with a white cowboy hat. And I'm wearing my white reed cowboy hat. And I just look at the woman and go, can I get the white cowboy hat discount like Roy over here? And she goes, I can do that with a small.
Maria Varmazes
Is there a black hat discount?
Joe Kerrigan
I don't know. That's a good question.
Dave Buettner
You sold the place up.
Joe Kerrigan
That's right.
Maria Varmazes
Agree.
Joe Kerrigan
My other hat is a black hat. I have a white hat and a black hat.
Maria Varmazes
Of course, of course. The black hat discount is you just take it, Right?
Joe Kerrigan
Yeah. I just walk in, give me the food, I leave.
Dave Buettner
Or you just help yourself to the Fixin's Bar like it's a salad bar.
Maria Varmazes
I'm a hacker. Don't mind me.
Dave Buettner
Pixels. No. Pickles and ketchup. Yeah, make yourself a pickles and ketchup salad.
Joe Kerrigan
Right.
Maria Varmazes
That is a black hat thing to do.
Dave Buettner
Yeah.
Joe Kerrigan
So the long, long end of the story is the AARP runs a couple of groups for runs, scam victim groups. There are also. I would imagine that if you're in Australia, there might be a similar organization for retired people that might have the same kind of thing. I don't know.
Dave Buettner
Yeah. There's another organization I saw online, and I can't vouch for this, but they're called fightcybercrime.org and they have a romance scam recovery group. So, you know, obviously there's a need for this, and so there are folks out there who are doing it. So, you know, kudos for you, Dave, for being a good friend and trying to help your friend, because this is certainly traumatic, what they've gone through.
Joe Kerrigan
And $70,000 is a lot of money.
Dave Buettner
Yeah, absolutely.
Joe Kerrigan
But it is not unrecoverable. I mean, not. You can't. It's not. It depends, actually. It depends on how old your friend is and how much they have and what percentage they lost, you know, but this is not the end of everything. You can recover from this. So don't, you know, don't get disheartened, I guess. I mean, yes, this sucks. If I lost $70,000, I would be absolutely enraged. Yeah. You know, I'd be trying to find out where these guys are and buying.
Maria Varmazes
Plane tickets with your cowboy hat on.
Joe Kerrigan
With my cowboy hat on, I'd show up with my cowboy hat on.
Dave Buettner
Yeah.
Joe Kerrigan
All right, partner.
Maria Varmazes
Yeah. I think it's interesting that these groups that we've mention are all for pensioner age folks, but I think there need to be more groups. And I'm not saying this is anyone's fault, just I think we're gonna also see more groups for younger folks, because if you're still seeking employment or if you've been the victim of a romance scam and you're, I don't know, a teenager, which is happening a lot too.
Joe Kerrigan
Oh, yeah, it's awful. And there needs to be that support group for those teenagers because these boys are just. Are just killing themselves. Literally. Literally a lot of them. Horrible. Horrible when this happens. Yeah. Yeah. There needs to be a support group for this. For that in particular, there needs to be. There should be a support group for people who've lost money. This is. Yeah, it's something that needs to be done.
Dave Buettner
They're out there.
Maria Varmazes
Yeah.
Joe Kerrigan
And they are out there, but, like.
Maria Varmazes
I didn't know of any. Yeah, I'm glad to be online. I appreciate that you both pointed it out because off top of my head, I wasn't aware of any. But there is a need, so.
Dave Buettner
Yeah. Well, this article in the Washington Post has a number of sources here, so maybe that's a good place to start your journey. I will add, just to put a button on the Roy Rogers thing, that when I was about 8 or 9 years old, I was in a Roy Rogers TV commercial. No way. Yep. I got to meet Roy and Dale. Yep. Really?
Maria Varmazes
Who is Roy Rogers? I don't know.
Dave Buettner
Oh, my.
Maria Varmazes
Wow.
Dave Buettner
Wow. Oh, boy.
Maria Varmazes
Yikes.
Dave Buettner
Joe, what's the name of Roy Rogers? Horse Trigger. Trigger.
Maria Varmazes
Was that a trigger warning? Yeah.
Dave Buettner
Oh, my goodness. Well, Maria, you. You've got homework, my friend.
Maria Varmazes
Do I?
Dave Buettner
You have got some homework, if you choose to accept it. Roy Rogers was the most famous of the singing cowboys. So the generation of Joe. And my parents would have gone to weekly serial movies at their local movie theater. And my mom did this.
Maria Varmazes
So you pay at a nickelodeon, perhaps one might call it.
Dave Buettner
You'd go. You pay a nickel. You'd go to the movie theater and you'd see. And this is literally where the cliffhangers were. You know, every. They'd get in trouble and the movie would be at the end and there'd be a cliffhanger, and so you'd come back the next week. But Roy Rogers was one of the most famous of them, and he was a singing cowboy along with his wife, Dale, and.
Maria Varmazes
Wait, his wife's name was Dale?
Dave Buettner
Dale Evans?
Joe Kerrigan
Was her name Dale Evans?
Dave Buettner
Yep.
Maria Varmazes
Okay.
Dave Buettner
Yeah, yeah.
