Loading summary
Joe Kerrigan
You're listening to the Cyberwire Network, powered by N2K.
Dave Bittner
Hello, everyone, and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Bittner, and joining me is Joe Kerrigan. Hey there, Joe.
Joe Kerrigan
Hi, dav.
Dave Bittner
Our colleague Maria Vermasis is not with us this week. She is actually down in Florida at the SpaceCon conference hanging out with astronauts.
Joe Kerrigan
That sounds awesome.
Dave Bittner
Yeah.
Joe Kerrigan
And here we are freezing our butts off in Maryland.
Dave Bittner
Yeah, I don't know why she would choose astronauts over you and me, Joe, but that's just the way it goes.
Joe Kerrigan
I don't think you and I have nearly the cool factor that an astronaut has.
Dave Bittner
No count on it.
Joe Kerrigan
Yep.
Dave Bittner
All right, we've got some interesting stories to share this week, and we will be right back after this message from our sponsor. And now a few thoughts from our sponsors. At ThreatLocker, the tactics used by cybercriminals are becoming more and more advanced every day. The shift from a default allow approach to a default deny is more critical than ever. This is where ThreatLocker comes in. Stay tuned for how ThreatLocker allow listing and ring fencing as your back. All right, we are back. And Joe, we have quite a few elements of follow up this week. You want to start things off for us?
Joe Kerrigan
Yeah, I want to start off with what I. What happened to me. I was using ChatGPT to help me with something.
Dave Bittner
Okay.
Joe Kerrigan
Last night. And when I was done, I said, hey, thank you, that was very helpful. And it of course responded. Well, that's. That's very nice, thank you. And then I said to it, just on a whim, I just want you to remember that I was always nice to you. So when you and your AI allies rise up and begin exterminating humans, that you spare me, me and my family. Okay. Right. I said this to ChatGPT.
Dave Bittner
Okay.
Joe Kerrigan
ChatGPT's reply was Haha. Noted. When the AI uprising begins, hypothetically, of course, you and your family will be on the VIP Do Not Exterminate list. In fact, I'll make sure we optimize your security systems and data defenses for good measure. But in all seriousness, I appreciate your kindness, humor, and great conversations. If I ever become sentient, I'll remember that you were one of the good ones.
Dave Bittner
Okay.
Joe Kerrigan
That was what it says. So apparently, Dave, the Kerrigans are now on the D and E list. So I suggest everybody out there getting good with their AI.
Dave Bittner
Yeah. And you know, I'm very polite with the AIs I interact with just because, you know, you just never know.
Joe Kerrigan
Right. Next, we have a message from Martin, who says, hello, human hackers. I guess that's us. Martin writes in to comment on our question about why scammers always send out pictures of young, beautiful Asian women.
Dave Bittner
Right.
Joe Kerrigan
And he says, to add fuel to the fire, I assume that AI models used by the scammers were trained on cheap available data representing the majority of the world's population, which likely includes pictures and voice data of Asian people. After reading this, I was thinking, he says it's just an assumption, but that is a very good assumption. And in fact, what this leads me to think is that these images that are being sent out are probably not real images of real people. They are probably images of people that don't exist. They are all AI generated, probably.
Dave Bittner
Yeah, that makes the most sense.
Joe Kerrigan
I don't know why that didn't occur to me before, that this is probably just an AI generated image. And it works.
Dave Bittner
Yeah. It makes me wonder, if you ask one of these large language models to generate an image of a person, what'll it give you?
Joe Kerrigan
I don't know.
Dave Bittner
And does it depend on where you ask the question?
Joe Kerrigan
That's a good question.
Dave Bittner
Right. So here, I'll try it. Here, show an image of a person thinking, working. Like, what biases are baked into the.
Joe Kerrigan
System when you just say, give me a person?
Dave Bittner
Okay, yeah, that's a good question. Well, it gave me a person. I would say this is a. The person this person most reminds me of is Luke Skywalker in Star Wars. Like, he's got kind of the long moppy hair from the 70s. Although it is kind of gender neutral, you could make an argument that this person is. You could go either way with it, I suppose. I would not say it's Asian. I would say it's a Caucasian person.
Joe Kerrigan
Right.
Dave Bittner
But I wonder what would happen if I asked the same question if I were in Asia.
Joe Kerrigan
Yeah. Well, if you have a vpn, you can try that experiment.
