Latest / Financial Survival Network / CyberSecurity Awareness -SIM Swapping and The Two-Factor -- Robert Siciliano #5937

Transcript

CyberSecurity Awareness -SIM Swapping and The Two-Factor -- Robert Siciliano #5937 · Financial Survival Network

0:00
Now, once they're inside the email, that gives them the ability to reset
0:05
the passcode on all the various accounts which are crypto, finance, banking,
0:11
whatever, credit card, Amazon, eBay, PayPal, whatever. Okay,
0:16
so they can reset the passcode on all the various accounts, but then they
0:20
still need that second factor for example, Coinbase, whatever it might be,
0:24
the crypto, they still need that second factor, which is once they gain
0:28
access to the email then and then once they have a handle on all the
0:32
various accounts, then the next thing they need to do is swap out that
0:36
SIMP. You're listening to Carrie Let'sa's Financial Survival Network where you get valuable information
0:42
you just can't find anywhere else to thrive in today's trying times. You need
0:47
the Financial Survival Network now more than ever. Go to Financial Survivalnetwork dot com
0:54
and get your free newsletter and gift. Financial Survival Network now more than ever.
1:03
Welcome you are listening to watching the Financial Survival Network of your own scary
1:07
lotz. Well, as we get to the end of October, we're getting
1:11
to Halloween, and nothing is spookier to think that somebody could get all of
1:15
your passwords to all your banking, to your credit cards, to everything,
1:22
to your email and take over your life. Well that's a real scary scenario.
1:26
So it's appropriate for Halloween. And our good friend Robert Ceciliano is with
1:33
us now. He is a security expert. Robert, you go around the
1:38
world lecturing about this stuff, password managers, all of this. My greatest
1:42
fear in life. One of them, and I guess I have a few,
1:46
is that somebody will crack the Apple password security scheme through neural network or
1:53
quantum computing and they'll have the keys to the match and if you will.
1:57
Is that fear overblown or is it realistic? So that's entirely possible. Now.
2:06
Password management is everything from making sure you're using strong passwords, which are
2:13
uppercase lowercase numbers and characters sometimes past phrases, to utilizing a password manager that
2:22
facilitates having a different password across every account. And then of course there's biometrics.
2:29
There's facial recognition, this's fingerprinting and so forth, and then of course
2:32
adding on additional security means two factor authentication, and whether that's using some type
2:38
of an authenticator app, or it's using SMS, texts right or eye message,
2:45
whatever it might be, and everything you know, beyond that and in
2:47
between, it's it's encryption and breaking encryption codes, and all of those concerns
2:58
need to be addressed at some level. Okay, But here's the thing,
3:00
Like, for for most of us, most of us are using the same
3:07
passcode across multiple accounts. The biggest mistake. Yeah, most of us are
3:15
not using two factor authentication for all of our critical accounts. Okay, most
3:21
of us. And when I say most of us, mistake, yeah,
3:24
And I know this because you know, statistically, that's what all the studies
3:30
show. But beyond that, I get in front of live audiences all the
3:34
time. So I might work with, like, you know, a financial
3:38
services professional who has like a book of business of I don't know, like
3:43
a billion dollars two billion dollars a year was worth their investments or whatever,
3:47
in clients, whatever, and he'll have you know, his top Like one
3:52
hundred people come in and I'll speak to them, and I'll ask them,
3:55
like how many of you use a password manager? And like ten of them
4:00
will raise their hand, And then then the next question is how many of
4:02
you use two factor authentication for email? And like five of them will raise
4:08
their hand you know, and these are moneyed individuals and then not doing much
4:14
in the way to protect their own data, their own devices, and these
4:19
are this is your client base. So if somebody breaks into your client's email
4:29
and then begins to communicate with you as one of your clients, right because
4:34
they're in your client's email, and you're thinking, this is my client reaching
4:40
out to me, communicating via email. And if that in this case,
4:46
you know, criminal hacker is good enough to impersonate your client from your client's
4:53
email, which isn't that difficult to do? You know, they can get
4:59
you in many ways to transfer money out of your client's account and so on.
