Loading summary
Transcript341 lines
- [00:02]
A
You're listening to the Cyberwire Network, powered by N2K.
- [00:15]
B
Hello, everyone and welcome to N2K, CyberWire's hacking humans podcast, where each week we look behind the social engineering scams, phishing schemes and criminal exploits that are making headlines and taking a heavy toll on organizations around the world. I'm Dave Buettner and joining me is Joe Kerrigan. Hey, Joe.
- [00:31]
C
Hi, Dav.
- [00:32]
B
And our N2K colleague, Maria Vermazes. Maria.
- [00:35]
A
Hi, Dave. And Hi, Joe.
- [00:37]
B
We've got some good stories to share this week, but first let's jump into some follow up here. Joe, what do you got for us first here?
- [00:44]
C
So last week or last actually two weeks ago, because I was not on the podcast last week.
- [00:50]
B
That's right.
- [00:50]
C
I was postulating. I'm sorry. I really wish I could be in Florida during this time of year, especially with the snow falling outside right now. I'm very angry about it. It's March and there should be no sn. Oh, yeah. Anyway, Michelle was noting that I was wondering what aggravated identity theft is as opposed to just regular identity theft. And Michelle is. Has a lot of background in law and policy.
- [01:19]
B
Right.
- [01:19]
C
And she says aggravated identity theft is identity theft that is used in the commission of another crime. So if you just steal someone's identity, it's fine, but then if you. Well, it's not aggravated, it's not fine, it's just identity theft.
- [01:33]
A
It's just vanilla identity theft.
- [01:34]
C
Right, exactly.
- [01:35]
A
Okay.
- [01:36]
C
But then if you use that to commit something like wire fraud in that person's name, then that becomes aggravated identity theft.
- [01:44]
B
I see.
- [01:45]
A
Because it's very aggravating that you've done that.
- [01:47]
C
It's an aggravate.
- [01:48]
A
Yeah, right.
- [01:48]
C
I think it has to do with the legal terminology is it's an aggravating factor or there are aggravating factors.
- [01:56]
B
I see. That makes sense.
- [01:57]
C
That make like this wound you've committed to society worse.
- [02:01]
B
Right. All right, good. Well, thank you, Michelle, as always. All right, we've got some other feedback from one of our listeners here. Maria, you want to take us through this one?
- [02:12]
A
Sure. This one comes from listener Robert Eberhardt from Calgary, Canada, and he wrote a very detailed email. So I'm just going to read it through because this is really good stuff. And he wrote. Hi, team. I listened to Dave's story about attackers using social engineering to reroute payroll deposits. And, and the interesting part for me was the contracted discussion about shared mailboxes. And this is shared email inboxes, to be specific. And I heard you ask the Question, why would you ever use them? And it just so happens that my job deals with these on a regular basis with my clients. So this is a really detailed email. So I'm going to go through all the bullet points that that Robert puts in here and he writes first in exchange. Shared mailboxes do not need a license. So they are used typically for inbound email only. They can be ap, like a, a, a, A. What is it? Accounts payable. Thank you, Accounts payable at. Or Accounts receivable at or HR questions at, et cetera. The shared mailbox does have an address associated, but typically does not have an ID and a password assigned. Users with a license are assigned access to the shared mailbox from their own mailbox. It shows up in the folder pane on the left side of the window as another top level folder. And permissions can include read, manage, and send, as that jives with my experience with them as well. So. Okay, yeah, I didn't know they didn't need a license. That is an interesting wrinkle.
- [03:28]
B
That's me neither. We have one. We have editor@thecyberwire.com, which is where people send their PR pitches and things. I'm on that mailbox, but it's not my primary mailbox, so I guess that is categorized as a shared mailbox.
- [03:47]
C
So when people bug me about being on the podcast, should I just tell them to email editorwire.com or n2k.com?
- [03:55]
B
No, because I still have to read them.
- [03:59]
A
Have them bother you directly. Joe.
- [04:01]
B
No, you tell him just to email Joe things Joe hates dot com.
- [04:07]
C
Yeah, I don't know who owns that domain anymore, Dave. Okay, I wish I still had it, but.
- [04:11]
B
Oh, you let it pass.
- [04:13]
C
Well, yeah, unintentionally. It wasn't me, it was the domain. I had a friend managing the domain for me, Joe. And yeah, Things Joe hates. I don't know if it's still doing this, but it was going to some kind of Japanese porn site and it was just awful.
- [04:30]
B
That's on brand for your podcast.
- [04:32]
C
It is absolutely not on brand.
- [04:35]
B
Wow.
- [04:36]
A
Okay, I'm gonna just leave that one hanging there.
- [04:39]
B
Maria, save us here the second half of this. Yeah, get us back on track.
- [04:43]
A
So the email goes on to say, in some cases, you would assign a license to a shared mailbox, but why would you do this? And the answer is, an unlicensed shared mailbox has a quota of 50 gigs and does not allow for online archives. Space needs to be managed to ensure that you don't hit the Quota, but it is free and adding a license can add capacity to the mailbox quota and allow additional features such as online archive, litigation hold, and that would be part of the license. When licensed, an ID and password can be assigned to the shared mailbox. And from a control standpoint, assigning an ID and a password and then sharing that information among multiple staff is definitely not a best practice. Amen to that, Robert.
- [05:25]
B
Okay.
- [05:26]
A
Yeah, so, yeah, this was very in depth info. Very, very much appreciate Robert sending this in because this is definitely not my world. So I appreciate this bit of color to the story. So thank you, Robert.