Maria Varmazes
Forgive me. I'm an immigrant's kid. Anything from before my time, I would.
Dave Buettner
And they're sang a song called Happy Trails.
Joe Kerrigan
Happy Trails.
Maria Varmazes
I've heard that song in my life.
Dave Buettner
Yeah, that's Roy Rogers.
Maria Varmazes
I just lack any cultural contacts in the United States before a certain year. So. I'm sorry, I'm just like. It's blank.
Dave Buettner
Well, I tell you, it was a thrill for my mother to meet Roy Rogers in person. So that was the best thing about that day.
Joe Kerrigan
And the restaurants are concentrated mostly here in Maryland. Maryland. We are fortunate to live in the state with the most Roy Rogers restaurants.
Maria Varmazes
Why do you know that?
Joe Kerrigan
I read the Wikipedia article. I don't know. You're getting into something I love.
Dave Buettner
He gets a cowboy hat discount. Why wouldn't he know this?
Maria Varmazes
I mean, but, like, do you know that. That Marilyn has the most, like. Why is that, like, a thing in your pocket that you have.
Joe Kerrigan
It's 22.
Dave Buettner
I mean, he doesn't wanna.
Joe Kerrigan
I just read the Wikipedia article, like, two weeks ago.
Maria Varmazes
Okay. It's like, I have no idea how many Dunkin Donuts are in Massachusetts. I really don't. Like, I feel like I should know that now.
Dave Buettner
Well, Joe gets itchy if he's more than a certain number of miles away from Roy Rogers.
Joe Kerrigan
So get the old Double R bar.
Dave Buettner
All right?
Joe Kerrigan
Pickles and barbecue.
Dave Buettner
Let's move on. So thank you, Dave, for writing in. We do appreciate it. What a rat hole that was.
Maria Varmazes
Yes, thank you for that.
Dave Buettner
And again, thank you for being a good friend to your friend. That's great to hear. All right, let's move on to our stories here. Maria, why don't you start things off for us?
Maria Varmazes
I just wanted to mention there are apparently over a thousand Dunkin Donuts in Massachusetts. So I've now answered my question. I googled it real quick. All right, there you go.
Dave Buettner
You can visit everyone.
Maria Varmazes
I don't like their coffee. All right, so my story is a quick follow up, actually, from the story that I covered last week, but also have been talking about now and then about people using essentially the, the latest and greatest and deepfake technology to fraudulently apply for jobs in the United States when they themselves are, I don't know, a North Korean hacker. We've talked about how people have applied for jobs at security companies and actually been successful in infiltrating security companies doing this. And last week we talked about how one software engineer, I'm just summarizing people who missed it. A software engineer actually was a screening out another technical applicant when the guy had like a very obvious deep fake face. It was quite a shocking video, actually. So the story that I have here comes from El Reg Jessica Lyons at the Register. The headline is Arizona. Arizona Laptop Farmer pleads guilty for funneling $17 million to Kim Jong Un. Always love their headlines.
Joe Kerrigan
So basically, basically, that's a lot of money.
Maria Varmazes
That is a lot of money.
Joe Kerrigan
It's going to buy a lot of missiles for that guy.
Maria Varmazes
Oh, that's, that's, that's a really comforting thought. This woman allegedly, no, her name actually is Christina Marie Chapman, but she pleaded guilty to conspiracy to commit wire fraud, aggravated identity theft, and conspiracy to launder monetary instruments. And essentially for over the course of three years, she ran a laptop farm out of her home in order for North Korean hackers or hackers employed by the North Korean state to have a credible US Based IP address for those fake job applicants to have a sort of believable geolocation. So when they're going through the application process with, as a remote employee of a United States company, perhaps they had a convincing deep fake. But you also have to pass other sort of security measures that companies put in place to make sure that you're a legit hire and one of them is checking where your geolocation is. At the very least, make sure you're, you appear to be based out of the United States. It's sort of like a very basic thing. And she just had a whole bunch of laptops in her house to give those hackers that US Based geolocation. And the court documents are actually really interesting read. Which is not a phrase I think I've ever said in my life. I found this really interesting paragraph that I just want to quote if you all don't mind, because I just thought it was so neat. The conspiracy perpetrated a staggering fraud on a multitude of industries at the expense of generally unknowing U.S. companies and persons. It impacted more than 300 U.S. u.S. Companies, compromised more than 60 identities of U.S. persons, caused false information to be conveyed to DHS on more than 100 occasions, created false tax liabilities for more than 35 U.S. persons, resulted in at least $6.8 million of revenue to be generated for the overseas IT workers. And they worked at blue chip U.S. companies, including a top five National Television Network and media company, a premier Silicon Valley technology company, an aerospace and defense manufacturer. Oh, that's very comforting. An iconic American car manufacturer, a high end retail chain, and one of the most recognizable media and entertainment companies in the world. All of which were Fortune 500 companies. The overseas IT workers also exfiltrated data from at least two US companies. A multinational restaurant chain. Maybe it was Roy Rogers and. No, no, don't.
Dave Buettner
So assuming they got the barbecue sauce recipe. Joe.
Joe Kerrigan
Oh, I hope I can get my hands on that because that is a good barbecue sauce.