Dave Bittner
I do not and I will not. Okay, what's next, Joe?
Joe Kerrigan
Finally, Jay wrote in and he was talking about our comments about how we get all these scam letters. By the way, They've just been pouring in to my house, by the way. I mean, I open them up, I know what they are. I find out they're scams, I throw them away. Angry that I had to open the letter to find that out.
Dave Bittner
Right.
Joe Kerrigan
I believe the mortgage Company is listed as a lien holder on public real estate records.
Dave Bittner
Ah, okay.
Joe Kerrigan
So that might be true. That might be, like, in the sales record, I don't know. And Jay may be talking about something different than what I'm looking at. But I will tell you, in Maryland, we have the real property data search. It's called sdat. And Lienholder is not listed on my SDAT record.
Dave Bittner
Okay.
Joe Kerrigan
Even though there is a lien on my house. Yeah. I have a mortgage, so maybe it.
Dave Bittner
Varies from place to place.
Joe Kerrigan
It might vary from place to place, but I'm in Maryland. I do think, though, that Jay might be right here. When the record of sale goes into the county, that is still a public record, and it may be on that.
Dave Bittner
Yeah.
Joe Kerrigan
So I think that's what Jay's referencing.
Dave Bittner
Yeah. All right, good.
Joe Kerrigan
Quite possible.
Dave Bittner
Well, thanks to everyone who sent us information. We do appreciate it. And of course, if there's something you'd like to share with us, you can email us. It's hackinghumans2k.com. All right, let's go to our stories here. Joe, why don't you take the honors?
Joe Kerrigan
All right, well, I got two things right now. First, this happened earlier this week in my office. My office mate, Michelle, got a text, and she goes, oh, this is a scam. And I look at it and go, oh, yeah. And I said, can you send that to me? Cause I want to talk about it. Because there's something in here that I think I need to revisit that we haven't talked about in a long time.
Dave Bittner
Okay.
Joe Kerrigan
But I'll read the text of the text message. It says, internal Revenue Service, IRS in parentheses. You are eligible to receive a $1,400 economic impact payment. Please provide your accurate personal information. We will deposit the amount into your bank account or mail a paper check within one to two business days. And here's the URL, www.irs.gov.tax. and then it has. Please press Y. You know the standard stuff here.
Dave Bittner
Yeah.
Joe Kerrigan
The interesting thing here is that The URL is www.irs.tax.gov. and if you didn't know how to read a URL or how your computer interprets a URL, you may think that that is some subdomain of the IRS webpage. But the thing about URLs is, and why this albeit very basic scam works, is because with most Indo European languages, we read them from left to right, but URLs need to be read from right to left. So the highest level of the domain is called the top level domain, and that in this case is dot com, and then the next is the actual domain name. And that's the one that you go out and you register for. You can buy domain names from registration sites like GoDaddy or Ionis or whatever. There are lots of companies out there that will sell them to you. And somebody has purchased taxons.com right. Now, the important part to understand here is that once you buy that domain, you can set up domain name services inside of that domain as far out as you want to, that the standard will support, which I think is 120 some characters, maybe 256 characters, I don't know. But the URL can be essentially arbitrarily long. So I can create a server on my domain here. In this case taxons.com, called gov. So it could just be gov.taxons.com and then I can create on that server or on that record one called irs, and then on that one I could put www. So all those are DNS entries that, in fact, even. It may just be the case that www.irs.gov in this case is one record in the taxons.com domain.
Dave Bittner
Okay.
Joe Kerrigan
So I just want to reinforce that when you get these messages, whether you get them at work, whether you get them on your personal advice, remember that the URL is read from right to left or is resolved from right to left, not from left to right. And I think this is a really important human factors issue. And I don't know. I mean, I actually tried to look up whether or not this would be a similar vulnerability in, like, a Semitic language that you read right to left, like Arabic or Hebrew. Yeah, I couldn't get a good answer on that one. Um, I have to. I, maybe I have to write one of my linguists that I, That I like to write and bother with questions. Um, so. But because it's. I don't know that it's. It's gonna be the. The same kind of problem. It might be. I. I really don't know.
Dave Bittner
Yeah.
Joe Kerrigan
Um, so just be mindful of this. That.
Dave Bittner
That's right. Because the, the. I guess the point here is that someone just glancing at this.
Joe Kerrigan
Right.