- [05:39]
B
Yeah, important distinction there. So thanks for sending that in and of course we would love to hear from you. If there's something you'd like us to discuss on the show, you can email us. It's hackinghumans2k.com. Every attacker counts on one thing. Environments that Trust too much. ThreatLocker closes that gap with default deny at execution. Unknown software blocked, Trusted apps contained with ring fencing, configurations verified with Threat Locker DAC so you stay secure and compliant. ThreatLocker delivers the visibility and control CISOs need without adding operational pain, making zero trust real for teams of any size. Stop ransomware at its earliest point. Book a demo@threatlocker.com N2K. All right, let's jump into our stories here. Joe, you have the honors this week. What do you got for us?
- [06:49]
C
Dave, my story comes from the cyber press and this is a story about a data breach that happened at Ericsson US which is the, you know, United States subsidiary of the Swedish, or Norwegian, what is it? Norwegian? No, Swedish telecommunications giant. Yeah, they make phones and everything. Remember the Ericsson? No, that was Nokia.
- [07:11]
B
I'm thinking.
- [07:11]
A
That was Nokia.
- [07:12]
C
Yeah, yeah, the indestructible phones. So, yeah, there's a lot of confusion here in the US because Ericsson is also the name of an elder care company here in the US the biggest elder care company.
- [07:24]
B
Oh yeah, Retirement homes.
- [07:26]
C
Right. So let's specify this is the phone manufacturer. They have suffered a data breach that exposed sensitive personal financial information from about 15,000 employees and customers. And the interesting wrinkle to this is the incident was not caused by compromising Ericsson, but rather by compromising a third party service provider that they were doing business with.
- [07:56]
B
Mm.
- [07:57]
C
So according to a regulatory filing submitted to the US authorities, the breach originated from a vishing attack.
- [08:07]
B
Oh, your favorite word.
- [08:09]
A
Oh, yummy, yummy.
- [08:11]
C
My favorite thing about this is the article has parenthetically voice phishing attack, which is a social engineering attack. We've all talked about this before, right? Somebody called up impersonating somebody else and got them to reveal some login credentials which got them, got the attackers access. They were able to infiltrate this network, the vendor network, and access files. And the dates are between April 15 and April 22, 2025. So the attack started almost a year ago, and they didn't detect anything until April 28, which is actually like 11 days later, which is really below the average. The average, I don't know. Actually, what I'm thinking of is old information. But it used to be that it would take you 180 days before you knew you had somebody in your network. Now I think that's decreased. So here we are now down 11 days, and this group of attackers is still exfiltrated about 15,000 records. Once the vendor discovered the breach, they did the right thing. They engaged an external cybersecurity company to, you know, do forensics and have incident response. They also notified law enforcement. And here's where it gets a little bit iffy on things, on how. How well things were, you know, how well things were conducted. Despite the fact that they found this breach back in April, they didn't notify Erickson of it until November of 2025. November 10th.
- [09:50]
B
Oh, you mean they didn't identify their mothership. Right, yeah, yeah.
- [09:55]
C
This is a third party vendor. They're out there.
- [09:57]
B
Oh, the vendor didn't identify. Okay, I'm with you now.
- [10:00]
C
The vendor said, oh, we have a cyber incident and they know about it, like within 11 days and they start resolving it. But then it takes them to November to get around to going, oh, by the way, Erickson, we lost 15,000 of your employees and customer records back in April.
- [10:14]
B
Right. Six months ago.
- [10:16]
C
Right.
- [10:16]
B
Okay.
- [10:17]
C
Right. Which would be, I gotta tell you, Dave and Maria, if I was doing business with a company that took this long to notify me that they had breached my data, I would be nonplussed. Let's put it that way.
- [10:29]
A
Nonplussed.
- [10:30]
B
It would be a former business relationship.
- [10:34]
C
I think that's kind of long. This article doesn't name who that third party is, but it says here that a detailed forensic investigation data review process continued for months to identify impacted individuals who was leaked. And the analysis finally concluded last month in February of 2026. So the incident response took almost a year, which is fine.
- [11:00]
A
Yeah, it can take some serious time.
- [11:03]
C
That can take some time. But notification of affected people, affected entities, rather, should be a lot faster than this.
- [11:10]
A
Well, if they only found out that that data was exfiltrated during the course of the investigation. How would they get it faster?
- [11:17]
C
Well, that's a good question. Maybe that's what they. It took them that long to figure out that they had lost that much data.
- [11:23]
A
Yeah. I mean, I think the bigger question that you're getting to is what is a reasonable timeframe? And that's a very complicated question.
- [11:30]
C
Right.
- [11:31]
B
Right.
- [11:31]
A
Yeah.
- [11:32]
C
So the compromise details included full names, residential addresses and dates of birth, Social Security numbers, driver's license numbers.
- [11:42]
A
Aye. Aye.
- [11:43]
B
Aye.
- [11:44]
A
Which used to be the same, right?
- [11:46]
C
Not that long in some states. Yeah.
- [11:48]
A
Yeah, I know.
- [11:49]
C
It was never the same in Maryland. At least not during my lifetime.
- [11:51]
B
No. My student ID was my Social Security.
- [11:54]
C
Yeah. My job.
- [11:55]
A
Yeah. My driver's license was my Social Security number here in Massachusetts for an alarmingly long amount of time.
- [12:00]
B
Alarmingly.
