Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Unmasking the Xenomorph: An In-Depth Discussion on Android Security and Cybersecurity

Transcript

Unmasking the Xenomorph: An In-Depth Discussion on Android Security and Cybersecurity · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:19
  Craig Petronella: All right, welcome to another episode.
• 0:22
  Craig Petronella: We've got Blake Gray with us.
• 0:25
  Blake Rea: Yeah, we're here again.
• 0:26
  Blake Rea: We're showing up.
• 0:29
  Craig Petronella: All right, we're back on track.
• 0:31
  Craig Petronella: Yeah yeah, one of the things we wanted to talk about today is the Xenomorph banking Trojan, which is specifically affecting Android users.
• 0:42
  Craig Petronella: Right yeah, that's correct.
• 0:45
  Craig Petronella: This new variant is targeting over 35 different financial banking institutions.
• 0:53
  Craig Petronella: Pretty nasty malware.
• 0:57
  Craig Petronella: Looks like it's supported by a nation state or I don't know about that.
• 1:04
  Blake Rea: They also did say that it was also affecting certain crypto wallets, which was interesting to me.
• 1:10
  Craig Petronella: Yeah, they're basically after credentials access, balance information, initiate transactions, obtain MFA tokens from authenticator apps and perform fund transfers.
• 1:27
  Blake Rea: Hmm, interesting.
• 1:29
  Blake Rea: It did say that it was only affecting Android 13.
• 1:34
  Blake Rea: So I'm not an Android user, but I don't know where they are in terms of the Android updates.
• 1:42
  Blake Rea: I mean, I always recommend people just update immediately.
• 1:48
  Blake Rea: Check your phone every week at least for updates, but I'm curious to see where they are in the Android update pipeline.
• 1:59
  Craig Petronella: Yeah, I think this goes back to one of my recommendations a long time ago is whenever doing banking or crypto transfers or something like that, make sure your device is security gardens.
• 2:10
  Craig Petronella: You want to make sure you're all updated and patched.
• 2:12
  Craig Petronella: Ideally, you do not want to use the same device that you have maybe a bazillion kids apps on that.
• 2:19
  Craig Petronella: You may not know the security of all those apps.
• 2:22
  Craig Petronella: So you want to try.
• 2:24
  Craig Petronella: I know it's hard, but try to use a more secure device that doesn't have much on it to do these things.
• 2:32
  Craig Petronella: Use a desktop.
• 2:35
  Craig Petronella: Make sure your OS is patched in your desktop.
• 2:38
  Craig Petronella: Whether you're a Mac or a Windows user, same applies, but it seems like Android's been really getting a lot of malware recently.
• 2:48
  Blake Rea: Yeah, I mean, I've never really trusted Android personally.
• 2:52
  Blake Rea: I don't know why, Maybe it's just a subconscious thing.
• 2:55
  Blake Rea: As an Apple user, I've always known Apple devices to be pretty security focused.
• 3:00
  Blake Rea: So they are on Android 14 now, so this is for people that are using last generation of Android operating systems.
• 3:09
  Blake Rea: But yeah, so I've just never really been a big fan of Android and maybe I could be mistaken, but it just seems like they have more security issues than iOS devices.
• 3:27
  Craig Petronella: Yeah, well, you know iOS has had some zero days recently, in the past few weeks too.
• 3:33
  Craig Petronella: So I mean, I feel like it's kind of pick your poison.
• 3:38
  Craig Petronella: You know, obviously nothing is foolproof, but I do think Apple is doing a pretty good job of privacy and security.
• 3:45
  Craig Petronella: I think that their job is a little easier because they're engineering the hardware and the software.
• 3:52
  Craig Petronella: You know I talked about this too, where Microsoft or Android, for example, you got all these different hardware manufacturers that have to make their hardware up to a certain standard.
• 4:02
  Craig Petronella: There might be some variances there.
• 4:03
  Craig Petronella: There might be some security flaws in the hardware itself that you may not know about.
• 4:08
  Craig Petronella: That can contribute to problems.
• 4:10
  Craig Petronella: I know a long time ago there was I don't know if you remember this, blake there was speculation around computer hardware chips that, at the hardware level, could be spying on people.
• 4:24
  Craig Petronella: Do you remember Now?
• 4:26
  Craig Petronella: Yeah, I remember that, gosh, I'll have to dig it up and find it.
• 4:30
  Craig Petronella: But there's you know I've actually talked about this a long time ago as well where you know we trust, as consumers and people, especially brand names like household names like Google, right, and Apple.
• 4:48
  Craig Petronella: You know these companies use really large marketing budgets and branding campaigns, and you know.
• 4:55
  Craig Petronella: Most of us, I would say, probably trust these companies to use their products and services.
• 4:59
  Craig Petronella: And my point is that you don't know if you're not buying something like Apple, where Apple is manufacturing the hardware and the software.
• 5:09
  Craig Petronella: But even with Apple, you don't really know.
• 5:13
  Craig Petronella: You know they're off shoring the building.
• 5:16
  Craig Petronella: You don't really know, like, what happens at the factory level.
• 5:21
  Craig Petronella: Right, I mean, who knows what?
• 5:23
  Craig Petronella: You know what I mean, right?
• 5:24
  Craig Petronella: So my point is that we talk a lot about employee training and testing and drilling, and I'm not insinuating that something bad is happening.
• 5:33
  Craig Petronella: I'm just saying, like, how do we know, right?
• 5:35
  Craig Petronella: I mean, how do you know that in a factory you've got hundreds or maybe thousands of workers and robots and all sorts of stuff happening where they're putting these chips in these devices?
• 5:46
  Craig Petronella: How do you really know if a chip doesn't have some kind of backdoor in it?
• 5:51
  Craig Petronella: Right, you know.
• 5:52
  Craig Petronella: So it's we talked about.
• 5:54
  Craig Petronella: You know the internet and TCP IP and and how.
• 5:58
  Craig Petronella: Tcp IP by nature is not really a great secure internet protocol tool for the internet, right?
• 6:06
  Craig Petronella: So we've put all these layers on top of it, like encryption and SSL certificates and all this stuff to kind of patch it up and bubblegum and duct tape it right, but it's not secure out of the gate and you know it goes back to the layers that we talked about.