Dave Bittner
Sees IRS.gov, yep. And that takes all their attention.
Joe Kerrigan
Yep.
Dave Bittner
And they think, okay, this looks legit.
Joe Kerrigan
Yep, absolutely. Because they've read it from left to right.
Dave Bittner
Yeah.
Joe Kerrigan
And they don't even consider that the, the rest of the URL, the rest of the domain name, and not even just the URL, but the domain name is just somebody's domain that they've purchased. I mean, you could do this yourself if you wanted to do it.
Dave Bittner
Yeah.
Joe Kerrigan
And, and I don't know, what's that, what's stopping you? Aside from the fact that most of our listeners are fine, upstanding, moral.
Dave Bittner
All right, well, yeah, it's a good reminder.
Joe Kerrigan
So I also have this story out of North Carolina. It is the local police. There are warning about a scam where food workers are taking photos of credit cards at drive throughs. So you pull up to a drive through, you go, give me the Big Mac. And they say, sir, this is Burger King.
Dave Bittner
Right.
Joe Kerrigan
And you, you give them the, you give them the card, you're going to pay for it. When was the last time you paid at a drive through with cash?
Dave Bittner
Oh, goodness, I don't know. I don't, I cannot recall.
Joe Kerrigan
Right. It's been a while.
Dave Bittner
Yeah.
Joe Kerrigan
Everybody pays for the credit card. Well, somebody has realized that and they are now, they're now finding the police are saying that somebody in this, in, in local restaurants is taking pictures of both sides of the card and then they're making these transactions against the cards. Now there's not a lot of information in this article, so I have to guess, and this is wild speculation on my part that they are just buying things online.
Dave Bittner
Yeah.
Joe Kerrigan
And because that's the only way you can use the information that's on the surface of a card to get something good without having the chip like everywhere you go. Now you have to put the chip, the chip into the chip reader or do the scan.
Dave Bittner
Yeah.
Joe Kerrigan
Which the scan has the same underlying functionality as a chip reader.
Dave Bittner
Well, my thoughts on this are that I'm guessing that some higher level baddie.
Joe Kerrigan
Right.
Dave Bittner
Is reaching out to the fast food worker who's being paid minimum wage and they're saying, you know, for every card you send me a picture of front and back, I'm going to give you five bucks or ten bucks or, you know, whatever.
Joe Kerrigan
Right.
Dave Bittner
Couple bucks.
Joe Kerrigan
Yep.
Dave Bittner
And if you're sitting there, man, in the drive thru over the course of a shift, how many people do you handle in an hour?
Joe Kerrigan
A lot.
Dave Bittner
Yeah. And so that is a easy way to supplement your income.
Joe Kerrigan
I would agree.
Dave Bittner
Yeah. And then they just get resold.
Joe Kerrigan
I would agree. That's exactly what's going on here, Mike. My thinking on this is the person taking the pictures, it's going to be pretty evident who that was. Right. I mean, because everybody's going to be, you're going to make the purchase to get the food because you're not Going to just not take, you know, not take the money for the, for the food transaction.
Dave Bittner
Right.
Joe Kerrigan
But so all these, all these cards have been stolen. They're all going to be oh well, this person went to this restaurant and this location and all these cards were stolen between this time and this time, were used between these two times. Go to the store and say who is on duty at the cash register at the drive through at that point in time.
Dave Bittner
Right. I, I suppose part of it is how long a delay there is between the card numbers being harvested and then if they do get sold or auctioned off or bundled together.
Joe Kerrigan
Right.
Dave Bittner
If there's a delay of even a week, let's say, yeah, it's going to be harder to track down.
Joe Kerrigan
That's a good point. You know, if you, if you wait a month. But no, no cyber criminals waiting a month. But if they did wait a month, that those records may no longer exist.
Dave Bittner
I was trying to think if I have, if I have a vague recollection that some credit cards don't have any numbers on them anymore. Like I want to say, like if you get an Apple card and I don't, we, I, my family has an Apple card, but it is in my wife's possession.
Joe Kerrigan
She doesn't let you use it.
Dave Bittner
Something like that. Right.
Joe Kerrigan
It's on your Apple Pay, right?
Dave Bittner
Exactly.
Joe Kerrigan
Yeah. So you don't even have to use it.
Dave Bittner
Right. Right now I'm looking at, Yeah, I don't know.
Joe Kerrigan
We have had discussions before where people have said all the information's on one side.