- [12:01]
C
We actually had to fill out our own student identifications by hand at my first university. And I think that my sloppy handwriting may have gotten me out of something.
- [12:11]
A
Security through obscurity. Right.
- [12:13]
C
What's the draft?
- [12:14]
B
Well, no.
- [12:15]
A
Oh, God.
- [12:18]
C
I made. I have a. The way I used to draw eights, they would sometimes come out looking like sixes. Okay, let's say that. So it kind of made me look like I was two years older than I was when somebody who had the authority to ask for my ID asked for it because there was something close to. It was a beer. There was a beer next to me.
- [12:41]
A
You went from implied to explicit. Okay, got it.
- [12:44]
C
I need to see your id. And I'm like, why? She says, you better give it to me or there's going to be issues. And I'm like, okay, fine. Here's my id. I hand her my student ID and she looks at it and I see her counting in her head. Okay. Hands it back to me, you know,
- [12:58]
A
I was like, you took your student ID as id? That's amazing.
- [13:00]
C
Yeah. That's all they could ask for. They couldn't ask for my driver's license because she was an RA with the university. She's not law enforcement.
- [13:07]
A
Right. Oh, my God. I mean, the liquor store can ask for a driver's license.
- [13:12]
B
It's a long way with you, Joe, doesn't it?
- [13:14]
C
Yeah.
- [13:14]
A
Dude, you remember all of this?
- [13:16]
C
I do.
- [13:16]
B
You know your rights?
- [13:18]
C
Well, yeah.
- [13:20]
A
You don't have to get hacking if you've been hacking the whole time.
- [13:23]
C
Yeah.
- [13:23]
A
Wow.
- [13:24]
C
Yeah, that's right. Also, government issue identification documents, like, they. It looks like they lost the passports and photo IDs, bank account information, like where your check might go, your credit card and Debit card details.
- [13:39]
A
Oh, we're back to the story now. Okay.
- [13:40]
C
Yeah, yeah, yeah. Oh, I'm sorry.
- [13:42]
A
I thought you were still talking about the RA and buying beer. Okay, this is all the stuff Joe
- [13:47]
B
carried around with him in his wallet.
- [13:48]
C
That's right. It's that backpack, Dave, that huge backpack.
- [13:51]
A
So that's what's in there. All right, Complete medical history.
- [13:55]
B
So you know, Joe gets hit by a bus.
- [13:57]
C
Yep.
- [13:58]
B
There's no searching and.
- [13:59]
C
That's right. My medical history is too big for a life alert bracelet.
- [14:03]
B
Yeah.
- [14:03]
C
There you go.
- [14:04]
A
Bless it.
- [14:06]
C
So they lost some financial information as well, Certain medical and health related information. I don't know what they would have as medical and health related information for employees beyond insurance information, but, you know, who knows?
- [14:19]
B
Yeah.
- [14:21]
C
This information was accessed. It doesn't specifically say that it was breached, but if you. If it was accessed, you can assume that it was breached. There is, and here's the good news. There is currently no evidence indicating that the stolen data has been misused or publicly leaked. Yeah, that is. That is cold comfort. Yeah.
- [14:41]
B
Yes. Siberia. Nailed it yet.
- [14:43]
C
Yeah. Good news is that they have. Erickson is providing identity theft protection services through a company called idx.
- [14:59]
A
Oh, yeah. Yep.
- [15:00]
C
Know them well, of course, people have to enroll before. Before the. Before June of this year. So.
- [15:09]
A
Can I be brutally honest about that? Just brutally. And this is not nothing at idx. Cause this is not their fault. I've been enrolled in so many of these identity protection services after a gajillion breaches that my data's been in.
- [15:20]
C
Yeah.
- [15:20]
A
All I get is an email at this point and I ignore them all because I don't know what they want me to do with any. I'm just like, I don't really know what this is doing or who it's helping at this point.
- [15:28]
C
Yeah, I had the same. The same thing when I had. I had identity theft protection and there was some kind of incident. Somebody opened a checking account. I think we talked about it on the show.
- [15:40]
B
We did, Yeah, I remember that. Yeah.
- [15:41]
C
And I went over to the branch and I said, what's going on here? Because it was a branch that had local bank here. And I said, I got these things in the mail and I don't remember opening an account with you. And they were like, oh, yeah, that account was open and it immediately closed as a fraudulent account. I'm like, okay. You didn't feel the letting me know? I didn't get a letter. All I got was checks.
- [16:03]
A
It feels like something you should tell me about. Yeah.
- [16:05]
C
Should have just gone out and written a bunch of checks.
- [16:07]
B
Right.
- [16:08]
C
I shouldn't have done that, by the way. I want to talk about something else. I'm going to go off tangent here. I was at the pharmacy, as I am wont to do. Right. I was at the pharmacy. I'm walking out the other day and I see a library card for the Carroll County Library on the ground.
- [16:23]
B
Okay.
- [16:23]
C
And I get in the car and I pick it up and I hand it, show it to my wife, and I go, hey, you want to go get some free books at the library that we won't have to return? And she looks at me and goes, you're a terrible person. Why would you do that? Why would you say that? I'm like, I'm not going to do it. I'm just gonna say that it could be done. I mean, you gotta understand that this. You lose this, that's important. You could wind up paying somebody else's for buying somebody else some books. I did actually turn it in at the library, though.
- [16:53]
A
Joe, did you know if you find a USB key in a parking lot, sometimes there's really yummy data on there, like payroll? You should absolutely open that file.