• 6:21
  Craig Petronella: But what do you do if there's a chip in in something?
• 6:25
  Craig Petronella: That I mean that you don't know about?
• 6:28
  Craig Petronella: But right, I mean, I mean if you just take a minute to think about that, I mean there could be a chip inside of your iPhone or your Android device and how do you really know that there's not something happening?
• 6:41
  Craig Petronella: You know, I know there's one product that came out from one of our partners where they they encrypt the keystrokes on the device.
• 6:51
  Craig Petronella: This is a desktop software application, but they also tell you when a certain application is listening to you through your microphone or trying to capture your screen.
• 7:01
  Craig Petronella: And I have to say you know, in evaluating their product, it's really alarming to see big brands like Adobe, microsoft just common names wanting access to your microphone or your camera.
• 7:14
  Craig Petronella: I mean like when you're looking at a PDF or like a Word document, like Like location settings too, like what's the point?
• 7:22
  Craig Petronella: Yeah, but I mean like these, nobody really.
• 7:26
  Craig Petronella: I'm sure most I can't say nobody, but I would say most people don't really read the detailed terms and conditions of all the rights that these software programs can have.
• 7:35
  Craig Petronella: But I thought it was quite alarming to see that, hey, adobe wants to capture your screen and listen through your microphone when I'm looking at a PDF.
• 7:45
  Craig Petronella: You know like what.
• 7:46
  Craig Petronella: You know what I mean.
• 7:47
  Craig Petronella: I think that's pretty crazy.
• 7:50
  Blake Rea: Yeah, and they, it seems like they all kind of spin it in the form of like hey, we want to better your user experience.
• 7:58
  Blake Rea: Yeah, that's like okay, you know, I mean I get maybe to a degree like capturing the screen and saying like, oh okay, well, people are trying to click here for this tool or click there for that tool, or maybe they're getting stuck in certain parts of the user interface, right, Totally to a degree understandable.
• 8:20
  Blake Rea: But I mean, is it really acceptable?
• 8:24
  Blake Rea: You know, yeah, I don't know how I feel about that personally.
• 8:31
  Craig Petronella: So yeah, I mean going back to this malware.
• 8:34
  Craig Petronella: I think maybe some of our listeners were like you know?
• 8:37
  Craig Petronella: Like what do we do?
• 8:38
  Craig Petronella: You know?
• 8:39
  Craig Petronella: Everything's kind of doom and gloom, right.
• 8:40
  Craig Petronella: I think the really the takeaway is that with a bank I mean as long as you have a certain amount of funds that don't exceed the $250,000 limit you're protected by FDIC insurance.
• 8:54
  Craig Petronella: So in the event that something happens bad, you've got that insurance lay.
• 9:01
  Craig Petronella: I'm not saying to bank on that, I'm not saying that, you know, maybe one day you'll get your money and hurry up and wait in line, kind of thing.
• 9:08
  Craig Petronella: Obviously, you have to take your own security measures into place, but I think it goes back to making sure you're using a secure device, trying not to type in the URLs.
• 9:20
  Craig Petronella: You know, use a password manager, save your bank information.
• 9:24
  Craig Petronella: It would encrypted drive.
• 9:26
  Craig Petronella: Ideally, don't store it on your computer at all if you can, but as far as like the URL or the website of the bank, store that in the password manager and or your favorites, or you know, don't type it in because you can fat finger it.
• 9:40
  Craig Petronella: And that's what the hackers are banking on.
• 9:43
  Craig Petronella: They're trying to register these domains that are often fat fingered and that's how you get phishing or malware on your computer and then in turn deploy some type of bad software like this one here.
• 9:56
  Craig Petronella: But this one's pretty rampant on the Android devices.
• 10:00
  Craig Petronella: So maybe the you know, like you said, like you know, this is targeting the older version, so obviously it goes with.
• 10:08
  Craig Petronella: Obviously make sure you update and patch your Android devices.
• 10:11
  Craig Petronella: But you know, again, it goes back to the layers that we talked about.
• 10:17
  Craig Petronella: So patching is a layer.
• 10:18
  Craig Petronella: You know your device, how to use that device, for who you're sharing it with, what other applications are on that device.
• 10:25
  Craig Petronella: Try to use a desktop or another device for your banking or other more sensitive tasks that you know.
• 10:33
  Craig Petronella: You take more care of and consideration around what software and applications are on that device, so that you're kind of, I guess, a bit more strict about what you put on there.
• 10:46
  Craig Petronella: You know what I mean.
• 10:46
  Craig Petronella: So you try to keep it more bare bones and you do your banking there.
• 10:51
  Craig Petronella: I know some people are more extreme and go the opposite direction and they don't do online banking at all and I know there's a group of folks that do that.
• 10:58
  Craig Petronella: That's obviously it's a trade off, of convenience, right?
• 11:02
  Craig Petronella: But yeah, you know, maybe not enable certain things with your bank either.
• 11:08
  Craig Petronella: You know there's different software or access type tools that you can use to pay people easily.
• 11:15
  Craig Petronella: You know certain things that your account level you could disable.
• 11:18
  Craig Petronella: Obviously, use strong passwords that you're not reusing other places.
• 11:21
  Craig Petronella: Use multi factor authentication.
• 11:23
  Craig Petronella: Obviously there's layers at an endpoint level that you should have on your device itself.
• 11:30
  Craig Petronella: Like I was mentioning that software that I was testing.
• 11:33
  Craig Petronella: You know that encrypts your keystrokes, but not only encrypts your keystrokes but blocks your camera and your microphone and you know, have technology like XDR that if you were to click on a bad link and make a mistake, they would get contained.
• 11:46
  Craig Petronella: So there's different.
• 11:47
  Craig Petronella: You know layers that you could put in place to protect yourself, but yeah, this one's a particular nasty one.
• 11:54
  Blake Rea: Yeah, one thing that I would also suggest too, that I didn't hear you touch I mean, you touched on it briefly, but just be very, very weird of what apps you're putting on your phone.
• 12:03
  Blake Rea: And in this instance, you know they had an app, a malicious app, in the app store.