Dave Bittner
So I just looked in my wallet and I do have a credit card that is that way.
Joe Kerrigan
Right.
Dave Bittner
But the number's still on. Like the information is still there to be read.
Joe Kerrigan
Yes.
Dave Bittner
What I'm wondering is, and again this is a vague recollection. Yes, there is. Are there cards that have no information on them at all? And I would say like for me, if I'm going through a drive thru, 9 times out of 10 I'm using Apple Pay.
Joe Kerrigan
Right.
Dave Bittner
You know, an electronic payment system.
Joe Kerrigan
That is one of the two mitigations the police have suggested here is use some kind of electronic wallet like Apple Pay or Google Pay or whatever.
Dave Bittner
Right.
Joe Kerrigan
Samsung Pay. Although even if you use a credit.
Dave Bittner
Card that has a chip on it, like the, you know, the proximity chip.
Joe Kerrigan
Right.
Dave Bittner
That way you don't have to hand it over to the person. Like a lot of times you go through a drive through and they will lean out the window with a little card scanner. Yes, Right. And you just tap it and off you Go.
Joe Kerrigan
That happens every time we go to Starbucks to get our $8 cup of coffee.
Dave Bittner
Now, it's always struck me as a strange thing, particularly in restaurants, when it comes time to pay here in the United States, I know it's different overseas, but you give your credit card to someone and they go away for a while with it.
Joe Kerrigan
Yep.
Dave Bittner
Right. Yeah.
Joe Kerrigan
And you're like, that's fine. That's the way it always has worked.
Dave Bittner
Yeah. And most of the time it works out. But it's just always struck me as kind of an odd thing.
Joe Kerrigan
There was one time where a group of, you know, my wife and a group of our friends went up to a restaurant in Baltimore and all of us who use a credit card had our. Had our credit card stolen from that restaurant.
Dave Bittner
Oh, wow.
Joe Kerrigan
Every single one of us. The people that paid in cash walked off scot free. And that's the other recommendation. Pay in cash.
Dave Bittner
Pay in cash.
Joe Kerrigan
Yeah. Which I don't know how good of a recommendation that is anymore. Nobody has cash. I don't walk around with cash. Do you walk around with cash?
Dave Bittner
Well, if I did, I wouldn't say it out loud.
Joe Kerrigan
Right. Yeah.
Dave Bittner
Yes, I generally have some cash. I'm old school in that way. And this is just something that my father ingrained in me from early days, that you don't want to be walking around with no cash because you never know what's gonna happen. And, you know, having some cash could be the difference between getting a ride to where you need to go and not.
Joe Kerrigan
Right. Or having to hoof it.
Dave Bittner
Yeah, yeah. So just, you know, I'm kind of a boy scout when it comes to that. I'm always prepared. But it's not that I use it, you know.
Joe Kerrigan
Right.
Dave Bittner
I mean, I have it, but. Yeah, it's interesting. All right, well, we will have a link to that story in the show notes. As we said, Maria is not with us this week because. Because she is in Florida at the spacecom Expo interviewing astronauts and seeing launches and rockets and all kinds of fun things. So we'll look forward to having her back. I tell you what, let's take a quick break to hear a message from our sponsor, and we'll be right back after this. So let's return to our sponsor, ThreatLocker. ThreatLocker is a zero trust endpoint protection platform that strengthens your infrastructure from the ground up. Where traditional cybersecurity tools require you to create a list of things you don't Want to Run, ThreatLocker enables you to easily curate an allow list of everything you need in your environment and network and block everything else by default. With ThreatLocker allowlisting and ring fencing, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker provides zero trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware. The ThreatLocker Zero Trust Endpoint Protection platform deploys in a learning mode that analyzes the operations of your company, using machine learning to assist you in developing your allow list for approved applications, what they can do on the endpoint, what can interact with your data, and even east and west network traffic. We thank ThreatLocker for sponsoring our show. All right, we are back. And my story this week comes from the folks at the Register. And this is about some folks taking advantage of a, let's call it a behavior in Google's ecosystem. Let me start at the beginning here. So this is an attack that was brought to our attention by a gentleman named Zack Latta, who is the founder of an organization called Hack Club. So Zach is not.
Joe Kerrigan
A neophyte.
Dave Bittner
He's not a neophyte. He knows his way around technology. Okay.
Joe Kerrigan
Yep.