- [17:01]
C
Yes.
- [17:02]
A
Find out what everybody makes. Yeah, yeah, definitely. Yeah, go for it. Just definitely pick up that USB key. Just put it right into your computer.
- [17:11]
C
Somebody did some research, some AB research on that where they dropped USB keys and saw what was more effective when you writ. When you wrote something on the outside of it, depending on what was written on the outside of it. I can't remember where that was, though. But I do remember reading that research. It was interesting.
- [17:29]
B
It's in the parking lot of the Johns Hopkins Applied Physics Lab.
- [17:34]
A
Top secret agency.
- [17:35]
B
I remember that, too. You know, I had a funny little Social Security number security incident yesterday. I went to the eye doctor just for my annual exam. And you walk into the eye doctor and they hand you a form on a clipboard with all your information. And they say, please check this to make sure everything's accurate. So I'm looking over the form and up the top, it has my name, address, date of birth, Social Security number, and the Social Security number is all X'd out. And I'm like, excellent. Good job, folks.
- [18:12]
C
Yep.
- [18:13]
B
So then I'm going down the list of things, and it gets to my insurance, and it has my primary insurance for my eye doctor, which is some kind of vision coverage. And it says account number, and it's my Social Security number. It's like, so close, right? So close.
- [18:32]
A
Yeah.
- [18:34]
B
Right.
- [18:35]
C
Well, yeah, that's unfortunate. You need to talk to your eye insurance people.
- [18:41]
B
You know, I could.
- [18:44]
C
Right.
- [18:44]
B
But I'm not.
- [18:45]
C
Yeah.
- [18:45]
A
I mean, really, it's a much bigger problem than them, honestly. Yeah, yeah.
- [18:49]
B
Like, I've surrendered when it comes to that. I'm just like. Cause really, you know. Okay. Have at it. Right. Anyway. All right. We will have a link to that story in the show. Notes. I'll tell you what. I'm gonna go next here. And I have two stories here, because they are short. The first one certainly is short. The second one may or may not be, depending on how much we decide to dig into it. This is from the Federal Trade Commission, a little notice that they put out about some scams that they're seeing going around. And these are the you've won a prize scam. So the idea is lucky, right? Wow.
- [19:33]
A
Really?
- [19:35]
B
You get a notice that says you've won a new car, you want a laptop, maybe some money.
- [19:40]
C
I hear that guy that used to be on the Price is Right with Bob Barker.
- [19:43]
B
A new car?
- [19:44]
A
Yeah. Oh, my gosh. Yeah.
- [19:46]
B
Yeah. Rod. Roddy.
- [19:47]
C
Rod Roddy.
- [19:48]
A
Rod Roddy. That's definitely his name.
- [19:51]
B
Yeah. Yeah. I met Bob Barker once. My wife and I went to see a taping of the Price is Right on our honeymoon.
- [19:57]
C
Really?
- [19:58]
B
Aw, that's adorable. Yeah, I got to shake his hand. It was pretty cool.
- [20:01]
C
That's awesome. Does he come out and meet everybody?
- [20:04]
B
Just me.
- [20:05]
C
Just you. The Dave Bittner?
- [20:08]
B
That's right. That's right. Just me. No, but we have it on. We were actually sitting in the front row. We didn't get called up to be on the show, but we were sitting in the front row. So my wife has the aisle seat, and I'm right next to her, and Bob Barker comes down the aisle. For whatever reason, on this particular show, he was coming in through the aisle. And so they announce, and everyone's on their feet, but clapping and everything. And I. And on the show. Cause we videotaped it when it aired. You can see me hurling my recent bride out of the way so that I could shake Bob Barker's hand. Just, like, pushing her out of the way, thrusting out my hand, and shaking Bob Barker's hand.
- [20:57]
C
This is gonna be a great marriage, she's thinking.
- [20:59]
B
Exactly. Exactly. To this day, she reminds me at least once a year that I'm lucky to still have her after.
- [21:07]
A
Oh, my God. I wonder if that's that.
- [21:09]
C
At least once a year for the Forever. Yeah.
- [21:12]
A
If that episode's on YouTube, I need to see this, because that Would be very funny.
- [21:16]
B
Yeah, no, I have. I think I still have the VHS at home, so I have to.
- [21:20]
A
Oh, my gosh, that's so funny.
- [21:21]
B
Trying to find it. I don't remember the date, but anyway, so these. You've won a prize. Things are scams. What happens is they say, congratulations, this is a prize. You've won. Laptop, car, whatever. All you have to do is pay the taxes. All you have to do is pay the shipping and handling fees or the processing fees.
- [21:45]
A
What a steal.
- [21:47]
B
Yep, yep. And it's usually something like 50 bucks, not a whole lot. Although taxes can be more. So if you win a car, they'll say, oh, well, it's only $5,000. Taxes on this brand new Mercedes. And they get you. So the FTC says some of the things that we say here all the time. They say, slow down. Scammers will say things like, it's a limited time offer to try to pressure you into acting quickly. They say, know that real prizes are free. They say anyone who tells you to pay to get your prize is a scammer. And also do some research. If you search online for the name of the contest along with words like complaint, review, or scam, you can see what other people are saying.
- [22:35]
A
Yeah, that's usually what comes up in autocomplete. Nowadays you'd search anything. The next word is always scam. Yeah, it's amazing.
