Latest / Privacy Please / S7, E275 - Choose Wisely: GigaWiper, Your New Delete Button & The Gold Bar Grift

Transcript

S7, E275 - Choose Wisely: GigaWiper, Your New Delete Button & The Gold Bar Grift · Privacy Please

• 0:07
  SPEAKER_00: Righty then, ladies and gentlemen, welcome back to another episode of Privacy Please.
• 0:14
  SPEAKER_00: I am your host, Cameron Ivey, and today we have a theme of choice.
• 0:21
  SPEAKER_00: That is the theme, my friends.
• 0:23
  SPEAKER_00: Because it turns out that everybody is making one right now.
• 0:28
  SPEAKER_00: Or at least we think we are.
• 0:29
  SPEAKER_00: Hackers are choosing how they want to destroy your data.
• 0:32
  SPEAKER_00: Lawmakers are finally giving you a choice about who gets to keep your data.
• 0:36
  SPEAKER_00: And one very unlucky woman in Phoenix almost made the choice that might have been the worst of her life over a bag of gold bars.
• 0:46
  SPEAKER_00: Quick reminder before we dig in if you're listening on a podcast app, go follow us, hit subscribe, whatever it's called in the app or wherever you're listening to us.
• 0:57
  SPEAKER_00: Cost you nothing.
• 0:58
  SPEAKER_00: Helps us a huge ton.
• 1:00
  SPEAKER_00: A huge ton.
• 1:00
  SPEAKER_00: That sounds terrible.
• 1:02
  SPEAKER_00: Helps us a lot.
• 1:03
  SPEAKER_00: And if there is a video version, it'll be on our YouTube.
• 1:06
  SPEAKER_00: Not all of them are always uh released on YouTube, but you can go there as well as the problemlounge.com for all of our episodes as well on our website.
• 1:15
  SPEAKER_00: So this week, Microsoft finds malware that lets attackers pick their own destruction method a la carte.
• 1:23
  SPEAKER_00: It's fancy.
• 1:25
  SPEAKER_00: Actually, not that fancy.
• 1:27
  SPEAKER_00: Two new privacy laws just handed you tools nobody is talking about.
• 1:30
  SPEAKER_00: And the FBI catches a scammer trying to flee the country mid-heist.
• 1:36
  SPEAKER_00: Let's get into it, people.
• 1:50
  SPEAKER_00: Alright, first up, Microsoft just published research on something called GigaWiper.
• 1:56
  SPEAKER_00: And it's not what you think it is.
• 1:59
  SPEAKER_00: It's a nasty little shift in how destructive malware works.
• 2:04
  SPEAKER_00: So here's some quick context for you.
• 2:07
  SPEAKER_00: Normal ransomware wants your money.
• 2:10
  SPEAKER_00: It just wants you gone.
• 2:12
  SPEAKER_00: No negotiation, nothing to pay for.
• 2:15
  SPEAKER_00: GigaWiper takes that and makes it worse.
• 2:18
  SPEAKER_00: It's a backdoor built from pieces of at least three older malware families.
• 2:23
  SPEAKER_00: And once it's inside your network, the attacker doesn't even have to decide how they're going to destroy you until they're already in.
• 2:32
  SPEAKER_00: Overwrite the hard drive at the physical level, deploy fake ransomware with an encryption key that's randomly generated and never saved.
• 2:39
  SPEAKER_00: So even if you paid, there's nothing to unlock.
• 2:43
  SPEAKER_00: Or just quietly sabotage the system.
• 2:46
  SPEAKER_00: Nobody's been named as the group behind it yet.
• 2:49
  SPEAKER_00: Microsoft, Google, and another security firm are all independently tracking it under different names, which honestly makes it way creepier.
• 2:58
  SPEAKER_00: Multiple serious researchers converging on the same thing at once.
• 3:03
  SPEAKER_00: Here's a quick tip.
• 3:05
  SPEAKER_00: This is squarely a your backups are the only thing that saves you story.
• 3:10
  SPEAKER_00: If you run a business, offline or otherwise, resilient backups aren't optional anymore.
• 3:17
  SPEAKER_00: Wipers don't negotiate.