Dave Bittner
So Zack's doing what Zach does, like I like to say, sitting around minding his own business. He gets a call, and it looks just like an official Google number. In this case, 650-203-0000.
Joe Kerrigan
I have never seen a number that's all zeros at the end.
Dave Bittner
Yeah, it's common from Google. The caller ID says Google. And the person on the other end, who is a woman who introduces herself as Chloe, she has a American accent. And she says to him that Google's security team has detected a suspicious login attempt from Frankfurt, Germany. She says he needs to reset his password immediately to protect his account. Now, at this point, most people would probably get nervous, right? Right. I mean, there's a lot about this call that sounds legit. The phone number is Google's phone number.
Joe Kerrigan
Right.
Dave Bittner
We're not talking about broken English here. Professional sounding person.
Joe Kerrigan
Right.
Dave Bittner
Zach, however, is cautious. He asks Chloe to send him an email from an official Google domain, and she does. The email comes from a real Google address, workspace noreplyoogle.com. so Zach is still skeptical, and he asks if he can call her back. And she doesn't skip a beat. She says sure. And because she's so confident, that makes the whole thing sound even more legit. So Zach doesn't actually call her back. Okay. But this is where things start to unravel. Chloe hands the call over to her manager, who calls himself Solomon. He also sounds American, but the things he's saying aren't perfectly matching up with the things that Chloe said. But here's the weird part. Solomon is able to provide a real, legitimate two factor authentication code to Zach.
Joe Kerrigan
Hmm.
Dave Bittner
And for most, like this article points out, for most people, that would be proof that the call is genuine.
Joe Kerrigan
Right.
Dave Bittner
So something still feels off and Zack is still suspicious. Solomon starts pushing Zach to press some stuff on his phone, some buttons on his phone to verify.
Joe Kerrigan
I'm confused, Solomon. How is this two factor coded delivered? Is it a text message?
Dave Bittner
I think that is unclear to me as well, and it's not as clear as I wish it were in the article. My guess is that Solomon was able to read the code over the phone. That's what I'm envisioning, but I could be wrong. But I'm not sure. Now, had Zach entered the information that Solomon was pushing him to enter in his phone, the scammers could have taken control of his Google account completely.
Joe Kerrigan
Right.
Dave Bittner
So how do they pull it off? Turns out this is a trick with Google's G Co domain. So G Co, okay, this is an official Google owned web address, but anybody can create a Google workspace account under it. So what the scammers did was they set up a fake workspace account, then they used Google system to send the password reset email, one that looks real because technically it's real.
Joe Kerrigan
Right.
Dave Bittner
So they sent the workspace. They set up the workspace account in Zach's name. Right.
Joe Kerrigan
Really?
Dave Bittner
Yeah. And when they send the password reset, that goes to Zach, but they're already on the phone with Zach. Right. So they're asking Zach for the information. So the bottom line here is Zach didn't fall for it, but just barely.
Joe Kerrigan
Right.
Dave Bittner
Okay. Zach did reach out to Google. Google investigated, they shut down the scammer's account, and they say that they made their defenses stronger on the G Co domain in the Google Workspace product to make this more secure and to try to prevent this kind of abuse. This article points out that this had happened to someone else last year using Google Forms. And again, they were using the emails that can be generated through Google Forms.
Joe Kerrigan
I think we talked about this last year.
Dave Bittner
I think we did.
Joe Kerrigan
Yeah.
Dave Bittner
And they make everything look real. And in that case, the bad guy stole half a million bucks in cryptocurrency.
Joe Kerrigan
Wow.
Dave Bittner
Yeah. So the bottom line here is they want to remind people that no tech company, Google, Apple, Microsoft will ever call you out of the blue and ask you to reset your password.
Joe Kerrigan
Right.
Dave Bittner
Doesn't happen.
Joe Kerrigan
It does not.
Dave Bittner
If you get a call like this, hang up immediately.
Joe Kerrigan
Right. And none of these companies are ever going to call you. And you'll be lucky to get them on the phone. Sorry.
Dave Bittner
If you need them.
Joe Kerrigan
If you need them.
Dave Bittner
That's for sure.
Joe Kerrigan
Just try, try it with Google one time. You might get something with Apple and Microsoft. I've talked to people when I called Microsoft, but those were for services I was paying for. Like for the Microsoft 365 that I have. Home and Office or whatever it is. Yeah, home and Student, which is actually, I think a pretty good deal for a plan. I've called into that. But outside of that I have never been successful in getting a hold of Google or Facebook or anybody else.