• 12:08
  Blake Rea: The Google Play Store sorry, that kind of poses itself as a legitimate app.
• 12:14
  Blake Rea: You know.
• 12:15
  Blake Rea: So I know we've all seen it.
• 12:18
  Blake Rea: When you're scrolling through social media and you see like an ad for like an interesting fun game or whatever, right, you know be very weary of what apps you download, right, and who those developers are.
• 12:32
  Blake Rea: You know, because every app has a developer listed.
• 12:35
  Blake Rea: So you know.
• 12:37
  Blake Rea: Of course you can do a background, a little mini background check on those developers.
• 12:42
  Blake Rea: Like you could type in the developer name and then type in like security or like exploits or like malware.
• 12:50
  Blake Rea: You know like those two search terms should yield something, or hopefully nothing, right In the case.
• 12:58
  Blake Rea: So don't go downloading a bunch of silly apps.
• 13:01
  Blake Rea: I know a lot of developers in the past have.
• 13:05
  Blake Rea: There was this one I think we talked about it on another podcast, not to go too far off track, but it was one of these like AI generator apps or something that was like making In several.
• 13:18
  Craig Petronella: There was one that was back a long time ago that we talked about as a flashlight app a free flashlight app for your phone and it was plagued with malware on it.
• 13:27
  Craig Petronella: I mean years ago, when we published one, we, we did an experiment and published an app, or I think it was a digital magazine or something like that.
• 13:37
  Craig Petronella: Anyway, when we did the research around that, we found that there are so many malicious apps out there that it was pretty easy to get an app approved with not only Google, but with Apple too.
• 13:48
  Craig Petronella: So the point is that there are malicious apps on those stores and you need to do your part and investigate.
• 13:56
  Craig Petronella: What are you putting on your phone or your device?
• 13:58
  Craig Petronella: Do you trust this vendor Cause?
• 14:01
  Craig Petronella: It's a risk question.
• 14:02
  Craig Petronella: And then you know, like Blake said, you need to patch and update these things too.
• 14:06
  Craig Petronella: So the more stuff, the more software, the more applications, the more things that you add to your device, the more your maintenance has to increase, because you need to patch those things, and not only the patching of the operating system, but all those applications that you have on your systems.
• 14:21
  Craig Petronella: You have to patch constantly and make sure, because all it takes is one of those to spy on you in the background and capture your keystrokes or your credentials, and that's how you get hacked.
• 14:32
  Blake Rea: Yeah.
• 14:32
  Blake Rea: And then also, I mean you can limit those apps that you do have on your phone, like for example again, you know I'm an iPhone user, but I can go in here and select the app that I want and turn off different permissions, like I can turn off access to a camera, access to a microphone or access to the location for that app.
• 14:50
  Blake Rea: So if you ever have any doubts in your mind, you know go explore the security features and functions of your phone and make sure some of these apps that you're not so sure about, you know get them off your phone.
• 15:04
  Blake Rea: If you feel like you need to, of course, and if you feel like you don't, or if you feel like you have some use for that application, you know go in and limit what data and what controls it has over your phone.
• 15:18
  Blake Rea: What access permissions Super important, I would think.
• 15:22
  Craig Petronella: I think those are great tips.
• 15:23
  Craig Petronella: I think, taking that a step further, it's almost like doing a self-assessment of your device or your phone or whatever you're using, and just a checkup.
• 15:32
  Craig Petronella: You know what apps are on here.
• 15:34
  Craig Petronella: Do I know and trust them?
• 15:35
  Craig Petronella: Have I done my own due diligence to investigate and evaluate a risk?
• 15:39
  Craig Petronella: But you know, the bottom line here is, if you've got hundreds of apps on your device, you just made your job 100 times harder because now you got to go through every single one.
• 15:48
  Craig Petronella: So you may want to, if you.
• 15:51
  Craig Petronella: I mean, an extreme approach would be to start over and then just put back on what you really.
• 15:57
  Craig Petronella: You know, maybe use this is an excuse maybe you've got an old device and you want to upgrade, so maybe use that upgrade process of instead of migrating all of your stuff over.
• 16:06
  Craig Petronella: You start over.
• 16:08
  Craig Petronella: I've often said you know, sometimes starting over is better, because if you do the upgrade path and you dump all the stuff over from the old device, you're moving everything over, including anything that could be malicious as far as an app goes, or corruption or any kind of data that could have a problem in the future to slow your device down.
• 16:29
  Craig Petronella: So you know.
• 16:31
  Craig Petronella: I know personally for me, whenever I upgrade or get it, I always start over fresh, and I know that's more work and annoying, but it also gives me the opportunity to go through everything and make sure do I really need this app?
• 16:43
  Craig Petronella: And, like I said before, I have other devices that I'll use for other things, so I won't do banking on certain things.
• 16:49
  Craig Petronella: So my point is that try to simplify your life and keep it simple.
• 16:54
  Craig Petronella: Right, the Kiss principle.
• 16:55
  Craig Petronella: It does have some validity.
• 16:59
  Blake Rea: Yeah, also be careful too, because in some of these articles that we read kind of unrelated but more you know.
• 17:05
  Blake Rea: Going back to your computer, right, like, be careful about Chrome extensions.
• 17:09
  Blake Rea: You know Chrome extensions as well, you know.
• 17:12
  Blake Rea: In this article that we read, they mentioned.
• 17:14
  Blake Rea: You know.
• 17:15
  Blake Rea: You know counterfeit, you know transactions and activity happening through Chrome extensions, you know.
• 17:22
  Blake Rea: So just be careful out there.
• 17:25
  Blake Rea: Obviously we say that every podcast, but you know, just know what you're doing on the internet.
• 17:31
  Blake Rea: You know, and if you're not sure, like, it's okay to ask for help.
• 17:34
  Blake Rea: You know, I think we've.
• 17:36
  Craig Petronella: I want it located to not install, or proceed and click next when you don't fully understand what you're agreeing to either and you know, try to take a devil's advocate, trustless approach.
• 17:47
  Craig Petronella: You know what happens if this app can listen to me or turn on my camera?