• 3:18
  SPEAKER_00: There's no ransom to pay your way out of this one.
• 3:22
  SPEAKER_00: Alright, so here's the second story, and this one's actually good news, which I know is weird for this show.
• 3:28
  SPEAKER_00: As of July 1st, Connecticut quietly flipped on a new requirement for us.
• 3:33
  SPEAKER_00: Companies now have to clearly disclose their privacy notices whether your data is being used or sold to train large language models.
• 3:41
  SPEAKER_00: ChatGPT, Gemini, DeepSeek, and Grok are named specifically.
• 3:46
  SPEAKER_00: This is one of the first privacy laws written for the AI moment instead of retrofitted onto old ones.
• 3:55
  SPEAKER_00: Here's the catch though.
• 3:56
  SPEAKER_00: And the part, of course, no one mentions.
• 4:00
  SPEAKER_00: Almost no one knows this exists yet.
• 4:03
  SPEAKER_00: And I'd bet real money, most companies are technically complying by burying it in 12 paragraphs of legal boilerplate that tells you nothing.
• 4:13
  SPEAKER_00: Here's what that probably looks like in practice.
• 4:16
  SPEAKER_00: Somewhere around paragraph 11 of a privacy policy you've never read, a line like aggregated user data may be utilized to enhance machine learning capabilities across afflated services.
• 4:29
  SPEAKER_00: Something like that.
• 4:30
  SPEAKER_00: Technically discloses it, tells you absolutely nothing.
• 4:34
  SPEAKER_00: That's the gap.
• 4:36
  SPEAKER_00: This law has not closed yet.
• 4:38
  SPEAKER_00: It says disclose, it didn't say in English though.
• 4:42
  SPEAKER_00: Here's a tip.
• 4:43
  SPEAKER_00: Next time you get a privacy policy update email, and I'm sure you're going to get one soon.
• 4:48
  SPEAKER_00: Actually search it for train or AI or language model.
• 4:53
  SPEAKER_00: Takes 30 seconds.
• 4:54
  SPEAKER_00: You might learn something you didn't expect.
• 4:58
  SPEAKER_00: Sticking with the actually good news theme, California's Delete Act is already live.
• 5:03
  SPEAKER_00: Drop, the delete request and opt-out platform, has been up and taking requests since January 1st, if you weren't aware.
• 5:10
  SPEAKER_00: What actually happens August 1st is enforcement.
• 5:14
  SPEAKER_00: That's the date data brokers become legally required to check Drop and act on the request already in the queue.
• 5:22
  SPEAKER_00: Before that, they just had to register.
• 5:25
  SPEAKER_00: Here's how it works: you go to privacy.ca.gov, verify you're a California resident, and submit your name, email, and phone number.
• 5:34
  SPEAKER_00: Drop hashes that and sends it out to every registered broker at once.
• 5:39
  SPEAKER_00: Over 600 of them as of this year.
• 5:41
  SPEAKER_00: Brokers have to check Drop at least every 45 days and report back on the status of your request.
• 5:48
  SPEAKER_00: And if they don't comply,$200 a day per request and fines.
• 5:53
  SPEAKER_00: That's real teeth.
• 5:54
  SPEAKER_00: That's good.
• 5:55
  SPEAKER_00: That's a great update.
• 5:57
  SPEAKER_00: That's so good to hear.
• 5:58
  SPEAKER_00: Now here's a tip.
• 5:59
  SPEAKER_00: If you're in California, submit your request right now.
• 6:03
  SPEAKER_00: It's sitting there cued and ready.
• 6:05
  SPEAKER_00: So the second enforcement kicks in on August 1st, you're already in the front of the line.
• 6:10
  SPEAKER_00: Get going.
• 6:12
  unknown: Act now.
• 6:13
  SPEAKER_00: Alright, last one here, and this is a story that's gonna make you want to call your parents tonight.
• 6:18
  SPEAKER_00: A 78-year-old woman in Phoenix gets a call.
• 6:21
  SPEAKER_00: Ring ring.
• 6:22
  SPEAKER_00: Hello.
• 6:24
  SPEAKER_00: I don't know why that was like Mrs.