Dave Buettner
It is.
Maria Varmazes
It did. He's like, don't call me. And a classic American clothing brand may have been a cowboy hat manufacturer. Joe, a lot of things are adding up to you. I'm just saying. And the overseas IT workers also attempted to gain employment and access to information at two US Government agencies on three different occasions. Although the court documents noted that they were thwarted due to the agency's enhanced due diligence. How nice. And I was looking at the line items of what each fraudulent employee gained. One employee alone, over three years managed to net over a million dollars as a salary like $814,000. And I looked at the fraudulent names and I was looking for a Gammaria V in case my identity had gotten stolen and was right.
Joe Kerrigan
Am I in here?
Maria Varmazes
There is a JO C. Oh, no.
Dave Buettner
There you go.
Maria Varmazes
Completely for real. So maybe it really was Ray Rogers. Instead I got one.
Joe Kerrigan
Now I gotta go look at the court documents.
Maria Varmazes
I just gave you homework. You gave me some and I've given you some. So there you go.
Dave Buettner
Wow.
Joe Kerrigan
No Dave B though, right?
Maria Varmazes
No, there was no Dave B. I was looking for a Dave B. And a Maria V. Nothing. But there's a Josie. So.
Dave Buettner
Okay.
Joe Kerrigan
Well, I haven't heard anything from the IRS about my tax returns not being right so far.
Dave Buettner
Well, yeah, because, you know, don't hold your breath, Joe.
Joe Kerrigan
They'll send you a letter, like, when you submit your tax returns, and they go, you left this W2 off your tax return. Yeah.
Maria Varmazes
I'm sure Doge is right on it right now. So. Just right.
Dave Buettner
Yeah.
Joe Kerrigan
So I guess they'll do that. I don't know. I have to talk to my son. That would be what I would expect, would be, because he's an accountant.
Maria Varmazes
Oh, there you go.
Joe Kerrigan
What do I know? Yeah, cybersecurity stuff, not accounting stuff.
Dave Buettner
Yeah.
Joe Kerrigan
He got upset with me the other day because I got a tax document. I said, I'll put this on my IRS pile. And he goes, you mean file? No, on my desk. Just a pile of documents.
Dave Buettner
Yeah. Yeah.
Maria Varmazes
I just did my taxes last night. So I relate. Yeah, it was. I. This story, I thought was just an interesting add on to how sophisticated these efforts are getting that we keep covering. And in case there was any question, this woman 100% knew what she was doing, so she pled guilty. And, oh, boy, is that data chain there. A lot of communications where she absolutely knew what she was doing. So it's not like her laptops got hijacked or something.
Dave Buettner
Right.
Maria Varmazes
She was part of a very sophisticated thing.
Joe Kerrigan
A bunch of laptops in her house. Right?
Maria Varmazes
Oh, yeah. I just wanted to make sure in case anyone's going, oh, maybe she didn't know. She did. She knew what she was doing. There was a lot of them. I was actually trying to figure out how many laptops there were because I wanted to get a sense, but I couldn't figure that out. Maybe I missed it, but if anyone knows, I bet it was a lot.
Dave Buettner
What a terrible thing to be involved with. Like a. You know.
Joe Kerrigan
Yeah. She may not train your.
Dave Buettner
Your countrymen.
Joe Kerrigan
She may not have known it was North Korea that was doing it, but maybe she did.
Dave Buettner
Yeah. I mean, I don't think she's earned the benefit of the doubt.
Maria Varmazes
Right.
Joe Kerrigan
Yeah, I'll agree with you on that.
Dave Buettner
All right, well, we will have a link to that story in the show notes. My story this week comes from Wired. This is an article by Lily Hayne Newman, whose work I always enjoy over at Wired, and it's titled the Loneliness Epidemic Is a Security Crisis. And it's about romance scams and the proliferation of those. But what really caught my eye, and why I think it's worth sharing, is this is a good article that you can send around and send to your friends and family, your loved ones, because it really does go through the highlights of what's going on with romance scams, how to avoid them, the types of manipulation they use. So I thought it'd be nice for us to go through it together here. One of the things they highlighted, which I guess is not surprising, is that more and more of these scammers are using AI in their scammer operations. They're using AI generated profiles on dating apps. Organized crime groups in Southeast Asia are using these AI tools to generate personalized scripts in real time conversations using multiple languages. And both the FBI and Google are reporting that AI has just made it easier for these folks to do what they do faster with a lot more volume. So I thought I'd go through a list of some of the techniques that they use for these romance scams. Love bombing.
Joe Kerrigan
Yep.
Dave Buettner
You ever been love bombed?
Joe Kerrigan
No, this never happened to me.
Maria Varmazes
Well, lucky I have. Yep.
Dave Buettner
And love bombing is. Well, so we should explain what it is. This is one of these excessive terms of endearment to build fast emotional connections. So people will often love bomb when they are trying to get you to join a group. Love bombing is really common with cults where they will find someone who is in a state of emotional weakness and they will just pepper this person with compliments and love and make the person feel like they're important and they're loved and provide them with connections. And it's effective. It works. Especially if someone's in a bad place.
Maria Varmazes
Yes.