• 17:52
  Craig Petronella: Am I in an environment at work where I'm talking about sensitive topics?
• 17:56
  Craig Petronella: That would be a problem if it were captured.
• 17:59
  Craig Petronella: Am I you know what I mean like?
• 18:00
  Craig Petronella: Know your surroundings, know your device and make decisions based on that too.
• 18:07
  Blake Rea: Yeah, I also think there's some software out there too that has keyboard permissions.
• 18:12
  Blake Rea: I don't think there's any app out there that should have any permissions over your keyboard that can log what you're typing and where you're typing.
• 18:21
  Craig Petronella: Well, what's crazy is and I've talked about this before is for Apple.
• 18:26
  Craig Petronella: For example, you said you're an Apple user.
• 18:28
  Craig Petronella: You know I don't know if this is still true or not, but when I investigated it, the keyboard, the keystrokes that you type in on your iPhone to like text message somebody for something those keystrokes are stored in a plain text, unencrypted database.
• 18:50
  Blake Rea: I'm not sure about that.
• 18:51
  Craig Petronella: Yeah, it used to be true.
• 18:52
  Craig Petronella: I don't know, I'd have to investigate it again to see if it still is true, but the point was that there could be a malicious app on your phone, like the Flashlight app, that can then interact with that unencrypted password or unencrypted keyboard file database.
• 19:10
  Craig Petronella: That's how they get all of your information.
• 19:12
  Craig Petronella: Now, this would be simple for Apple, or maybe I'm oversimplifying, but the point is that in this context and in this case, I would want Apple to encrypt that database.
• 19:22
  Craig Petronella: I would want those keystrokes to be encrypted.
• 19:25
  Craig Petronella: Anyway, my point is that taking a trustless approach as the consumer, if that's important to you, that you don't want your keystrokes to be captured by some app that you're not aware of, well, consider adding in keystroke encryption to your device.
• 19:42
  Craig Petronella: Then what happens?
• 19:43
  Craig Petronella: There is again taking that trustless approach, even if this is no longer an issue.
• 19:49
  Craig Petronella: Let's say Apple patched it.
• 19:51
  Craig Petronella: Let's say Apple now encrypts their keyboard.
• 19:54
  Craig Petronella: I don't know if they do or not.
• 19:55
  Craig Petronella: I'd have to, like I said, but let's say they do.
• 19:59
  Craig Petronella: You use that other layer?
• 20:00
  Craig Petronella: Well, what's that hurting?
• 20:01
  Craig Petronella: You're double-encrypting, okay.
• 20:06
  Craig Petronella: Well, what if there was some exploit or something that reversed it?
• 20:11
  Craig Petronella: At least?
• 20:11
  Craig Petronella: Again, it goes back to the layers If you did your part and you encrypted your information and then there was a breach or something happened, well then they got scrambled data so they didn't technically breach it.
• 20:22
  Craig Petronella: That's what I'm getting at as far as the layers go.
• 20:24
  Craig Petronella: The same thing like when you're using plaintext email or you're using Gmail or something and you don't have encryption.
• 20:32
  Craig Petronella: You could add for very inexpensive, sometimes free encryption on top of that to then add that extra layer of protection.
• 20:41
  Craig Petronella: There's things that we all can do, and that's my point.
• 20:46
  Craig Petronella: We should be doing or implementing as many layers as possible to protect ourselves.
• 20:52
  Craig Petronella: I think that's generally going to be a good thing and go in the right direction.
• 20:57
  Blake Rea: Yeah, there's no simple approach to security.
• 21:01
  Blake Rea: There's no one shoe fits.
• 21:04
  Blake Rea: There's always constant assessments that have to happen.
• 21:10
  Blake Rea: Evaluations, Obviously, it comes back to the human principle.
• 21:17
  Blake Rea: Are you doing enough?
• 21:20
  Blake Rea: We've talked before about a lot of the hacks and exposures happened from a human element.
• 21:32
  Blake Rea: Ironically, I don't know.
• 21:35
  Blake Rea: We talked about the last podcast, Caesars MGM.
• 21:40
  Blake Rea: Did you hear about how that actually happened?
• 21:42
  Blake Rea: They actually found out how it happened.
• 21:45
  Blake Rea: Go ahead.
• 21:47
  Blake Rea: The kids that were hacking them were apparently super young.
• 21:53
  Blake Rea: They were anywhere from 16 to 20-year-old kids.
• 21:56
  Blake Rea: What they did was they went on an info website and they found an executive.
• 22:03
  Blake Rea: They also went to one of the help desks, or they called the help desk and said hey, my name is executive, I'm locked out of my account, Like will you reset my email password or reset my password or whatever.
• 22:20
  Blake Rea: It was that simple.
• 22:23
  Craig Petronella: So social engineering at its best.
• 22:25
  Blake Rea: Right, yeah, it was that simple.
• 22:28
  Blake Rea: There's nothing sophisticated about 20-year-old kids calling to help desks for this casino and chitting the password.
• 22:37
  Blake Rea: So, yeah, I mean people like to be trustworthy.
• 22:45
  Blake Rea: It's a character trait that people like to possess.
• 22:51
  Blake Rea: People like to be trustworthy.
• 22:53
  Blake Rea: People like to take things at face value, because some people they ignore the bad things that go on in this world because they live in a bubble, I guess is the easy way to say it.
• 23:08
  Blake Rea: But people like to be trustworthy, people like to feel like they're being honest to people and they feel like they get back what they give out in the world.
• 23:17
  Blake Rea: It's pretty common, but so somebody just in their mind, trying to do the right thing help this executive out ended up being the wrong thing.
• 23:30
  Craig Petronella: Yeah.
• 23:30
  Craig Petronella: So it goes back to what I've said before many, many, many times.
• 23:33
  Craig Petronella: If you're in that position, you're that help desk agent.
• 23:37
  Craig Petronella: Just pick up the phone and call the executive.
• 23:41
  Blake Rea: Yeah, call, or just have policies in place that you know.
• 23:45
  Blake Rea: Okay, I'll reset your password.
• 23:47
  Blake Rea: It has to go back to your email, right, yeah?
• 23:49
  Craig Petronella: But it goes back to what's the saying Trust, don't trust, verify.