5:05
It can just get as ugly as it can possibly be. Okay,
5:11
So I just did a presentation yesterday for real estate agents, and real estate
5:16
agents are handling handling a lot of sensitive client information. They're handling wire transfers
5:21
in many various states and so on. And I asked the same question of
5:27
real estate agents, who are service professionals who deal with transactions, who deal
5:32
with sensitive data, and they're not any more secure than your basic investor.
5:41
Unbelievable. You do two things. So a lot of the financial websites mandatory
5:49
two factor authentication now even to the point where they won't go with the SMS
5:56
code for you to type in. They actually make you approve it on your
6:00
device where it says are you trying to get into American Express? Yes?
6:04
Or no? I say no. That's the end of it. And the
6:10
other thing is there's a thing called SIM swapping. Know about this, but
6:15
a friend of mine, she got nailed from a crypto account. They went
6:19
into T Mobile in New York. She was in Florida, and they said
6:24
they were her. Maybe they even had some identification and they said they lost
6:28
their phone. They got a new phone with a SIM. They managed to
6:31
pull out eighteen grand from a crypto account, and they were in the process
6:35
of trying to steal money out of her bank account, but it was stop.
6:40
Now that bank account, you're going to be covered eventually, God knows
6:45
how long that's going to take. But the crypto account a lot more complicated.
6:49
Had to go to a lawyer, got to be suing these people.
6:53
And I didn't even know in the end if they're libel to you or not,
6:57
if they actually did what they set we're supposed to do. Yeah,
7:01
So this is like disaster in the making here. It's about the other.
7:04
You've got to make sure that your phone company will never give someone another phone
7:11
with a cloned simcord that you know, it's really tough. That one really
7:17
took me for a loop. Yeah, so I just just just two weeks
7:23
ago. I testified as an expert witness in a simswap case just two weeks
7:28
ago. And the victim in this case, which is the plaintiff, a
7:32
client and his attorney. He lost nineteen thousand dollars with the crypto because one
7:40
of the telco's facilitated his SIM card being swapped out, which meant that the
7:50
criminals were able to get into his coinbase account exactly, and they made like,
7:59
I don't know how many I need hundreds of like four and five dollars
8:03
transfers out of his account over the course of a long weekend. In the
8:07
back is working, right, his phone stopped working. He had no idea
8:11
why correctly even get through to the carrier, right, correct, correct,
8:16
So there's a few things going on there. In the case of your friend
8:20
and my client, I would bet that your client email was also compromised.
8:28
Had to be, had to be, because now else could they know about
8:31
the account. Yes, I would bet that the client's email was compromised first.
8:35
Same with my clients, because I'm confident that my client's email was compromised
8:41
first. Now, once they're inside the email, that gives them the ability
8:46
to reset the passcode on all the various accounts which are crypto, finance,
8:54
banking, whatever, credit card, Amazon, eBay, PayPal, whatever.
8:58
Okay, so they can reset the passcode on all the various accounts. But
9:01
then they still need that second factor, for example, Coinbase, whatever it
9:07
might be, the crypto, they still need that second factor, which is
9:09
once they gain access to the email then and then once they have a handle
9:13
on all the various accounts, then the next thing they need to do is
9:18
swap out that SIM. And so the main problem with swapping out the SIM
9:22
for the user is that your AT and ts and T mobiles and boosts and
9:28
all that they have authorized resellers, authorized dealers. And you know what the
9:35
authorized dealer is. It's like it's like a it's a guy on the corner
9:41
of downtown Main Street between the gas station and the convenience store and the dry
9:48
cleaner, and he's selling gum candy and T mobile phones and he's an authorized
9:56
reseller. Yeah, and so in order for and he's also selling SIM cards,
10:01
and in order for him to activate a SIM card, all he's got
10:05
to do is just be an authorized reseller. And while the big telcodes,
10:11
the AT and T s, the T mobiles of the world have all these
10:13
various systems in place that require that reseller to check ID, well, yeah,
10:18
the reseller could say, yeah, I saw ID. They showed me
10:22
an ID. Whether they showed ID or not, that's just you, honestly
10:26
probably not an expert either and identifying fraudulent ID. That's it. And if
10:31
a guy walks in and says, I'll give you one thousand dollars to swap
10:35
out this SIM, you think he's going to resist. And chances are he
10:41
If somebody's walked in and said I'll give you a thousand, they already have
10:45
a relationship. Yeah like that. Yeah, this is not the first time
10:50
that reseller has swapped out a SIM like. This is something he does.