Dave Buettner
So they do that. They ask a lot of personal questions, which is a way to gain trust with the person. To say, I'm your confidant, you can tell me. I know, hey, it's none of my business, but I'm just wondering. They feign vulnerability. This is a lot of scammers pretend to have been scammed themselves to appear trustworthy. So they'll say, you know, I am hesitant to get into this relationship with you because I've been hurt so many times before. In fact, I got scammed one time and I lost a bunch of money and I sure would, you know, I'm nervous that you're trying to do that to me. Right.
Joe Kerrigan
That's interesting. They turned the table on that. Yeah. And that is probably very disarming to the person that is being scammed.
Dave Buettner
Right.
Maria Varmazes
It sure is. Because it's awfully close to the real. How real connections are often made is with that sharing of vulnerability. Right. So.
Joe Kerrigan
Right.
Maria Varmazes
But if you're only, you know, Showing your belly briefly, it sort of gives the scent of. I'm really mixing metaphors, but sort of makes you feel like you're trustworthy. But it's only, it's, you know, it's. It's brief. Right, right. Yeah. It's. It's amazing though, that it, when you try to describe this as someone who's going through it, I'm sure maybe you've done this, Dave. Also, it does sound a lot like, well, this is how real people connect with each other. But it's just like, it's slightly off, it's slightly different. Yeah, it's tough.
Dave Buettner
This article mentions financial manipulation where they will mention money problems but they won't directly ask for help. So they wait for the victim to offer assistance rather than ask for it.
Joe Kerrigan
Because that way it's the victim's idea.
Dave Buettner
That's right.
Maria Varmazes
Right. Yeah. Just lead them to water.
Dave Buettner
You're not triggering the thing in the victim's mind that says, this person is asking me for money. All you're doing is talking about your troubles. And out of the goodness of their heart, the victim says, well, I have money. Why don't I just send you some and you can pay me back later? You know, that, that sort of thing, that's what they take advantage of.
Joe Kerrigan
I'm always reminded of Steve Martin in Dirty Rotten Scoundrels.
Dave Buettner
Yeah.
Joe Kerrigan
When he's at the, the table with the woman on the train and he's, oh, these prices, you know.
Dave Buettner
Oh, right, right, right.
Joe Kerrigan
And he never asked her, but she buys him lunch. And Michael Caine watching him and rolling his eyes.
Dave Buettner
Yeah. Fun movie.
Joe Kerrigan
It is a fun movie.
Maria Varmazes
It's such a good movie. I love it.
Joe Kerrigan
It's good. But this is the way I feel every time someone starts talking about money problems to me. And, you know, I don't want to say I'm invulnerable to all this stuff, but if somebody starts giving me a lot of compliments, I'm immediately suspicious.
Maria Varmazes
If somebody.
Dave Buettner
Because of how well you know yourself.
Joe Kerrigan
Yeah.
Maria Varmazes
When you've got crap, low self esteem, you're like, yeah, this guy thinks I'm on the take. Yeah.
Joe Kerrigan
Maybe that's the issue.
Dave Buettner
The joke's on you. I've got more self loathing than you can possibly break through.
Joe Kerrigan
That is true.
Dave Buettner
True.
Maria Varmazes
But the other thing is, I know you're lying.
Joe Kerrigan
The.
Dave Buettner
What was it?
Joe Kerrigan
What was the second one that they did not. Not the love bombing, but asking personal questions. Asking personal questions. Nothing, nothing will shut me down quicker than that.
Dave Buettner
Yeah.
Maria Varmazes
You know, that's Cause we're from the Northeast, Right.
Joe Kerrigan
Maybe. Maybe it is.
Maria Varmazes
I was raised by a woman from.
Joe Kerrigan
New York, and she was like, why are you asking that question would be something my mom would ask.
Dave Buettner
Okay. Interesting.
Maria Varmazes
Yes, that is. I mean, that's why a lot of us have that frosty reputation. But people don't understand that is completely out of self preservation. If you start asking me for something and you're a stranger, I meet you on the street. I am always very suspicious until proven otherwise.
Dave Buettner
Yeah.
Joe Kerrigan
Because my wife and her family are from West Virginia, and they initially found me to be very rude.
Maria Varmazes
No, you. No, Absolutely not.
Joe Kerrigan
They love me now.
Maria Varmazes
Oh, that's good.
Joe Kerrigan
Yeah. But initially they're like, that guy, he. But I think you're right, Marie. It's the Northeast. It's a New York City kind of thing. New York. Well, up in the Northeast, where you will say, why are you asking that kind of question? What makes you think that I want to answer that question?
Maria Varmazes
Yeah. When I was a freshman in college in New York, a lot of my friends were Korean American. That was just how it ended up. And I remember on the second week of school, one of my friends who was from the suburbs, she met up with us and basically said, you know, there was this guy I met on the subway, and he needed like 50 bucks for a thing. So I just gave it to him. And there's no way he could have been a scammer because he spoke Korean like I do. And we all just kind of went like, are you serious? No, just instantly she just trusted him because he also spoke Korean. It's like you got taken. Are you serious?
Joe Kerrigan
Yeah. That common language bond. We've had stories on here about that.