- [22:42]
B
So this is from the ftc, but I will say I did see someone else calling attention to this just within the last week or so, that evidently this is an active scam and whoever's doing this has revved this one up. So just be on the lookout for it. So that is story number one. Story number two is, well, I'm just gonna get to it here, see why. So Meta says, uh, oh, one of
- [23:11]
C
my favorite companies to talk about on this show.
- [23:14]
B
Yeah, Meta, Okay. You know them as the folks behind Facebook, Instagram. They say that they've removed 159 million scam ads in 2025, and they shut down nearly 11 million accounts tied to scam centers, presenting their effort as a major crackdown on online fraud. The company says most of these ads were caught automatically and they're working with law enforcement around the world to disrupt large scam networks. This article, which comes from the folks over at Recorded Future, say critics aren't entirely convinced.
- [23:50]
C
Right.
- [23:51]
A
Yeah.
- [23:53]
B
Americans lost more than $10 billion to scams back in 2023, many of them originating on social media platforms. And of course, I think we talked about it here. There was that investigation from Reuters that suggested that Meta projected about 10% of their ad revenue comes from ads linked to scams. Meta disputes that claim. But who are you going to believe?
- [24:17]
C
Reuters says that 10% of the revenue comes from scams.
- [24:20]
B
Correct?
- [24:21]
C
Huh?
- [24:21]
B
Correct.
- [24:21]
A
That number seems conservative to me. Yeah, based on nothing but gut feeling. Just to be for the record, but.
- [24:28]
B
Right. So lawmakers are pushing for investigations and regulations requiring platforms to verify advertisers. To which I say, hala fricking Eula, Hallelujah. Yeah, there you go.
- [24:41]
A
Halla frickin Lula. Yeah.
- [24:44]
B
So Meta claims it's fighting scams aggressively. My experience says otherwise. I don't know about the other two of you, but this led to just a giant eye roll for me. And I'll believe it when I see it because everything I see on Facebook and, well, Facebook's really the only meta platform I'm on, but everything I see says otherwise. So I don't know if it's a drop in the bucket or trying to bail out the ocean, but thanks, Meta. I guess the bottom line here is that they just have no integrity for this.
- [25:25]
C
You know, nothing is believable.
- [25:28]
B
Right, Right. Yeah. I just don't feel like we can believe anything they say. They've demonstrated time and time again that they don't seem to be a good actor when it comes to following through on what they say they're gonna do or even ever doing the right thing. So just call me skeptical.
- [25:49]
C
Oh, skeptical Dave.
- [25:52]
A
And yet we're all still on their platform, so.
- [25:54]
C
Yeah, yeah, I gave up social media for lent, so I took it all off my phone except for the messenger app. I have to keep that on because
- [26:01]
A
that's not for the messenger app.
- [26:04]
C
Right?
- [26:04]
A
Yeah, yeah, yeah.
- [26:06]
C
But I'm not doom scrolling Facebook or LinkedIn or anything else.
- [26:09]
B
That's good.
- [26:10]
A
It is doom scrolling LinkedIn.
- [26:12]
C
Yeah. Every time I go to LinkedIn, it's like my favorite new term for LinkedIn is Facebook in a suit.
- [26:19]
A
That's so true.
- [26:21]
C
It's unhinged garbage from front to back. And everybody's out there. Look, I'm a LinkedIn content creator. I had AI generate this post that you might find insightful. No, I don't.
- [26:31]
B
Yeah, I don't.
- [26:32]
A
Yeah, the LinkedIn lunatic subreddit is one of my favorite places on the Internet. It's quite amazing.
- [26:38]
C
Oh, I will have to check that out too.
- [26:40]
A
It's basically the people who spend way too much time on LinkedIn trying to make themselves very, very influential. And I just. I really hate LinkedIn. I recognize this utility and I have an account and I use it, but I also hate it.
- [26:54]
C
So I have an update on my things joehates.com domain. Yeah, it's mine again.
- [27:02]
B
Wow, that was quick.
- [27:03]
A
In the course of this recording.
- [27:05]
C
Yeah, I just went to GoDaddy.com and said, hey, is this still available? Because, you know, if the people who snatched it up snatched it up when it expired.
- [27:14]
B
I see.
- [27:15]
C
And then they just, they were like, okay, this guy's not contacting us. We can't just blackmail him for his domain. So it has expired again. So I bought it. All right, so I have it.
- [27:25]
B
Wow.
- [27:26]
C
Wow. There's nothing going to it. They won't. People won't see the podcast if they go to it.
- [27:29]
A
But I have the breaking news on hacking humans. This is what we do here. What we're known for is breaking news.
- [27:37]
B
Oh, my gosh. You know, somebody once created a. What was it? It was the awesomeness that is davebitner.com I think.
- [27:46]
A
When did you buy that domain, Dave?
- [27:48]
B
Well, the thing is, I didn't. It was some friends of mine who were razzing me. And yeah, when you brought it up, it was just a big picture on my smiling mug. Hilarious. It was a hilarious joke back in 2004, I think. Wow. Yeah. Anyway, all right, tell you what, let's take a quick break here to hear from our show sponsor. We will be right back after this message. Most environments trust far more than they should, and attackers know it. ThreatLocker solves that by enforcing default deny at the point of execution. With ThreatLocker allowlisting, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. Its powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today. And we are back. Maria, it is your turn. What do you got for us?