10:54
This is something he's known for. And in the case that I testify to,
11:00
there were two resellers in different parts of the country that had swapped out
11:05
the particular SIM of this guy's phone multiple times over the course of two and
11:09
three days. Wow. So what they did was is they had actually swapped
11:16
up the SIM, were able to log in, change the passcode of a
11:20
particular account, get that one time text message to his phone via SMS,
11:24
logged into the accounts and then swapped the SIM back of the original just like
11:28
that. And they did that over a period of time, and they got
11:31
into a number of different accounts over a two and three day period of time.
11:37
So that's where utilizing an authenticator app is better than utilizing your mobile phone
11:45
number as that second factor. All right, So authenticator apps and any viewers
11:50
are probably not familiar with it, they can be a pain. Google has
11:54
an authenticator there's a number of number of them out there. From what you're
12:01
saying, Robert, that is the safest route to go rather than two factor,
12:05
although coinbased has three factor authentication sometimes, certainly when you're opening an account.
12:13
So all of this you really you really got to think seriously about it.
12:18
Yes, it requires you, as a user, somebody who has something
12:24
to lose and an account holder to focus on what it is you're getting yourself
12:30
into when it comes to setting up two factor authentication versus an authenticator app and
12:37
then determining what your best options are. The easiest thing obviously is the SMS
12:41
to using your mobile phone, but the authenticator as an actual app on your
12:46
device is a different story entirely, and that's the direction you want to head.
12:50
Yeah. In addition to that, if you ever have the opportunity to
12:54
use a Google Voice phone number as that second factor as a phone number versus
13:01
your mobile phone number, utilizing Google Voice as a phone number, your second
13:07
factor is actually more secure than your actual phone number. Sure you can't.
13:13
There's no SIM involved in a Google Voice number. You can't swap out the
13:16
Google Voice number. So this is why all the carriers are going to simless,
13:24
cardless sims, electronic sims, because they see the potential for fraud here
13:28
and in theory, at least that should eliminate it. But it's pretty scary.
13:35
I mean, right now, both of my phones are sim are cardless
13:39
sims. So that's where you don't actually have the SIM that can be reprogrammed.
13:45
You actually have to program a new phone. So they must have some
13:50
means of going about it to prevent that new phone from being cloned. What
13:56
they do at the corporate level and at the authorized actual eighteen, took T
14:03
store the actual T mobile store. Like at the actual T Mobile store,
14:07
when you walk in because you want to swap up out a SIM, they're
14:11
requesting your driver's license and then they will actually scan the back of the the
14:16
bar cord or the back of the driver's license to make sure that it's a
14:18
legit driver's license correct, and they'll have that on record, and that reduces
14:24
T Mobiles liability in that regard. And AT and T had has similar but
14:31
not the same processes. Keeping in mind that prior to me testifying as an
14:37
expert witness in the simswap case, I'm not going to name the defendant in
14:41
the case. The day before I testified, I called Boost Mobile, I
14:46
called T Mobile, I called AT and T. I called my own AT
14:52
and T to find out one of my options as far as swapping out my
14:56
SIM because my toilet, my phone fell on the toilet. What do I
15:00
do? And the woman on the phone told me all my auctions, and
15:03
she was like very you know, direct with me and all that, you
15:07
know, very helpful. And she said, all you've got to do is
15:09
going to an AT and T store with the driver's license and they'll take care
15:13
of you. I said, okay. I go, like, do they
15:16
ask me for a pin code or anything? She said, well, they
15:22
probably won't. As long as you have the driver's license, you should be
15:24
fine. I said okay. I said, but like, what if somebody
15:28
goes in with a fake driver's license. She said, well, you know,
15:31
they're not skilled in detecting that, but you know, like the likelihood
15:35
of that happening is small. I go, okay, but if somebody does
15:39
going with the fake driver's license, they could posess me. Well, I'm
15:43
not positioned to comment on that. That was with the AT and T.