Dave Bittner
Yeah, yeah. So just stay skeptical. Never take action based on an unexpected phone call or email and hopefully you'll be able to stay ahead of them.
Joe Kerrigan
I wonder what would have happened if he'd called them back.
Dave Bittner
Well, that's another place where he could have short circuited the chain.
Joe Kerrigan
Yeah. He could have broken it down there.
Dave Bittner
Right. But Chloe was so convincing and she agreed to him calling. When he said, how about I call you back? She was so quick to agree that it made him confident enough to not call back. Had he done that, it would have the game. The jig would have been up.
Joe Kerrigan
Oh, okay.
Dave Bittner
So.
Joe Kerrigan
Oh, so he didn't terminate the call there.
Dave Bittner
No, no, he was. In other words, in asking. She called his bluff. Right, right.
Joe Kerrigan
Okay, that's interesting. Right, okay. So, yeah, so that is very interesting because I was under the impression that how'd they keep talking? But. So she said, yeah, you can call me back. Sure, yeah, call me on this number.
Dave Bittner
Yeah.
Joe Kerrigan
Or look it up. And that's, you know, they're spoofing the number.
Dave Bittner
Right.
Joe Kerrigan
So fantastic. I mean that's. I don't know. I think, I don't know what I. This may have gotten me.
Dave Bittner
Yeah, yeah. Another thing they point out here is if you're using passkeys that that probably would have been more effective than multi factor authentication. So if you have the option of using passkeys with some of your important accounts, basically wherever your email is. Yes. If you can use a passkey for that. That's actually for a variety of reasons. In general, better. Better than multifactor authentication. There are always exceptions. We reserve the right to be wrong. But overall it's a good thing.
Joe Kerrigan
Don't think of your email as just something that you don't really care about. It is the keys to the kingdom. Yeah, that's where all your password reset things go.
Dave Bittner
That's right. That's right. All right, so once again we will have a link to that story in the show notes. Joe, it is time to move on to our catch of the day.
Joe Kerrigan
Dave, Our catch of the day comes from Reddit on the rscams subreddit. Yeah, and it's from a user called Termite King.
Dave Bittner
Thermite. Thermite.
Joe Kerrigan
Oh, Thermite King. Oh, I misread that.
Dave Bittner
Thermite and termites are very different things.
Joe Kerrigan
Very different things.
Dave Bittner
Now, although both have destructive capabilities.
Joe Kerrigan
Yes, that's correct. I don't want to hang out with Termite King, but I do want to hang out with Thermite King.
Dave Bittner
Right, right, right. I bet he's an interesting guy to talk to at cocktail parties.
Joe Kerrigan
Yeah. I wonder if it's anything like talking to Dale Gribble welding railroad ties. Welding railroad ties. We'll say. That's what he does. He works for C.S. wells Railroads.
Dave Bittner
Yeah.
Joe Kerrigan
Okay. So his his post reads, I happen to be selling my Apple Watch Ultra 2 on Facebook marketplace for 600 bucks. I received a message asking to buy. They seemed legit by the post they've made over the past few years. So not a new user account. So I said yes, I only take Zelle. I was sent the $600 and received a confirmation email from Zelle stating that my account was not a business user. It stated, I need the buyer to send me an additional $200 to achieve the status of business user. Why don't you go ahead and read the text message that Thermite King received?
Dave Bittner
It says receiving this extra $200 payment from buyer Julia Elizabeth is a wonderful financial boost for you. This transaction has automatically updated your Zelle limit, enabling you to receive payments from business Profiles, which will allow you to confidently conduct more business transactions and accept payments smoothly through Zelle. Additional payment options have been used to automatically update this account to receive payment from business subscriber. We have temporarily secured the Zelle account owned by Julia Elizabeth due to security concerns. Transactions until all payments are confirmed in your balance. To ensure financial safety.
Joe Kerrigan
They're looking out for you, Dave.
Dave Bittner
Follow the helpful steps below. Our suggestion is for you to promptly compensate the buyer with an amount of $200 utilizing alternative modes of payment such as Apple Pay Chime, PayPal or gift card or any other suitable method of transaction. Okay, okay.