- [29:34]
A
I've got a short story for today. Just a. It's been a little while since we've checked in on the world of deep fakes. And it's not that there's necessarily anything new, new, new, aside from they continue and they're getting better all the time. But I, I, it's one of those vectors that just continues making everything worse. So I figured it's time for us to just take a little look at it. And the lens through which I wanted to just take a look at it was actually through Canada and Canada. U.S. politics and political engagement right now. Not a big surprise that U.S. canada relations right now are not fantastic. Yeah. And unfortunately there have been a spate of deep fake videos blanketing YouTube especially that are a lot more subtle than you might expect that are fanning the flames.
- [30:26]
C
Sorry, it's Americans badmouthing their bacon.
- [30:31]
A
Well, no, see, that would be to me more obvious, but yeah.
- [30:36]
B
Is it more subtle than that?
- [30:38]
A
A little more subtle than that, yeah. Like that's obvious bait. Right? But if you have a half an hour long video of Warren Buffett sort of pontificating on the economic fallout of U.S. canada relations souring, and again it's him sitting in a chair talking about it in economic terms and there's nothing really obviously malicious about what he's saying, you might go, oh, and really give that video a listen. And not suspect that somewhere in that long video there's some stuff that's not quite correct or exaggerated, but it's subtle.
- [31:14]
C
Is the entire video synthetic?
- [31:16]
A
The entire video is synthetic. It's a half an hour long deepfake of Warren Buffett. And this specifically comes via Toronto Star, this little investigation about that specific video. But what I thought was very interesting was that one video, and there's many like this, got 300,000 views on YouTube alone about the Warren Buffett deep fakes, to be specific. And it is propaganda, it is disinformation. But because it got so many views, it also made money for the people who are spamming these deepfakes. So it is a self perpetuating problem of it seems credible enough to have Warren Buffett not saying anything crazy or offhand. Like it's not like him going out there being like, I'm gonna bomb name province, you know, nothing, nothing like that. It's just him, him pontificating in a way that sounds like you've just caught him in a quiet moment at Davos, right. And he's talking about how things are bad and gonna get worse and it all sounds plausible. So it's enough that you would sit there and listen and go, this is an expert giving some really good insight on current world events and you might not have any sense that this is actually fake. And indeed, in this case, it is entirely fake. And the scammers have now made money off of your views. Cause they're able to serve ads Against it on YouTube. And then, of course, then the algorithm will serve you more and more and more videos just like this. So, AI slop deepfakes on YouTube. Not exactly brand new. And I'm sure now with the conflict in Iran, we're going to see more along those lines as well. But to me, the idea that it's not just being used for disinformation, but also for making money is like, oh boy.
- [32:56]
C
Yeah, that's great. I have noticed that YouTube has just become a pile of garbage in terms of content.
- [33:06]
A
Yeah, it's a shame, isn't it?
- [33:07]
C
And it is. It used to be good. And there's, you know, the channels I follow, I still enjoy going to and seeing. But if I want to know about something I can't find, I search it on YouTube. I can't find a not obviously AI video.
- [33:22]
A
You know,
- [33:25]
C
sometimes it takes me like a minute and a half to get into. I'm sorry for cutting you off, Maria. But sometimes it takes me like a minute and a half and then the cadence of the voice is off a little bit or there's a mispronunciation. I'm like, this is just somebody's AI slop. And I've been consuming it for. For like a minute ahead down vote close with that.
- [33:41]
A
Yeah, it feels like a betrayal. And it's also for all of us who have hobbies, which all of us do, YouTube was the gold mine of, you know, getting expert advice from people who are, you know, pro hobbyists in your chosen field or for home improvement, you know, how do you fix that squeaky door or whatever? I still remember there's this video, this one guy, his whole video is how to fix a really, like a door that's out of alignment. And it was the best video on YouTube I've ever seen. It has like 6 million views. And he tells you exactly how to fix it and he shows you how to do it and he tells you exactly, like, if it doesn't work, here's the other things to try. And I, like, I gave him five bucks and it was a legit video. And I'm thinking that's what YouTube is meant for. That is good Internet, right? And now those videos are very hard to find. And all our hobbies are getting filled with slop videos of showing things that are just not possible or incorrect. And it makes me really, it makes me really Sad and mad and makes me want to go to a cabin in the woods.
- [34:39]
C
Here's Maria. David Thoreaude.
- [34:44]
A
I don't live far from where he was at, but it's changed a lot since his day.
- [34:48]
C
I told my son that I told that story in this podcast, and he said I was 15 when I told it, not 12.
- [34:53]
A
Oh, still very clever, though.
- [34:55]
C
Yeah. He still couldn't come up. He. He picked that name. It was either Henry David Thode or he thought another author that he couldn't remember which one it was, but he got it right.
- [35:04]
A
So he went, Ralph Waldo Emerson.
- [35:07]
C
You know what, Maria? That's exactly who it was.
- [35:09]
B
Yeah.
- [35:09]
A
Here you go. Thank you. You're very welcome.
- [35:14]
C
You said the name, and I'm like, yep. You know, I want. You know, here's the thing, Maria and Dave, I think there's a real opportunity out there for someone just to come in and eat YouTube's lunch.
- [35:26]
A
A YouTube disruptor.
- [35:28]
C
Right. We're gonna put up content that is not AI. If you post AI generated content to our website, your entire account is immediately deleted and banned.
- [35:40]
A
It's gonna be the rise of curation. I think we're gonna go back. YouTube used to be curated. In its early days, it was curated. And. Yeah. And now the pure volume of it, it can't be. But I wonder if we're gonna have to go back to that. Cause it's just gotten so bad.