• 23:55
  Craig Petronella: So never assume that this person on the other end of the phone is who they say they are.
• 24:02
  Craig Petronella: Verify it.
• 24:03
  Craig Petronella: How do you get them to prove they're who they are?
• 24:05
  Craig Petronella: I have said with your cell phone providers everyone listening should have a pin number with their mobile carrier to prevent SIM swap attacks.
• 24:14
  Craig Petronella: Sim swap attacks are still commonplace now.
• 24:16
  Craig Petronella: Don't use your phone number to get one-time pins to certain things.
• 24:21
  Craig Petronella: Now, I know in certain situations it's unavoidable.
• 24:24
  Craig Petronella: It's kind of comical to me where banks often are the ones that you think of a bank or at least for me, you think of a bank as bank encryption or bank grade security.
• 24:37
  Craig Petronella: You think banks should have the best right, right, but in working with banks I'm no blank, in working with banks.
• 24:47
  Craig Petronella: I'm reminding him of a story, of a test we did.
• 24:49
  Craig Petronella: Oh God, it's not true.
• 24:51
  Craig Petronella: It's just don't assume again that your bank has got the best security, because they don't.
• 24:58
  Craig Petronella: I'm not going to call out a single bank, but I'm just saying that again, don't trust that your provider, your company, your vendor is providing you and protecting everything.
• 25:09
  Craig Petronella: Verify it, get them to prove it and do your own part.
• 25:13
  Craig Petronella: Like I said when I was going with this little tangent was that certain websites, certain banks they force you to use the text SMS, unencrypted, one-time password to your phone.
• 25:27
  Craig Petronella: They don't use a more secure authenticator app, for example.
• 25:32
  Craig Petronella: So I get it.
• 25:33
  Craig Petronella: I know that you have to use it in certain situations, but try to limit it.
• 25:37
  Craig Petronella: If you have the option to not use text for one-time pins, use the software that's much more secure and add additional pins and security with your mobile provider to prevent a SIM swap attack.
• 25:52
  Craig Petronella: Because now, with banks and crypto and everything else, we do so much on our mobile devices, we depend so much on our mobile phone number.
• 26:00
  Craig Petronella: You've got to do what you can to protect it.
• 26:03
  Craig Petronella: Because, just like with that story that Blake shared, it's often the same story with the SIM swap.
• 26:08
  Craig Petronella: Oh, I'm in a bad spot, I lost my phone, I need you to send me a new SIM or help me move my phone.
• 26:15
  Craig Petronella: And that's how SIM swap attacks happen the hackers.
• 26:19
  Craig Petronella: They persuade in social engineer, the rapid, the mobile carrier, to do something with the phone number and then, guess what?
• 26:27
  Craig Petronella: They just activated the hacker's phone and now they have access to all your pins.
• 26:31
  Craig Petronella: So then they go a step further and then they keep going through the layers.
• 26:35
  Craig Petronella: So just try to be smart and implement as many layers as you can.
• 26:44
  Blake Rea: Yeah, the human element is really important to any attempted breach.
• 26:49
  Blake Rea: I remember one.
• 26:51
  Blake Rea: There was one that was going on Facebook and me personally.
• 26:55
  Blake Rea: I know this is probably the worst thing to say publicly, but I like to mess with people who try and mess with me.
• 27:00
  Blake Rea: So somebody had sent me a message saying oh, I'm locked out of.
• 27:06
  Blake Rea: I need help resetting my password.
• 27:09
  Blake Rea: It was like a Facebook message or something, something silly.
• 27:11
  Blake Rea: I need help resetting my password.
• 27:13
  Blake Rea: I'm like I don't know you.
• 27:15
  Blake Rea: How am I going to help you with such a password?
• 27:17
  Blake Rea: Oh, facebook told me to contact you.
• 27:19
  Blake Rea: They gave me a little list of pictures of people to click and you were one of them.
• 27:23
  Blake Rea: It's like oh, ok.
• 27:25
  Blake Rea: And then they're like can you provide me the six digit code that just went to your phone?
• 27:31
  Blake Rea: And I mean pretty much the whole time.
• 27:33
  Blake Rea: I mean I was just giving them fake, fake six digit numbers and pretending like oh, my God, I want to help you.
• 27:40
  Blake Rea: You know like I'm sorry, I like to troll people that troll me.
• 27:44
  Blake Rea: So we literally tried for like hours, like I just kept giving them no, I don't know why it's not working.
• 27:50
  Blake Rea: Like this is the number that I'm getting texted, you know.
• 27:53
  Blake Rea: And then eventually they just gave up.
• 27:54
  Blake Rea: Right, you know there's a human element.
• 27:58
  Blake Rea: Right, that has to happen in almost every attempted intrusion, you know.
• 28:04
  Blake Rea: So, don't be that human element, you know?
• 28:07
  Blake Rea: I mean if something is weird.
• 28:09
  Craig Petronella: Back to the training and testing that we've always talked about.
• 28:12
  Craig Petronella: You just constantly have to train and test your people and yourself so that you get into that muscle memory and that that just that reaction is again set.
• 28:23
  Craig Petronella: I know what you're saying, blake.
• 28:24
  Craig Petronella: I mean it's human nature and psychology to want to help people and I think they and it does go against the grain and the psychology of your kind of your roots, right, your, your DNA but you have to train and test and drill yourself to protect yourself and your, your bank is not not going to ask you in an email to give you your social security number or pin number or something Right?
• 28:49
  Craig Petronella: So be very cautious and always again verify.
• 28:55
  Craig Petronella: Don't immediately trust that whoever's on the other end is who they say they are, and do your part, because the more you do your part, the less likely you are to become a victim.
• 29:08
  Blake Rea: Yeah, yeah.
• 29:08
  Blake Rea: And at that, at that point I mean there's a lot more on the line right, like if you do the wrong thing, if you open up your company to some huge exploit or some attack, I mean who knows what could happen.
• 29:22
  Blake Rea: You know your, your livelihood is at stake.
• 29:25
  Blake Rea: At that point, if you know you open a door that look at look at that from a business owner perspective.