15:48
So I called Team Mobile and I asked them the same all the same questions,
15:52
and they said, well, we have on our iPads we have an
15:56
app where we have to scan the driver's license. I said, good,
15:58
that's great. And then I called Boost Bobo and I asked them all the
16:03
same questions and they said, well, you're supposed to have a pin code
16:07
in order to swap ont you sim I says, well, I don't know
16:10
what my pin code is, and she said, well a lot of times
16:15
it's like the last we usually suggest either like the four numbers of your birthdate
16:21
or the last four digits of their social Security number. Oh, that's real
16:25
clever there. She suggested that to me that if you don't know what it
16:30
is, it might be that that's often what it is. I go,
16:32
well, what if it's not any of those? And she says, well,
16:36
they can usually call corporate and they can override that and they can get
16:40
somebody to take care of it right on the spot. So all of them,
16:45
that everybody that I spoke to, they were very accommodating, you know
16:49
what I mean, Like they were very nice, Like they didn't know that
16:52
they were dealing with somebody who was doing some research. They didn't know they
16:55
were dealing with what we would consider an ethical hacker, little social engineering exactly.
17:00
And so that all being very helpful and being very helpful is what gets
17:06
you and I a liquidated bag account. So there's a few things that you
17:11
know, we want to as system, but you want to put in place
17:15
now. Number one, you want to do your own research on your own,
17:18
you know devices, you don't in calling your own telcode and finding out
17:23
you know, if somebody posed as me, what would by options be.
17:26
You want to make sure right now that you have an additional passcode on your
17:30
account, that's not your last four of your social and your in your birth
17:36
Yeah right, if anybody is going to swap out your sim, you want
17:37
to make sure that it's not going to be easy. And then beyond that,
17:44
in your digital life, I suggest that everybody use a password manager.
17:48
So a password manager, of course, is a software program that manages all
17:52
your passwords. And when I say all of your passwords, that means that
17:56
you should have multiple passwords, that your using the same passcode twice, which
18:02
is really important because look at I'm fifty five years old, I don't know
18:07
more than three or four passcodes that I possess in military or four. It's
18:12
my Google passcode, it's my Apple passcode, it's the passcode and my password
18:18
manager, and I think the one for my alarm system. That's it.
18:22
That's all I know. My password manager remembers the rest. And often people
18:27
say, well, what if the password manager gets hacked. I'm not worried
18:30
about that at all. And the reason why I'm not worried about that is
18:33
because password managers are security companies. The low hanging fruit is not the password
18:37
manager for the hacker. The low hanging fruit is the fact that we are
18:41
using all the same passcodes across multiple accounts. And what the bad guys do
18:45
is they use a tool called credential stuffing. So here's an article that I
18:48
wrote. I think you could see that over my shoulder over here right.
18:52
Credential stuffing, What it is and why you should be concerned. A recent
18:56
credential stuffing attack on twenty three and meters left most people bemused if they noticed
19:03
it at all. Similarly muted response to following the leaks of millions of user
19:07
records. Basically, an anatomy of a credential stuffing attack is what the criminals
19:15
will do is they'll go to the dark web and they'll grab millions and millions
19:18
of stolen records, and they'll feed those millions of usernames and passcodes into a
19:22
credential stuffing software program. And your credentials are then stuffed into this software and
19:30
they'll see if they can get it to twenty three and meters. They'll see
19:33
if they can get into Amazon to PayPal, the eBay to your email,
19:37
and so on, and they'll stuff your credentials in say the top one hundred
19:41
five hundred one thousand websites, and the software will log the bad guy in
19:48
remotely. That's credential stuffing. Right now. The way you keep the bad
19:52
guy out is number one, you never use the same passcode twice. That's
19:56
number one. Number two, you used two factor authentication with all your critical
20:02
accounts, all of them. Okay, let me show you something here.
20:07
Carry really quick and I know that like the clock is ticking on us here.
20:10
Yeah, So on my website, right, I scroll to the bottom
20:12
of the website and actually go to my homepage. Right, go to my
20:17
homepage and on the bottom of my homepage, one second you'll see one second,
20:26
I know the clock is ticking. Thank you for your patient sofa tight
20:29
down. Here you see the cybersecurity awareness check right, and you see check
20:33
it for email has been breached. And we click on email checker. Hey
20:37
to watch this right, so check it for email hasn't breached. I type
20:41
in R O B E R T S I C I L I A.
20:45
N Oh what side this? What side are we on? Right now?
20:48
We're on protect now LLC dot com, Protect now LLC dot com, Protect
20:55
now LLC dot com right all right, which is my website and at the
21:00
bottom of the homepage, research my email address robertsisanwimail dot com and then you
21:07
see your email and possibly a password of in stolen in the following breaches.