• 6:26
  SPEAKER_00: Doubtfire.
• 6:27
  SPEAKER_00: Guy on the other line says he's from the U.S.
• 6:30
  SPEAKER_00: Attorney's Office.
• 6:31
  SPEAKER_00: Tells her she's a victim of identity theft connected to a federal investigation.
• 6:36
  SPEAKER_00: And I mean he goes there.
• 6:37
  SPEAKER_00: He tells her it's tied to a child exploitation case.
• 6:41
  SPEAKER_00: Pure fear, straight to the gut.
• 6:43
  SPEAKER_00: He walks her through protecting her money, which somehow means converting it to gold and having it picked up.
• 6:51
  SPEAKER_00: She's in the process of handing over$600,000 in gold bars when something in her clicks, and she calls the actual authorities herself instead.
• 7:00
  SPEAKER_00: FBI tracks the guy down, his name's Gary Christopher, never trust the guy with two first names, and catches him at a Phoenix Sky Harbor Airport mid-scam, trying to board a flight to none other than Florida.
• 7:14
  SPEAKER_00: Wait a minute, that's my state.
• 7:15
  SPEAKER_00: Why am I making fun of it?
• 7:17
  SPEAKER_00: Ah, we all know what it means.
• 7:19
  SPEAKER_00: Alright, here's the thing.
• 7:22
  SPEAKER_00: This isn't a one-off wild story.
• 7:25
  SPEAKER_00: The FBI says phantom hacker scams have pulled in over a billion dollars since 2024, and gold bar scams specifically took$219 million last year alone.
• 7:37
  SPEAKER_00: Most victims are 60 and older, and the courier in our story wasn't some criminal mastermind.
• 7:43
  SPEAKER_00: Court documents say Christopher actually left his job to travel the country picking up gold for scammers,$5,000 a box.
• 7:51
  SPEAKER_00: That's the business model now.
• 7:52
  SPEAKER_00: Regular people getting recruited as couriers for cash, no idea or no care what they're actually a part of.
• 8:00
  SPEAKER_00: Here's a tip: no government agency will ever tell you to move your money into gold, crypto, or stupid gift cards to protect it.
• 8:08
  SPEAKER_00: Ever.
• 8:08
  SPEAKER_00: If you get this call, or your parents do, or your grandparents, hang up.
• 8:13
  SPEAKER_00: I don't even know who answers calls anymore if you don't know their who's calling you, anyways.
• 8:17
  SPEAKER_00: Call the actual agency back using a number you look up yourself, not one that they gave you.
• 8:22
  SPEAKER_00: Alright, so quick recap here.
• 8:24
  SPEAKER_00: Attackers are now choosing their destruction method, a la carte.
• 8:27
  SPEAKER_00: Connecticut and California just quietly handed you tools most people don't know exist yet, and a phone call almost cost one woman her life savings and gold bars.
• 8:36
  SPEAKER_00: Choose wisely, people, because this week, everybody else sure is.
• 8:41
  SPEAKER_00: Listen, if you have topics, stories, or guests that you want me to dig into, I would love to hear from you.
• 8:48
  SPEAKER_00: Um I love doing these kind of stories.
• 8:50
  SPEAKER_00: Obviously, this is a shorter episode this week.
• 8:52
  SPEAKER_00: Things have been a little hectic in life and all those things, so appreciate the patience.
• 8:57
  SPEAKER_00: I know I haven't had as many episodes like we usually do, so thanks for sticking through.
• 9:02
  SPEAKER_00: Uh, things will pick back up soon.
• 9:04
  SPEAKER_00: We have tons of guests in the queue and a lot of good things to cover.
• 9:09
  SPEAKER_00: So thank you so much for the support.
• 9:11
  SPEAKER_00: Thank you for listening to Privacy Please.
• 9:14
  SPEAKER_00: And if this was your first time, thank you for joining us.
• 9:16
  SPEAKER_00: I hope you hit subscribe and continue with us.
• 9:19
  SPEAKER_00: Um, stay safe out there, and we will see you guys on the next one.
• 9:23
  SPEAKER_00: Cameron Ivy.
• 9:25
  SPEAKER_00: Over and out of the