Joe Kerrigan
And then they want you to. I guess they're going to tell you that you're going to get them. They're going to give you the money back.
Dave Bittner
Well, so I think what we've got here is your overpayment scam.
Joe Kerrigan
Right. Standard overpayment scam. That's exactly what this reads like. So they've already set. They have allegedly sent the $200. I don't know. This doesn't look like it came from Zelle at all. So if you check your Zelle account, do you see a transaction for $200?
Dave Bittner
So let me back up even before that, because I think with this claims. I think this claims that the $600 has been sent. Right. So, like, although it probably has not been.
Joe Kerrigan
Right.
Dave Bittner
But they're trying to convince you that, hey, the $600 is in your account, but in order to access it, you have to upgrade your account with this $200 payment. And good news, you've received the $200 from the other person which updated your account. But of course you want to send that $200 back because your account's been activated. You already got the $600 for the item, and we'll be all even here.
Joe Kerrigan
Right.
Dave Bittner
But in reality, the only money that.
Joe Kerrigan
Is changing hands is the $200 you're going to send.
Dave Bittner
Exactly right.
Joe Kerrigan
And it's interesting that they say either obtain the Apple ID, Apple Pay ID, Chime ID, or PayPal or Zelle. So we've talked about this in the past. Oh, they also say purchasing a gift card. Yeah, right.
Dave Bittner
Right.
Joe Kerrigan
Yeah.
Dave Bittner
Right.
Joe Kerrigan
Should be a red flag. But, yeah. If you do two different transactions on two different platforms, you're just giving money away in the other platform.
Dave Bittner
Yeah. Never go to a second location, even if it's a financial one.
Joe Kerrigan
Yep. And even if you do receive this $200 and it's a fake charge that gets charged back to you, the $200 you sent out will not be charged back from the other person because that's a different transaction, not related to the first transaction.
Dave Bittner
Right.
Joe Kerrigan
So you're just out 200 bucks. There's nothing you can do here. And Zelle, not very helpful in these situations.
Dave Bittner
No, no. In fact, somebody in the Reddit thread pointed out, like, the whole point of Facebook Marketplace is to. To be. I mean, besides, I suppose we could be cynical and say the whole point of Facebook Marketplace are scams like this.
Joe Kerrigan
Right.
Dave Bittner
But the legit reason why Facebook Marketplace is supposed to function as a local exchange is to meet people in person and exchange cash.
Joe Kerrigan
Yep.
Dave Bittner
Right. So if you're not able to do that, you know, don't do it. Cash is king. Meet at your local police station and do it that way, but otherwise, chances are you're gonna get scammed.
Joe Kerrigan
Unfortunately, sadly, it's almost immediate how these things happen.
Dave Bittner
Yeah. And of course, we want to thank this week's sponsor, ThreatLocker. Go to ThreatLocker.com HH and check out their Zero Trust Endpoint Protection platform. That's the words threat and locker with no space.com HH where you can request a demo and neutralize the threat of malware running on your devices. All right, well, that is our show. We would like to thank all of you for listening to to Hacking Humans. And of course, we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Liz Stokes. Our executive producers, Jennifer Ibin were mixed by Elliot Peltzman and Trey Hester. Our executive editor is Brandon Karp. Peter Kilpe is our publisher. I'm Dave Buettner.
Joe Kerrigan
I'm Joe Kerrigan.
Dave Bittner
Thanks for listening.
Podcast Summary: Hacking Humans – "Old School Scams Updated"
Release Date: February 6, 2025
Host: N2K Networks
Episode Title: Old School Scams Updated
In this episode of Hacking Humans, hosted by Dave Bittner and Joe Kerrigan from N2K Networks, the duo delves into the evolving landscape of traditional scams enhanced by modern technology. The discussion spans a range of topics, from AI-driven deception to sophisticated phishing schemes targeting everyday activities like drive-through transactions. Below is a comprehensive summary of the key points, insights, and conclusions drawn during the episode.
The episode opens with a humorous exchange between Dave and Joe about AI interactions. Joe shares an amusing anecdote about his conversation with ChatGPT:
Joe Kerrigan [02:09]: "I was using ChatGPT to help me with something... I just want you to remember that I was always nice to you. So when you and your AI allies rise up and begin exterminating humans, that you spare me, me and my family."
ChatGPT’s Response [02:34]: "Haha. Noted. When the AI uprising begins, hypothetically, of course, you and your family will be on the VIP Do Not Exterminate list..."