• 29:31
  Craig Petronella: Let's say you're a small business and you're you're working with sensitive information.
• 29:37
  Craig Petronella: Or let's say you're a medical company.
• 29:40
  Craig Petronella: You know, I heard on the news earlier today the Lazarus group the people responsible for the casino hack they are are basically hoarding and collecting cryptocurrency and their next projected victim is the healthcare industry hospitals, medical.
• 29:59
  Craig Petronella: You know they're going after them for ransomware and ransomware payments so that they can hoard more Bitcoin and more and more crypto.
• 30:07
  Craig Petronella: My point is that you know we just have to go through the exercises and keep drilling this stuff into the human side of things to prevent that malware from being able to be dropped.
• 30:19
  Craig Petronella: You know, I know we're all busy and everybody's working multiple hats and multiple jobs, but you could have the best security and if you you're human side, you know it goes back to people, process and technology.
• 30:30
  Craig Petronella: We've talked about this.
• 30:31
  Craig Petronella: If your people are not trained and they hand over the keys to the bad guys, well, I mean, there's only so much the technology leg of the stool can do, right.
• 30:44
  Craig Petronella: I mean, yeah, you can rely on XTR and hope that that's, you know, contained and.
• 30:50
  Craig Petronella: But there could be more social engineering and impersonation that can happen to further deepen the hack, right?
• 30:59
  Craig Petronella: So, like you know, like if you picture you're on the other side and you're the bad guy, you're the hacker.
• 31:05
  Craig Petronella: If you do something and it doesn't work, you shift gears to do something else, or maybe the person you're talking to is too well versed and trained, so you find another victim and you look, you look through social engineering, social networks and LinkedIn and Facebook, and you find another executive that you can prey on and see if that person, he or she, is going to fall back.
• 31:28
  Craig Petronella: So my point is that these, these hackers nowadays are it's their day job to do this stuff.
• 31:35
  Craig Petronella: You know, they're the ones that are, like you said, they were kids, they're younger, 16 to 20, you know, they may be in a country that is a poorer country, and this is this is what they do for work.
• 31:46
  Craig Petronella: They're actually in the States, okay, so so they're in the States and they're doing this for work.
• 31:53
  Craig Petronella: You know they're getting paid.
• 31:54
  Craig Petronella: You know, I, I, I remember when we were looking, we're researching the MGM hack last week.
• 32:00
  Craig Petronella: It's just, it's crazy how it's.
• 32:04
  Craig Petronella: It's become like a business model, and there's also a business model for basically taking down your, your competitor too, like you could buy like ransomware kits online and try to you know, just pummel your.
• 32:20
  Craig Petronella: Yeah 商一直 안.
• 32:21
  Craig Petronella: It's a nasty place out there.
• 32:26
  Blake Rea: It is weird to think that little Johnny on your son's soccer team may be taking down corporate yeah, fortune 50 companies.
• 32:37
  Blake Rea: Here with millions in bitcoins is hanging out.
• 32:43
  Craig Petronella: If your company isn't training and testing your folks and doing these tabletop exercises and these pen tests, if you're not paying the money and investing in your company, all it takes is one person on your staff to make a mistake.
• 32:57
  Craig Petronella: If you think about that, if you're 10 people, you have to train those 10 people.
• 33:03
  Craig Petronella: It's your responsibility as the owner to provide the training and the security controls to protect your systems.
• 33:08
  Craig Petronella: The more sensitive the information you have to protect, the more at risk you have.
• 33:13
  Craig Petronella: If you think about it, if you're a small company and your secret sauce is really how you're surviving, because if competition had all of your secrets and intellectual property, what else do you have other than price to compete on?
• 33:31
  Craig Petronella: If somebody on your team isn't trained and hands over all your intellectual property to a competitor or to a bad actor group who sells it to a competitor, my point is that your survival as a small business is limited.
• 33:44
  Craig Petronella: Think about if you're 100 people or 1,000 people or 10,000 people.
• 33:48
  Craig Petronella: You're larger companies.
• 33:49
  Craig Petronella: Now you just exponentially amplified your risk factor because now you got 10,000 or however many employees.
• 33:59
  Craig Petronella: You have to make sure they don't do the wrong thing.
• 34:01
  Craig Petronella: It gets really complicated really fast.
• 34:07
  Blake Rea: Yeah, just stay alert out there.
• 34:09
  Blake Rea: Stay alert, Trust.
• 34:15
  Blake Rea: Nobody trust nothing when it comes to your personal information, data, your keys to your castle.
• 34:24
  Blake Rea: If it seems weird, if it seems odd, there's a reason why.
• 34:32
  Craig Petronella: usually, yeah, and going back to the consumer level or the personal level, the more you listen and implement these layers, the more not only unhackable you become, but you become more unhackable at a personal level too.
• 34:53
  Craig Petronella: What I mean by that is, let's say, something happens with a skimmer at a gas station and they try to steal your identity.
• 35:03
  Craig Petronella: If you have more protections around your identity and you have monitoring, you're less likely to become an identity theft victim.
• 35:10
  Craig Petronella: My point is that, like Blake was saying earlier, you have to think about all the software and all these different things on your computing devices, but you also have to think about it on other areas, like your car and what gas station you go to.
• 35:26
  Craig Petronella: You know what I mean.
• 35:28
  Craig Petronella: You have to look at all this stuff.
• 35:34
  Blake Rea: I've seen those little pictures or videos on the internet of people lifting up the keypads on the card readers that are literally one-for-one clones of the text, as like new fear unlocked.
• 35:49
  Blake Rea: Every time I go to a gas station I'm trying to rip the keypad off.
• 35:55
  Craig Petronella: Some of them have a sticker like oh, it's tamper proof, it's got the orange sticker or whatever.
• 35:59
  Craig Petronella: But again, you have to do.
• 36:02
  Craig Petronella: You think that somebody could buy an orange sticker on Amazon or somewhere and put that sticker there?
• 36:07
  Craig Petronella: My point is trust no one.
• 36:09
  Craig Petronella: You've got to protect yourself.
• 36:11
  Craig Petronella: Then I think some people are probably listening and they're like oh, I'm just going to not worry about that, I'm going to rely on my credit card company to protect myself.