Dave Buettner
Yep. Yeah, true.
Joe Kerrigan
You know, exactly. You're in a. In a. I think. Was it. Was it England or was it. I don't think it was in England.
Maria Varmazes
It was here in the U.S. yeah.
Joe Kerrigan
Was it?
Dave Buettner
Yeah.
Maria Varmazes
Well, it happens everywhere, but. Oh, no, no, you're right. That story specifically was in England. That's right.
Joe Kerrigan
The Cantonese. Because Cantonese is not the majority language. Mandarin is what most people speak, I think, in China. But so if you speak Cantonese, you're already part of a smaller population globally, and now you're in England speaking Cantonese.
Dave Buettner
Right, right.
Joe Kerrigan
I mean, yeah.
Dave Buettner
Yeah.
Maria Varmazes
But it was.
Dave Buettner
This article wraps up with some discussion of the psychological impact and how the victims can be susceptible to this. So they point that scammers use language that is similar to coercive controllers and abusers, which I guess is not surprising that they have that ability to manipulate.
Joe Kerrigan
Someone emotionally, they are coercively controlling and abusing somebody.
Dave Buettner
Yeah, that makes sense. It says the victims, especially the ones who are experiencing loneliness, often struggle to accept that the romance is fake. And the police say it is extremely difficult to convince victims that they're being deceived. Yep.
Maria Varmazes
Or worse. Or worse. They know they are. And they're like, I don't care because this is better than nothing. I've seen that a few times. That's always like, oh, I don't even know what to do about that one.
Dave Buettner
Yeah, yeah. There was a famous story from years ago about someone who was before the online era. He was doing basically romance scams through pen pals. And this was this guy's living was, you know, having pen pals that we pretended to be women. And when he finally got arrested and brought to in front of a judge, more than one victim said that they didn't really feel victimized, like it was entertainment to them, you know, like it was worth it. So, I mean, what a strange. It's a strange thing for us to ponder.
Joe Kerrigan
But.
Maria Varmazes
But it's real humans for you. Yeah, it's real. Yep.
Dave Buettner
Yeah. Silly humans. All right. We will have a link to that story in our show notes. We're going to take a quick break to hear a message from our sponsor, so let's return to our sponsor. ThreatLocker. Threat Locker is a zero trust endpoint protection platform that strengthens your infrastructure from the ground up. Where traditional cybersecurity tools require you to create a list of things you don't want to run, Threat Locker enables you to easily curate an allow list of everything you need in your environment and network and block everything else by default. With ThreatLocker allowlisting and ring fencing, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker provides zero trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware. The ThreatLocker Zero Trust Endpoint Protection platform deploys in a learning mode that analyzes the operations of your company using machine learning to assist you in developing your allow list for approved applications. What they can do on the endpoint, what can interact with your data, and even east and west network traffic. We thank ThreatLocker for sponsoring our show. And we are back. Joe, you are up. What do you got for us this week, Dave?
Joe Kerrigan
I got three things, which is a lot of things, but they're all really short. Okay, first one is the two weeks ago I talked about my office mate, Michelle Getting a text message.
Dave Buettner
Yeah.
Joe Kerrigan
Yesterday or two days ago, I got the exact same text message on my phone. These are both on our work phones. And with just a different URL, a different domain, everything else was the same.
Dave Buettner
Okay.
Joe Kerrigan
Including the www.irs.gov prefix of that URL. It's just a new domain. That's it. Everything else was the same. So these guys are just out there running this scam with new domains all the time. And apparently it's working because they're still doing it. Next thing I have is an interesting story about a thief who used a barcode ring to scam Walmart self checkout. So he had a ring with a barcode printed on the ring. So when he would run something over the scanner, it would ring up as a 70 cent can of great value tomato soup.
Maria Varmazes
Now, points for innovation, right?
Joe Kerrigan
That's what the police said.
Maria Varmazes
I am the police.
Joe Kerrigan
Right. So how he got caught was he rang up a $300 grill.
Maria Varmazes
Oh, he got greedy.
Joe Kerrigan
Yeah, he got greedy, Exactly. Paid the $0.70 blunder and then drove out. And of course Walmart has security, right? They're watching. There's always somebody watching something at Walmart. And I don't know if you have the. If you've ever been to a Walmart, Dave, you ever had to. You ever been to a Walmart, Maria?
Dave Buettner
Oh, yeah, yeah.
Joe Kerrigan
You go and use her self checkout because that's pretty much all that's open and it's got a camera facing you.
Dave Buettner
Right? Right.
Maria Varmazes
Oh, my kid loves to dance in those camera views. She always waves and dances.
Dave Buettner
She does it.
Joe Kerrigan
I always tell those people on the.
Maria Varmazes
Camera, honestly, me too. I'm like, you're probably bored if you're looking at this.
Dave Buettner
Hi.
Maria Varmazes
Dancing, an elevator, all of that.
Joe Kerrigan
Give somebody, they said, okay, that guy's walking out of here with a $300 grill paying 70 cents. Loss prevention says, I'm just gonna call the police, gets the license number. The police tail him home as soon as they get home, as soon as the police find him, he says, yeah, I just use this ring to ring it up. And they now charged him with felony burglary. Okay, so that's my second story.