- [35:54]
B
And I saw someone over the weekend mention they referred to it as. And actually this is a YouTuber who does sort of home improvement kinds of things, not unlike what you were describing, Maria. And this person was lamenting exactly what we're talking about here. And his prediction was that we're headed for what has to happen is. He called it an economy of authenticity, where people are gonna be so hungry for authentic creators that there will need to be a way to differentiate them from all the slop. And so I agree it's a space ready for disruption. But it's just like Facebook. We're all locked in, and it's hard for anybody to. I mean, you know, if we had a real fight against monopoly in this country, perhaps something could be done, but it doesn't seem to be happening these days.
- [36:51]
C
The problem with that argument is that there really is no barrier to entry to you standing up another competing service. Although I think what you're talking about more is the huge tech conglomerates. Right. Like, there's no way for you to start up an Alphabet or a meta.
- [37:08]
B
Right.
- [37:08]
C
And that those companies should be broken Up.
- [37:10]
B
So, yes, just the scale at which they operate makes it really hard for anyone else to break in.
- [37:16]
C
Yeah, I don't like that those companies are as big as they are.
- [37:19]
B
Yeah. So, Maria, your story reminds me of a. Something that crossed my desk earlier today, which is that the folks at Grammarly are facing a class action lawsuit. Have you seen.
- [37:32]
A
Yeah, I did. Because I'm in the journalist circle. A lot of people I know are joining that class action lawsuit because Grammarly apparently, and I'm gonna summarize it very poorly, but you know, it's AI, so it's fair. Basically they've got something where you can write in a famous journalistic voice, like a reporter's voice. So I guess they scraped a whole bunch of articles written by journalists and said, you want to write like this journalist? You can now do that. And a lot of writers are understandably, like, you know, that's actually a skill that people spend years and years honing developing your journalistic or writerly voice. That's not just something you're born with. That's a skill that you got to work at. So it's not okay for someone to come in and say, we're just going to steal that. Thank you very much. So I'm very glad that you ask. And they did not ask. They did not ask. No.
- [38:20]
B
Right. Yeah. And it's not just people who are alive. Like you could say, you know, update this article in the voice of Carl Sagan and it'll do it.
- [38:29]
C
Who's that guy that broadcast the Hindenburg?
- [38:32]
B
Right?
- [38:33]
A
Not Carl Sagan.
- [38:34]
B
Not Carl Sagan. All the humanity. All the humanity.
- [38:38]
A
Billions and billions. Anyway, I just realized also, I'm probably gonna drive somebody crazy that I didn't actually mention the name of the video about the sticking door. The guy's name is Donnie Doors and The video is 17 years old. So I put a link in it. Cause someone's gonna need a link to how to fix a sticking door from
- [38:55]
B
Donnie Doors, who said. Did he retcon the name after he became popular for his door video?
- [39:03]
A
Or maybe. But he has an ebook on his website and I gave him a few bucks. Cause he actually helped me fix like three doors in my house that wouldn't latch properly. I was so grateful. So, yeah, I figure someone might need this link. So I'm putting it in the show notes.
- [39:18]
B
Yeah, maybe I'll start calling myself Davey Cyber.
- [39:21]
C
I am looking at his. I'm looking at this guy's YouTube page and he's got like how to tie knots on it.
- [39:28]
B
Oh, I'm gonna.
- [39:29]
C
This is. Thank you, Maria. This is my new rabbit hole.
- [39:32]
A
I. I'm telling you, this is. See, when I did the same thing when I found his channel and I said, you know what? This is what the Internet was really made for. This is good Internet stuff. I missed this Internet when it was a lot of this kind of thing. And so it makes me happy when I think, still see stuff like this. This is real expertise. And it was delivered very well and to the point. And the video's only 7 1/2 minutes long. And he goes through like every scenario of how to fix a damn door, which if you don't do it yourself, you end up paying a lot of money for someone else to do it for you. So you know that's true. Yeah.
- [40:03]
B
No. One of my regrets of never having been a boy Scout is that I wish I knew more knots than I do. And I realize I can. There's nothing stopping me from going out and learning more knots. But I feel as though it's one of those things that would have been much easier and would have stuck with me had I learned them when I was just a young lad.
- [40:21]
A
Well, Donnie Dorz is here to help. It's never too late.
- [40:25]
B
All right, we will have links to all of this stuff in our show notes. Joe, Maria, it is time to move on to our catch of the day.
- [40:41]
C
Dave, our catch of the day comes from the scambait subreddit. Apparently there's a discount Elon Musk out there. Discount Elon Musk? He loves me within five minutes. It's a romance scam, it looks like.
- [40:56]
B
Yeah.
- [40:56]
C
Who's gonna be whom here?
- [40:58]
B
Well, I think I will be the aspirational Mr. Musk. Yes, Maria. Oh, boy, you can be with escalating frustration, because that's what this is about. So I will begin. I'll say hello.
- [41:15]
A
Hello. How did you get this number?
- [41:17]
B
Baby, you don't know me. Send me you pictures.
- [41:22]
A
No, I don't send pictures to people I don't know. I am not your baby.
- [41:26]
B
Honey, you know I love you very much. Try to send me you pictures. You are the best in my life. Heart, heart, heart.
- [41:33]
C
This is just starting off like asking for pictures.
- [41:37]
B
I mean, Elon doesn't have time to waste, Joe.