• 36:21
  Craig Petronella: And yeah, the credit card company may have like an anti-fraud kind of guarantee where you're not responsible for that.
• 36:27
  Craig Petronella: But I'm not talking about just that transaction, I'm talking about the after effects of identity theft that could happen from that event.
• 36:39
  Craig Petronella: So it's not only where do you frequent, where do you get gas, it's who you do business with at a personal as well as a business level and limit the amount of information you share and demand privacy and security.
• 36:54
  Craig Petronella: If a vendor or somebody you're doing business with on a personal or a business level says, hey, I need you to fill out this paperwork and you see this paperwork and it looks sensitive to you, meaning you don't want some of this information just blatantly on the internet about you or your business or whatever.
• 37:10
  Craig Petronella: Push back and say, look, how are you securing this information for me?
• 37:15
  Craig Petronella: And if they're saying, oh, just email it back to me.
• 37:18
  Craig Petronella: No, push back, email's not secure.
• 37:22
  Craig Petronella: Why would you send all this information?
• 37:24
  Craig Petronella: First of all, push back on why they even need the information and push back on the methodology around how you send it to them, and then also push back on what are they doing to ensure your protection and your privacy and your security.
• 37:37
  Craig Petronella: Because if they don't have good answers to those questions and they don't, in my mind, score well, then think again about whether you should do business with them, because if they don't have your best interest at heart, well, that's another risk factor for you to get breached information.
• 37:55
  Blake Rea: I also think, going back to financial institutions, I think these financial institutions just know your credit card information is probably likely already in a data leak, whether it's this company, that company, whatever and the way that they've combated that pretty recently is implementing the locking features on your card, where you lock your card after use, and that's something that I personally do.
• 38:27
  Craig Petronella: You can call it freezing right, so you could freeze your card, yeah freeze your card.
• 38:32
  Blake Rea: I literally will do that for every single one of my cards.
• 38:35
  Blake Rea: I will literally be that guy in line holding up the line.
• 38:39
  Blake Rea: Hold on, let me unlock my card.
• 38:40
  Blake Rea: Sorry for anybody who's behind me, but it's a scary world and a lot of times, when they buy this information through the dark web or whatever, they'll just go through a list of them and then, if it's declined, they'll delete it.
• 38:59
  Blake Rea: If it's declined, they'll delete it.
• 39:01
  Blake Rea: Oh, and then this one works right.
• 39:02
  Blake Rea: Okay, cool, let's hang on to this one.
• 39:08
  Craig Petronella: So you made me think of something.
• 39:10
  Craig Petronella: Have you heard about the security flaws around Hyundai and Kia vehicles?
• 39:17
  Blake Rea: No, but my dad has a Kia, so I'm curious.
• 39:20
  Craig Petronella: I think Tesla is somewhat affected too.
• 39:22
  Craig Petronella: So I was reading some security information I think it was a day or two ago and they were saying that the security is so bad with and these this includes brand new Kia and Hyundai vehicles too.
• 39:38
  Craig Petronella: The security is so bad with the, the lack of encryption with their key fobs and things like that that car thieves.
• 39:47
  Craig Petronella: It's not just like single digit percentage increases of thefts, it's like exponential in the hundreds of percentages of how easy car thefts in those brands are occurring right now.
• 40:00
  Craig Petronella: And if you think about that as a consumer, you know you might really like one of those vehicles that you know.
• 40:08
  Craig Petronella: Maybe they're, it's a good price, or maybe you feel it's good value, and they may be true.
• 40:11
  Craig Petronella: But again, as a consumer you have to think about well, if I buy this car or truck or whatever it is, I'm now trusting that company to keep me safe in my vehicle.
• 40:24
  Craig Petronella: Or if I go to a restaurant or wherever and you know, a few years ago I never would have thought like, oh, you know, my vehicle is going to get stolen or whatever I pretty much trust that my vendor and my key fob is, you know, I lock my doors and stuff and you feel like you've done your part right.
• 40:40
  Craig Petronella: Well, when I read this article, I was like, oh my goodness, I'm like.
• 40:44
  Craig Petronella: You know, you can have this brand new car and you can lock it and wherever and it's just like child's play for thieves to not only steal the contents inside the car if you've got packages or whatever in there or, god forbid, you're in medical and you've got a laptop in there and you lock it.
• 41:02
  Craig Petronella: You thought you did good, you locked it up or whatever, but for whatever reason, you didn't encrypt it or do the other layers again right, that we're talking about and that thing gets out there.
• 41:12
  Craig Petronella: Well now, not only did you trust that vendor, in this case Kia and Hyundai, but now you suffered a breach because of their lack of security, right?
• 41:23
  Craig Petronella: So that's what I'm saying.
• 41:24
  Craig Petronella: Like, think about this at a personal level, where, what if my car can get opened from some adversary and I've got stuff in there?
• 41:34
  Craig Petronella: What am I doing to protect not only my stuff, but what am I doing to protect my car?
• 41:39
  Craig Petronella: Are there additional things that I can do to protect myself?
• 41:42
  Craig Petronella: You see what I'm saying.
• 41:44
  Craig Petronella: So it's just kind of a weird world.
• 41:47
  Craig Petronella: But yeah, I think we need to push back on the dealerships and on the car manufacturers like, look, I really like this car, I would buy this car.
• 41:55
  Craig Petronella: But here's the latest headlines and this is like the number one and they're not getting these cars back.
• 42:02
  Craig Petronella: By the way, they're like they're going to chop houses and they're divvying these cars up and selling them for parts and stuff.
• 42:07
  Craig Petronella: And one extreme could be at the consumer level.
• 42:10
  Craig Petronella: Oh well, that's why I have insurance and that's they're going to give me.
• 42:13
  Craig Petronella: And, yeah, that might be an option as far as depending on your coverage and things like that.
• 42:18
  Craig Petronella: But that's not the point.
• 42:20
  Craig Petronella: The point is that we need to do more as consumers to push pressure on our vendors and who we buy products from and services from to take our security and take it more seriously and do better to protect us.
• 42:35
  Blake Rea: Yeah, I mean 100% agreed.