Dave Buettner
So first of all, like Maria said, points for cleverness.
Joe Kerrigan
Correct.
Dave Buettner
I mean, but the thing that I wonder about is, my understanding is with self checkout is that somehow they're calibrated to the weight of the thing being purchased. So if you scan a can of beans that weighs 16 ounces, you put that on the little platform where the bagging stuff is and it reconciles the can of beans with what it thinks it's supposed to weigh. So if you have, I don't know, a little box of toothpicks that's different than a can of beans or a greeting card or something, something like that, that doesn't weigh very much.
Joe Kerrigan
You know, Dave, I've seen these, I've used these self checkouts, things that insist that you put the item on the scale. You know, the bagging scale.
Dave Buettner
Yes.
Joe Kerrigan
But I've never tried to like put something of a different weight on there. Like, you know, buy a. Scan a can of soup and then put a gallon of milk on there, which is like eight, eight times the weight of a can of soup.
Dave Buettner
Yeah.
Maria Varmazes
How do you weigh a grill?
Joe Kerrigan
Yeah, you don't weigh a grill. You have to skip bagging.
Dave Buettner
And so, like, for example, because I use the self checkout all the time at my local grocery store and sometimes I will buy, let's say a 12 pack of cans of soda. Right. Which doesn't need to go in a bag. And so they're calibrated for. When you ring something like that up, it says put it in the bagging area or back on your cart. So it knows that that's something that might not go in a bag.
Joe Kerrigan
Okay.
Dave Buettner
And if you put. And it's okay with you putting it in your cart, something else like a can of beans, it's not okay with you just putting it back in your cart. It wants you to put that in the bagging area. And I've also had it say to me an unexpected item is in the bag.
Maria Varmazes
An expected item in the bagging area.
Dave Buettner
Yeah, right.
Joe Kerrigan
Well, I'm going to check that now.
Dave Buettner
So you're going to do some A B testing?
Joe Kerrigan
Yeah, do some a B testing on this.
Maria Varmazes
Don't get arrested. Don't get arrested.
Dave Buettner
And that, ladies and gentlemen, is why Joe is no longer allowed in the Walmart.
Joe Kerrigan
There's other reasons I'm not allowed in the Walmart.
Dave Buettner
You know what's going to happen?
Maria Varmazes
Cowboy hat.
Dave Buettner
You know what, here's what's going to happen. Our friend Mallory Safoste, who from the local affiliate is going to be showing a blurry picture of a man in a white cowboy hat sprinting out of the Walmart with security people chasing after him. And I will have to pretend like I don't know who that is.
Joe Kerrigan
Right. There was one time I was watching the news and they put up a picture of a guy who had gone into a gym and broken into a bunch of lockers and stolen like $1,000 worth of watches out of the locker. Yeah, this guy looked exactly like me.
Maria Varmazes
And I was like, oh man, there goes that alibi.
Joe Kerrigan
Right?
Maria Varmazes
I mean, I mean it was a.
Dave Buettner
Nice watch you sold me though, Joe. I have to say.
Joe Kerrigan
I showed it to a co worker of mine, he says that guy looks like you. I'm like, I know. He stole watches out of a gymnasium.
Dave Buettner
Well, fortunately, nobody's gonna catch you at a gym.
Maria Varmazes
That's right.
Joe Kerrigan
Not gonna catch me at a gym.
Maria Varmazes
Dang.
Dave Buettner
All right, what's your last story?
Joe Kerrigan
If you weren't gonna say it, I was.
Dave Buettner
What's your last story?
Joe Kerrigan
Last story is a little bit of good news out of Australia.
Dave Buettner
Okay.
Joe Kerrigan
And this actually kind of ties back in with our letter from Dave, but Australians. This is from Kat Wong at aap. There is game changing anti scam laws to protect consumers and they are working on passing this law in Australia. Businesses could be fined up to $50 million if they do not maintain strong scam defenses. Also victims will have clearer pathways to compensation. So there are three fronts of this, three things we're talking about. The law establishes scam prevention framework that banks and telecommunication companies and media organizations, social media organizations have to do with the have to. The guidelines are going to have to follow. The first one is that banks are going to have to verify who they're sending the money to, when they're sending money for a person. Now these regulations haven't finalized yet but the bank is going to have to is they're going to have to confirm the payee identities for people that are now that will help get, you know, if you think you're sending money to your grandson who's calling you from a Mexican prison. Right, yeah.
Dave Buettner
Know your customer regulations.
Joe Kerrigan
Exactly. But this is no other people's customers. Telecommunication companies will be required to detect and disrupt scam numbers which, which I'm surprised is not something that we can just do. But it isn't apparently. And then the social media companies and other big tech companies are going to have to validate that they are selling ads to legitimate people, which I think Google's not going to like. But no good.
Dave Buettner
It's good to see the burden shifted more towards the, the providers here.
Joe Kerrigan
Yeah, I agree. All right, so now this is an Australian law. I don't look for anything like this to happen in America anytime soon, I would say. But yeah, it's a good step forward. If Australia gets this law passed and puts these compliance problems or compliance regulations in place, they may have an ancillary.