- [41:39]
A
No, that's why he's a very well known man.
- [41:41]
B
He's very busy man.
- [41:42]
A
Yeah, I don't know you. How can you love me in five minutes? You just met me. I'm not sending pictures to strange men. You must be crazy.
- [41:51]
B
Honey, you need to know me. Honey. I love you very much. Heart. Heart. Heart.
- [41:56]
A
Call me Jen.
- [41:59]
B
I can do without you anymore. Honey, I love you very much. Heart.
- [42:04]
A
Don't use pet names. I hate them. I don't love you. I don't know you honey.
- [42:09]
B
Why you don't me? I loved you. I love you and I will love you forever.
- [42:17]
A
I just met you five minutes ago.
- [42:20]
B
I will love you till my last breath. No matter what life brings before us.
- [42:26]
A
No, you don't. Your love is literally based on nothing. You don't even know me. How can you love me?
- [42:31]
B
Honey? Forget that one. Honey, I love you very much. Loving you is the only thing that makes my life worth living.
- [42:38]
C
This is like the worst love bombing ever.
- [42:41]
A
It's like aggravating love bombing. Forget what? I don't love you. Call me Jen. I hate pet names.
- [42:47]
B
Because I love you with all my heart.
- [42:50]
A
I hate pet names. I don't love you.
- [42:53]
B
Honey. Don't worry yourself anymore. Send me you pictures.
- [42:56]
A
Honey, you haven't said anything about yourself.
- [42:59]
B
I love you very much.
- [43:05]
A
Capital N O. No. Stop asking for pictures. I don't send pictures to strangers.
- [43:10]
B
Okay, my beautiful love.
- [43:13]
A
You will have to actually get to know me as a person. Call me Jen.
- [43:18]
B
Okay my beautiful love.
- [43:21]
C
He's gonna call this woman anything but J.
- [43:24]
B
Am busy for now honey. Honey, you are my best love. Am feeling on you honey. Love you very much.
- [43:34]
A
Call me Jen. Call me Jen. Call me Jen. Call me Jen.
- [43:39]
B
Honey. You are the only person I love in my life, honey.
- [43:44]
A
Call me Jen.
- [43:48]
B
I love you very much.
- [43:51]
A
What's my name?
- [43:52]
B
Honey? You are my queen. Honey. I love you very much.
- [43:59]
A
What's my name? If you don't even know my name, how can you love me? I don't want to talk to you unless you can have a real conversation.
- [44:06]
B
Honey. Don't worry yourself anymore. Am busy now honey.
- [44:12]
A
Because. Just kidding. I love you for every single response is very, very boring. So call me Jen. Do not call me honey. Why don't you listen honey?
- [44:23]
B
I know you name honey but you are my best.
- [44:30]
A
Call me Jen or I will stop talking to you. No more honey. It is getting really aggravating. So what is my name? Why won't you use it?
- [44:40]
B
Honey, my name is Jennifer Lopez. I love you very much. You are the only person I love in my life. So send me you pictures now. Honey. You are my honey.
- [44:55]
A
How do I parse this? So no, you need to have a real conversation with me first. Jennifer Lopez. And especially this from Elon Musk.
- [45:03]
B
This is confusing Honey, you know I really love you very much. Heart, heart, heart.
- [45:08]
A
I doubt this very much, as it did not take much for you to fall in love, and thus, it would not take much love for you to fall for literally anything with two legs and a hole. Slash wiener.
- [45:19]
B
Ew. Ooh. Wow. Geez.
- [45:22]
A
Call me Jen.
- [45:23]
B
Oh, sorry, Jen. No, I'm Jen. Wait. Oh, we're both Jen. Oh, this is so confusing. All right, let's try to cut to the chase here.
- [45:32]
A
This is a really long one.
- [45:34]
B
It just goes on and on and on. No pictures for you, honey. You, my heart. So let her, honey.
- [45:40]
A
My name is also Jennifer.
- [45:44]
B
All right, I'll tell you what. Let's leave this.
- [45:46]
A
I cannot believe how long this goes on for.
- [45:48]
B
Just go. I mean, this goes on, but I'm interested in just how much patience the recipient has here, who's clearly playing along.
- [45:56]
C
Yeah, I'm not sure there's a person on the end of this.
- [45:59]
A
I was gonna say you're just wasting your time with a bot. I wouldn't even bother.
- [46:03]
C
You think this fails the Turing test for me?
- [46:05]
B
Yeah. Yeah. Could be. Could be. All right, well, Maria, thank you, honey.
- [46:14]
A
Call me Jen.
- [46:19]
B
All right, well, we will have a link to that in our show notes. And of course, if there's something you'd like us to consider for the catch of the day, please do send it to us. It's hackinghumans2k.com. Most environments trust too much and attackers know it. Threat Locker enforces default deny at execution Blocks unknown apps and limits what trusted apps can do. Stop ransomware at the source. Get your demo@threatlocker.com N2K. And that is our show, brought to you by N2K Cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast. Please also fill out the survey in the show notes or send an email to hackinghumans2k.com this episode is produced by Liz Stokes. Our executive producer is Jennifer Ivan. We're mixed by Elliot Peltzman and Trey Hester. Peter Kilpe is our publisher. I'm Dave Bittner.
- [47:31]
C
I'm Joe Kerrigan.
- [47:32]
A
And I'm not Jen. I'm Maria Varmazes.
- [47:35]
B
Honey, thanks for listening, honey.