21:12
Now what this means is is that my email address, Robert tis leonoimail dot
21:17
com has been a part of numerous data breaches, not because I did anything
21:22
wrong, but because these particular companies were hacked. Okay, So this tool
21:26
that we have on our website allows us, allows me and my team to
21:32
facilitate you researching over twelve billion stolen records. We have access to twelve billion
21:38
stolen records, so including email addresses and passcodes. So you see right here,
21:44
like right at the top, a data dub of a massive collection of
21:47
three thousand alleged data breaches was found online, including eighty million unique email addresses
21:52
and associated passcodes. Oh my god. Okay, we have the ability to
21:56
allow you to research all of that. Here. In July twenty eighteen,
22:00
Apollo had what is it, dumb, I don't even know how many millions
22:04
of records in pass roads allow uh is Yahoo? Yes, one hundred and
22:11
twenty six million unique email addresses. Right, here's a bitcoin for him from
22:15
back in twenty fourteen, Billy, we have five million and nine million using
22:19
it, the one that makes custom links yes, right to read exactly redirect
22:26
so you don't have to use these monster URLs. So Bittley got hacked too,
22:32
Bitley code halfway mom discus Juice books showing this is exactly why you need
22:37
the pass word manager to create those in those unique passwords for every site.
22:45
I mean, I have my standard password, but I change it every single
22:49
month. And you know, so like all the old ones that are out
22:53
there aren't going to do anybody any good and all likely good. How often
22:57
should you change your password on your email? So here's the deal, right,
23:03
Like I don't you know, like I haven't changed my password in an
23:06
email for a while because I use two factor authentication. So here's the deal,
23:11
right, even if they have your password, if you have two factor
23:15
authentication, whether it's Smaster or the authenticator app, right, better the authenticator
23:22
app or use Google Voice number, even if they have your passcode, they
23:27
can't get in if they don't possess your mobile soon. Right, So the
23:33
idea is to make the data useless to the thief. So changing up your
23:36
password is always a good thing, okay, And if you want to do
23:38
it, every month. Fine, But for most of us, I would
23:41
I say that security needs to be easy. If it's not easy, you're
23:45
not going to do it. So I would rather you use a different passcode
23:51
across every account, use a password manager that manages all those various passwords,
23:56
and then have two factor authentication. If you do that, in most cases,
24:00
you're going to keep the bad guy out because most other people aren't doing
24:04
any of those things. You become a teper target. They become the path
24:08
of leash resistance. Makes sense about it, yeah, totally. And then
24:14
two factor authentication right Like, next thing you do is you just google it
24:18
team wo factor Gmail. Right now, when you do that on the first
24:25
page of serch you see two step verification at my account dog Google dot com.
24:29
You could do the same thing for yao, the same thing for AOL.
24:33
And the main, main thing for most of your listeners viewers is that
24:37
you've got to tighten up email. Man, Like everybody's got to tighten up
24:38
email. Email. If they get into your email, bad guys say own
24:44
the email, you own the person. So that's it. The first thing,
24:48
no question about it, all right, I know your crunch for a
24:52
time, Robert, where we find you. How do we get that neat
24:55
little security checkup that you just showed. I tell everybody going to protect now
24:59
LA dot com, Protect now LLC dot com. Scroll towards the bottom and
25:03
you'll see use our free email checker to check if your email address and or
25:07
your passwords are part of any specific data breaches. All right, excellent.
25:11
Hey, you got a question for Robert myself, Just send me an email
25:15
at kl at Carrie LUTs dot com. And there's a link to Robert's site
25:21
in the show notes of this interview on Financial Survival Network dot com. Make
25:25
sure you use it while you're there. Sign up for your free newsletter.
25:27
Robert always a pleasure, always enlightening, and always gives me something to think
25:32
about what I should be doing that I'm not. And that's the most important
25:36
thing. Hey, you buddy, I appreciate you. Hey. Likewise,
25:38
take care, Robert, have a good day. Thanks for listening to Carrie
25:41
Letz's Financial Survival Network your solution to today's trying times. For the latest,
25:48
go to Financial Survivalnetwork dot com. Financial Survival Network now more than ever