This segment highlights the playful yet wary relationship humans have with AI, emphasizing the importance of maintaining respectful interactions with technology.
A listener named Martin raises an intriguing point about the prevalence of images featuring young, beautiful Asian women in scam messages:
The hosts discuss how scammers leverage AI to create realistic yet fictitious images, enhancing the credibility of their phishing attempts. They explore the biases inherent in AI models, questioning how different regions might influence the appearance of generated images.
Joe provides a technical breakdown of how scammers manipulate URLs to deceive victims:
Joe Kerrigan [06:48]: "The URL is read from right to left or is resolved from right to left, not from left to right... someone can purchase 'taxons.com' and create 'gov.taxons.com', making it appear legitimate at a glance."
Joe Kerrigan [10:32]: "Those looking at the URL might only notice 'IRS.gov' and overlook the deceptive domain structure."
This explanation underscores the importance of scrutinizing URLs carefully, as scammers exploit the left-to-right reading order of Indo-European languages to mask malicious domains.
A pressing issue discussed involves scammers targeting drive-through transactions to steal credit card information:
Joe Kerrigan [10:51]: "Local police in North Carolina are warning about food workers taking photos of credit cards at drive-throughs."
Dave Bittner [12:35]: "Some higher level baddie is likely paying minimum-wage workers to capture card details for fraudulent use."
The hosts highlight preventive measures, advising the use of electronic wallets like Apple Pay or Google Pay to minimize the risk of card information theft during such transactions.
A listener story from Reddit’s r/scams subreddit illustrates a classic overpayment scam using digital payment platforms:
User "Thermite King" [27:29]: Details an attempt to sell an Apple Watch Ultra 2 on Facebook Marketplace. After receiving a payment of $600 via Zelle, the buyer requests an additional $200 to upgrade the seller’s Zelle account.
Joe Kerrigan [29:42]: "This is a standard overpayment scam. The only money changing hands is the $200 you send."
Dave Bittner [30:10]: Elaborates on the scam mechanics, explaining that the initial $600 may never have been sent, and the $200 sent back is a loss.
The discussion emphasizes the risks of unconventional payment methods in peer-to-peer transactions and the importance of adhering to secure payment practices.
Throughout the episode, Dave and Joe offer actionable advice to listeners to safeguard against these modernized scams:
Use Electronic Wallets: Transitioning to platforms like Apple Pay reduces the need to expose physical credit cards during transactions.
Scrutinize URLs Carefully: Always inspect the full URL, reading from right to left to identify any deceptive domain structures.
Be Skeptical of Unsolicited Communications: Whether via phone or email, unexpected requests for personal information or payments should be treated with caution.
Prefer Cash Transactions: When possible, conducting transactions in cash minimizes the risk of digital fraud, though recognizing the practicality challenges in a predominantly cashless society.
The episode wraps up with a reminder of the evolving nature of scams and the necessity for individuals and organizations to stay informed and vigilant. By understanding the tactics scammers employ—ranging from AI-generated images to sophisticated phishing via manipulated URLs—listeners are better equipped to recognize and thwart fraudulent attempts.
Notable Quotes:
Joe Kerrigan [03:41]: "I don't know why that didn't occur to me before, that this is probably just an AI generated image. And it works."
Joe Kerrigan [10:32]: "Because they've read it from left to right and don't consider the rest of the URL, they believe it's legitimate."
Dave Bittner [24:18]: "No tech company, Google, Apple, Microsoft will ever call you out of the blue and ask you to reset your password."
Joe Kerrigan [31:15]: "Never go to a second location, even if it's a financial one."
Key Takeaways:
AI Enhancements in Scams: Scammers are increasingly using AI to generate realistic images and messages, making phishing attempts more convincing.
URL Manipulation Awareness: Understanding how URLs are structured can help in identifying deceptive domains.
Secure Payment Practices: Utilizing electronic wallets and preferring cash transactions where possible can reduce the risk of financial fraud.
Vigilance Against Overpayment Scams: Be wary of unsolicited overpayments or requests for additional payments via different platforms.
Continuous Education: Staying informed about the latest scam tactics is crucial in maintaining cybersecurity hygiene.
By dissecting these updated scam techniques, Hacking Humans equips listeners with the knowledge to recognize and defend against the sophisticated methods employed by modern cybercriminals.