• 42:38
  Blake Rea: And then you know we've talked about this and hopped on this a lot, but the human element, you know, again, like I think I read an article somewhere that the instance of car break-ins increased because of, you know, somebody looking into the car and seeing a purse or a backpack or a box you know an Amazon box, or so you know something that you can do that takes zero effort really is if you're going into the grocery store and you're like, oh, let's me leave my work laptop, my work backpack here, you know you just got off work, boom, it's in the back seat.
• 43:17
  Blake Rea: Put that in your trunk.
• 43:19
  Blake Rea: You know, I know that sounds really simple, but you know, if somebody who's getting ready to break into your car looks into your car through the window because they're just not going to go oh that's a, you know that's an Audi, or oh that's a BMW or Mercedes Boom, smash.
• 43:35
  Blake Rea: You know, like, doesn't work.
• 43:37
  Blake Rea: Like that.
• 43:38
  Blake Rea: They look into your car and see what they're going to get access to if they're not deciding to take your car and, like Craig said, to a chop shop and you know, get in and do the entire car jacking.
• 43:49
  Blake Rea: That's a lot of work and there's a lot of risk.
• 43:52
  Blake Rea: You know it's easy for them just to knock the window out and grab your your bag, right?
• 43:56
  Blake Rea: That's a lot easier and it's, you know, a lot less sketchy, right, because then they have to transport that vehicle to the chop shop when you just reported it missing, right?
• 44:06
  Blake Rea: So there's a lot more added risk, but something as simple as putting those things in your trunk and keeping your car clean, you know with no visibility.
• 44:17
  Craig Petronella: I would agree with that.
• 44:18
  Craig Petronella: The only part that I wouldn't agree with is don't put a laptop in the trunk and let, like you know, if you've got it end to end encrypted and you're really certain that you feel that that laptop has enough safeguards.
• 44:29
  Craig Petronella: Do an experiment and just hand it to somebody and just kind of think that if you were to hand this to somebody, do you feel that everything is protected well enough that you won't suffer a breach?
• 44:40
  Craig Petronella: Obviously, put your, your valuables and things like that out of out of sight.
• 44:45
  Craig Petronella: Put them in the trunk, yeah.
• 44:47
  Blake Rea: Carry them, carry them with you, you know.
• 44:50
  Blake Rea: Yeah, the whole point I was trying to make is just get them out of, get them out of vision, get them out of sight.
• 44:56
  Blake Rea: Yeah, don't leave that sitting in the front seat.
• 44:58
  Craig Petronella: I think the other part that's more alarming, though, is that you can or a bad actor can buy these repeaters to legitimately repeat the signal from your your key fob and open your door.
• 45:12
  Craig Petronella: So it's not a matter of they break the window as often anymore.
• 45:16
  Craig Petronella: This is more higher level crime, where they're buying electronic devices to then repeat the signal, either bounce it off from your valid key fob in the restaurant If it's not far enough away.
• 45:27
  Craig Petronella: So that's why we talked about Faraday bags and protecting your keys and using RFID protections around your wallets and things like that.
• 45:35
  Craig Petronella: Now, again, I mean yeah, it goes back to layers, but I don't know if everybody wants to carry a Faraday bag with them.
• 45:41
  Craig Petronella: Maybe it boils down to layers, like we talked about.
• 45:46
  Craig Petronella: What do you, what do you want to do to make it more difficult and what are you willing to do it?
• 45:50
  Craig Petronella: So you're willing to go to try to make yourself as unhackable as possible.
• 45:56
  Blake Rea: Yeah, and those repeaters are cheap $125 on Amazon.
• 46:00
  Blake Rea: They're not illegal to own either.
• 46:01
  Blake Rea: So, you know, that's, that's crazy.
• 46:05
  Blake Rea: So they were selling them at DEF CON.
• 46:08
  Craig Petronella: Yeah, I think you can get a Faraday bag for 15, 20 bucks on Amazon.
• 46:11
  Craig Petronella: So yeah, you know, as an experiment for homework for listeners, you can try do an experiment.
• 46:19
  Craig Petronella: Get one of the repeaters, buy a $15, $20 Faraday bag and see if you can get it to work on your own vehicle.
• 46:25
  Craig Petronella: You know that'd be a pretty inexpensive experiment to do on yourself to see if you see how much at risk you are.
• 46:34
  Blake Rea: Yeah, yeah, absolutely.
• 46:36
  Blake Rea: I mean, don't make it easy, don't make yourself the target, you know, because if you're the low hanging fruit, you know these people have to eat.
• 46:47
  Craig Petronella: Yeah, and then you know, consider some type of camera or recording device on your vehicle.
• 46:53
  Craig Petronella: You know I know they make dash cams now that go both.
• 46:57
  Craig Petronella: They have two cameras, one inside, one outside.
• 47:00
  Craig Petronella: You know you can consider something like that.
• 47:02
  Craig Petronella: But, yeah, the more, the more stuff you have from a security perspective, more layers you put into place, the more evidence you can collect that, god forbid, something does happen.
• 47:13
  Craig Petronella: You know, then you've got more stuff to catch the criminal.
• 47:18
  Blake Rea: Yeah, I've seen some of these apps now, some of these car apps for the new modern cars.
• 47:23
  Blake Rea: Like you can lock the car from your phone and then it'll also tell you, you know, if your alarm's going off, like, oh, like my car, you know, somebody just opened the car door and the alarm went off, or tried to open the car door, you know.
• 47:37
  Blake Rea: And then there's a button that says, like you know, press.
• 47:40
  Blake Rea: You know, call 911, or something.
• 47:42
  Blake Rea: Like you know, they're getting up there trying to make these things more helpful to you, but just be careful out there, you know.
• 47:50
  Craig Petronella: Yeah, absolutely.
• 47:53
  Blake Rea: Well, I think we went a little off topic, but we still had some good information.
• 47:56
  Craig Petronella: Yeah, agreed.
• 47:57
  Craig Petronella: Well, stay tuned for our next episode.
• 47:59
  Craig Petronella: We'll have another one for next week and maybe we'll do a short in the meantime.
• 48:03
  Blake Rea: Yeah, yeah, all right, take care, bye.