Dave Buettner
Impact on Us could be a model for the world.
Joe Kerrigan
Could be a model for the world, but it could also just be that, you know, Google doesn't want to have a different regulations set for everybody, so they're just going to go have a, have a validation ad, ad verification process that they follow.
Dave Buettner
Yeah.
Joe Kerrigan
And then we get to benefit from that because of Australia. I don't know if that's the case. I would like to think that's the case, but I would say the companies like Google and Meta, they're, they don't care. They, they really. I, I have become very jaded about this, Dave and Maria. I, I really, I really think that they know that they're profiting from scam ads and they just don't care. They would rather have the money.
Maria Varmazes
I think you're right.
Dave Buettner
There's a lot of evidence to support that claim.
Joe Kerrigan
Right.
Maria Varmazes
Yeah. I was like, that's not even a spicy take. I think that's just facts. Straight facts. Yeah.
Dave Buettner
All right, well, we will have a link to all of your stories in the show notes and of course, we'd love to hear from you. If there's something you'd like us to consider for the show, you can email us. It's hackinghumans2k.com Joe, Maria, it is time for our catch of the day.
Joe Kerrigan
Dave, our catch of the day comes from R. Scambait on Reddit and the user is second hundred K. It's a scammy text exchange.
Dave Buettner
Yeah. All right, Maria, you want to start us off here?
Maria Varmazes
All right. I guess I'm the scammer, huh?
Dave Buettner
You are the scammer, yes.
Maria Varmazes
Oh, fun. Okay, what is dinner?
Dave Buettner
I was thinking I would pair your liver with fava beans and a nice Chianti.
Maria Varmazes
Hi, Alexander. I'm Jane.
Dave Buettner
Hello, Jane.
Joe Kerrigan
It's a pretty good Hannibal lecture.
Maria Varmazes
Yeah, I mean, that's eerie as hell. Hello. Nice to meet you here. Are you Alexander?
Dave Buettner
Yes. Have you ever seen blood in the moonlight, Jane? It appears quite black.
Maria Varmazes
No, no, I never saw. Sorry. No, I never saw it.
Dave Buettner
On a related note, I must confess, I'm giving serious thought to eating your cousin.
Maria Varmazes
Very nice, Alexander. Your name is the same as my friend. Heart emoji.
Dave Buettner
Very nice indeed, Jane.
Maria Varmazes
Sorry, I accidentally messaged you because I saved the wrong number.
Dave Buettner
Remarkable girl. Jane, I admire your courage. I think I'll eat your heart. And it ends there. End scene.
Maria Varmazes
Why are you so good at that? That's so terrifying, right?
Dave Buettner
I don't know. Just a little inner psychopath, you know, Just channeling my inner psychopath.
Maria Varmazes
That movie scared the. Oh, my God.
Dave Buettner
Yeah.
Joe Kerrigan
Anthony Hopkins. Best Hannibal ever.
Dave Buettner
Saw that one in the theater, and let me tell you, it's a tough one. Yeah.
Maria Varmazes
Yes.
Joe Kerrigan
Yeah.
Dave Buettner
What's the little dog's name?
Joe Kerrigan
Precious.
Dave Buettner
Precious.
Maria Varmazes
Precious.
Dave Buettner
Just more Precious.
Maria Varmazes
Precious.
Dave Buettner
More Precious.
Joe Kerrigan
I think it was Precious, right?
Dave Buettner
Yeah. You know, it's Precious. All right. It was Precious. All right. Well, that is our catch of the day. And again, we would love to hear from you. If there's something you'd like us to consider for the show, please email us@hackinghumans2k.com but I guess we should. Do we need to explain what the scam is that was going on here as is our. Or are we all just too weirded out to.
Maria Varmazes
No, no.
Joe Kerrigan
This is the beginning of the wrong number scam. Oh, I misdialed, but. And then they start doing. This is what I did. This is the kind of person I was messing with a couple months ago when I was in Texas actually buying my white cowboy hat.
Dave Buettner
You have a strategic cowboy hat reserved?
Joe Kerrigan
I have a place I go, Dave.
Dave Buettner
Oh, I see.
Maria Varmazes
You have a place you go.
Joe Kerrigan
Yes.
Maria Varmazes
Where everybody knows there's a Roy Rogers.
Dave Buettner
Is there a Roy Rogers on.
Joe Kerrigan
On.
Dave Buettner
On site?
Joe Kerrigan
No, there's no Roy Rogers in Texas. This place is called Harry's. It's in San Saba, Texas.
Dave Buettner
Okay.
Maria Varmazes
Oh, my God.
Joe Kerrigan
Go upstairs and see Inez.
Dave Buettner
You go in and they say, hi, Joe. Like, you're like Norm at Cheers.
Maria Varmazes
Yeah, everybody knows his name.
Joe Kerrigan
I mean, they see me, like, once a year, but they still remember me.
Dave Buettner
I'll bet they do. I'll bet they do. And of course, we want to thank this week's sponsor, Threat locker. Go to threatlocker.com HH and check out their Zero trust endpoint protection platform. That's the words threat and locker with no space.com HH where you can request a demo and neutralize the threat of malware running on your devices, is. All right, that is our show, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cyber security. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Liz Stokes. Our executive producer is Jennifer Ibin. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher I'm Dave Bittner.
Joe Kerrigan
I'm Joe Kerrigan.
Maria Varmazes
And I'm Maria Varmazes.
Dave Buettner
Thanks for listening.
Podcast Summary: Hacking Humans – "I'm a Scammer and Need Support"
Episode Information:
Timestamp: [01:21] – [09:01]
The episode opens with host Dave Buettner addressing a listener named Dave who reached out for assistance after his friend fell victim to a sophisticated scam. The scam involved a "dream job" deception that resulted in a loss of $70,000. Joe Kerrigan emphasizes the intelligence of victims, stating:
"Your friend did not fall for this because he was stupid, but because he is human and these guys exploited that."
— Joe Kerrigan [01:46]
Maria Varmazes and Joe discuss the availability of support groups, highlighting organizations like AARP and fightcybercrime.org, which offer resources for scam victims. They underscore the traumatic impact of such scams and the importance of having platforms for victims to share their experiences and receive support.
Notable Quote:
"There needs to be a support group for people who've lost money. This is something that needs to be done."
— Joe Kerrigan [08:55]
Timestamp: [12:06] – [18:37]
Maria Varmazes presents a compelling story from El Reg Jessica Lyons at The Register, detailing the case of Christina Marie Chapman. Chapman pleaded guilty to orchestrating a laptop farm that funneled $17 million to Kim Jong Un through North Korean cyber operations. This elaborate scheme provided North Korean hackers with credible US-based IP addresses to apply for jobs at major US companies, thereby bypassing standard security measures.
Key Points:
Notable Quote:
"The conspiracy perpetrated a staggering fraud on a multitude of industries at the expense of generally unknowing U.S. companies and persons."
— Maria Varmazes [13:12]
Timestamp: [19:19] – [27:03]
Dave Buettner introduces an article by Lily Hayne Newman at Wired titled "The Loneliness Epidemic Is a Security Crisis." The discussion focuses on the increasing prevalence of romance scams and how scammers are leveraging AI to enhance their deceptive tactics.
Techniques Highlighted:
Love Bombing: Excessive praise and affection to build rapid emotional connections.
"Love bombing is really common with cults where they will find someone who is in a state of emotional weakness."
— Dave Buettner [20:53]
Financial Manipulation: Scammers mention money problems without directly asking for help, prompting victims to offer assistance out of goodwill.
Use of AI: Organized crime groups employ AI to generate personalized scripts, enabling real-time, multilingual conversations that appear authentic.
Psychological Impact:
Notable Quote:
"Victims, especially the ones who are experiencing loneliness, often struggle to accept that the romance is fake."
— Dave Buettner [26:33]
Timestamp: [28:00] – [34:37]
Joe Kerrigan shares two intriguing scam stories:
IRS Phishing Attempts:
"These guys are just out there running this scam with new domains all the time."
— Joe Kerrigan [29:19]
Walmart Self-Checkout Fraud:
"He got greedy, paid the $0.70 blender and then drove out."
— Joe Kerrigan [30:27]
Discussion:
Timestamp: [35:07] – [38:10]
Joe Kerrigan brings attention to significant anti-scam legislation being developed in Australia, as reported by Kat Wong at Aap. The new laws aim to:
Banks: Must verify the identities of payees to prevent fraudulent transfers.
"Banks are going to have to confirm the payee identities for people..."
— Joe Kerrigan [35:12]
Telecommunications Companies: Required to detect and disrupt scam numbers proactively.
Social Media and Big Tech: Obligated to validate advertisers to ensure legitimate ad placements.
Implications:
Notable Quote:
"Businesses could be fined up to $50 million if they do not maintain strong scam defenses."
— Joe Kerrigan [35:12]
Timestamp: [38:38] – [41:16]
The hosts engage in a light-hearted scambait exchange, parodying the iconic interactions between Hannibal Lecter and his victims. Through this segment, they humorously demonstrate how scammers might initiate conversations, highlighting the absurdity and danger of such interactions.
Excerpt:
Dave Buettner as "Alexander": "I was thinking I would pair your liver with fava beans and a nice Chianti."
Maria Varmazes as "Jane":
"Sorry, I accidentally messaged you because I saved the wrong number."
Joe Kerrigan:
"I think I'll eat your heart."
Conclusion:
Support Systems Are Crucial: The need for robust support groups for scam victims, extending beyond older demographics to include younger individuals and diverse age groups.
Evolving Scamming Techniques: Scammers are increasingly sophisticated, utilizing AI and deepfake technologies to bypass security measures and exploit emotional vulnerabilities.
Legal Measures as a Deterrent: Progressive legislation, such as Australia’s new anti-scam laws, can significantly impact the effectiveness of scam prevention and victim support.
Vigilance is Key: Awareness of common scam tactics, such as love bombing and financial manipulation, is essential in preventing victimization.
Final Notable Quote:
"If somebody starts giving me a lot of compliments, I'm immediately suspicious."
— Joe Kerrigan [23:20]
For More Information:
Stay Informed and Safe!