00:00:00
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:00:06
Speaker 2: Well, settle in. There's a lot going on. We have a firecracker of a show tonight. You may want to jot this down because there's probably going to be so much information and so much entertainment that you won't be able to absorb it all at once. You may need to go back and listen again. If you want to share it as well, you can. It's NightsideOnDemand.com. NightsideOnDemand.com. Speaking of. com, well, that takes into the cyber world, where it's a big, bad, and scary world. It's a dangerous world. And you've got to keep on your toes. And you've got to actually know what's going on. And towards that end, we have a fantastic guest tonight, the triumphant return of Robert Siciliano. Thanks for coming in.
00:00:53
Speaker 3: My pleasure.
00:00:53
Speaker 2: Thank you. I really appreciate that you come in. I love to actually see you in person and hang out. But I also love the information you give. You remind me of things that I didn't know, and you tell us new things that we all need to know. So here's what we're going to do. We're going to start out this way. Before we get into this, let me tell you, we're going to inform you about a thing called pig butchering.
00:01:21
Speaker 4: Yeah.
00:01:21
Speaker 2: And you don't want to be the pig that gets butchered, do you? Well, if you don't listen, it could happen to you. So there you go. Google is ubiquitous. It's everywhere. A lot of people use Gmail. That must be 90% of people use Gmail.
00:01:41
Speaker 3: I think 85% of the general public has a Gmail address.
00:01:44
Speaker 1: Okay.
00:01:45
Speaker 2: And so many of you use Gmail, and Google also owns other things like YouTube, right?
00:01:53
Speaker 4: Yep.
00:01:54
Speaker 2: Okay. And so, I don't know, you really have to be careful out there. Let's do this. Let's pretend that you got, and it could happen, somebody got your Google password, it was on the dark net or something, and you don't know what to do. You don't know what kind of risk you're in. You don't know what actions to take. You don't know what you could have done before. You don't know what you should do now. It's very likely that this could happen to you. So, Maybe we can prevent it, and if it does happen, maybe we can help you keep the damage to a minimum. So, Robert, what are some of the ways that the bad people can get your login information?
00:02:42
Speaker 3: Well, number one, and most people don't know this, there are, on average, between 2,500 and 3,500 data breaches every single year. Okay, so in 10 years, we're looking at, you know... 25,000 to 30,000 data breaches, right?
00:02:57
Speaker 2: You mean in the United States, in the world or?
00:03:00
Speaker 3: Globally.
00:03:01
Speaker 1: Okay.
00:03:01
Speaker 3: Okay. And a good portion of them are actually here in the US, a good portion of them, UK and so on. And those data breaches contain our personal information, names, addresses, phone numbers, email addresses, account numbers, and many passwords. So if you do your own research, you'd find that there's probably about 300 billion of our records on the dark web, 300 billion with a B. And of those 300 billion records, about 25 billion of them are actually passwords. And so bad actors, they're not necessarily hacking. They just log in. And once they log in, they own you. If they have access to your email, that's where they can do the absolute most amount of damage. So the idea is do the basic things like never using the same passcode twice ever.
00:03:54
Speaker 2: Meaning for different applications.
00:03:56
Speaker 4: Yeah.
00:03:57
Speaker 3: So for example, like you have a different passcode for Gmail as you do for Facebook, a different passcode for eBay as you do for Amazon and so on. Never using the same passcode twice. And people say, well, how do you remember them? Well, you don't remember them. I don't remember them.
00:04:10
Speaker 1: At all.
00:04:11
Speaker 2: Of course, you don't remember.
00:04:12
Speaker 3: The password manager that you have, which you should have a password manager, remembers your passwords for you. Then people say, well, what if the password manager gets hacked? I'm not worried about that. I've had a password manager since 2004, and I'm good. If you use a password manager... They use bank-level military-grade encryption, and you should be fine.
00:04:30
Speaker 2: Okay.
00:04:30
Speaker 3: Explain to the folks what a password manager is. So it's a software, you know, like any other software. Generally, when you download it, you install it, it plugs into your browser, Safari, Chrome, Edge, and so forth. So it's like a little icon up there. When you log into a website, when you go to a website, the password manager will pop up and say, hey, you want us to enter the passcode? And you click a button, and it enters the username and passcode in for you. And or you can use the password manager to actually get to that website. So it's really a time and efficiency and privacy and security.
00:05:03
Speaker 2: It's great. I think password manager was an app where you have all the passwords and you go to it, you put in a master password and it has all your usernames and passwords. Is that different?
00:05:13
Speaker 3: You said it better than me.
00:05:15
Speaker 2: Is it better?
00:05:16
Speaker 3: That is correct. That is correct. That is what a password manager is.
00:05:19
Speaker 4: Okay.
00:05:19
Speaker 1: Yeah, yeah.
00:05:20
Speaker 2: Here's a question. A lot of times when you're logging into something, a thing pops up that says, save password for this device. And it says, always, never, and something else. Is it bad to save the password for that device?
00:05:33
Speaker 3: Well, it all depends on the device that you're on. So generally, like if you're on your own device, your own laptop, your own desktop, versus like the library computer, you know, which people still do. Generally, the answer is yes, it's okay to do that. Honestly, I don't do that the majority of the time. I let my password manager log in pretty much every time with the exception of like Amazon and Google.
00:05:58
Speaker 4: Huh.
00:05:59
Speaker 2: So can bad actors get into your computer and find the saved password?
00:06:05
Speaker 3: So I'm not so worried about them getting into my computer or your computer, unless like right now, if you're in a windows machine, you are supposed to be on windows 11, you know, windows 11 is the latest, greatest operating system, the most secure operating system that they currently offer. If you're in like Windows 8, well, you're extremely vulnerable. It's like you're driving a Pinto with bald tires. You know what I mean? So as long as you're like on the latest updated version of Windows or the latest updated version of Mac, so the latest hardware, the latest software, generally you should be in pretty good shape maintaining updates for your browser, updates for your operating system. Like these are the basic one-on-one things.
00:06:44
Speaker 4: Okay.
00:06:44
Speaker 3: And as long as you're updated, generally you should be fine. And a hacker was going to have a harder time getting on your machine. Okay.
00:06:52
Speaker 2: And I mean, I have random questions that don't have necessarily chronological order. Is it more dangerous? I wrote them down as I thought of them. Is it more dangerous to use a banking mobile app on your phone than it is to do your online banking at your desktop at home?
00:07:12
Speaker 3: So I do both frequently. And I would say that like they're both equally secure and and equally have the same vulnerabilities. The vulnerabilities are, of course, like if your mobile phone, let's say, is not password protected, and you'd be surprised how many millions of people do not password protect their mobile phone. If your mobile phone is not password protected, and it's lost or worse, stolen, what do they have access to?
00:07:40
Speaker 2: Everything.
00:07:40
Speaker 3: Everything, okay? So that's what the vulnerability is. That's truly what the vulnerability is.
00:07:46
Speaker 2: Just the other day, the phone asked me, how long before it shuts off if it's inactive? I think the default might have been five minutes. I switched it to two minutes. Is that a good plan?
00:07:58
Speaker 3: Yeah, two minutes or one minute. One minute might not be enough time. Like I just used Apple Pay. Because if somebody finds it and it's open, they can keep it open just by keeping it active. That's correct. Or they could go right into it and they could shut off the.
00:08:14
Speaker 2: Timer.
00:08:15
Speaker 3: So two minutes generally is fine for functionality purposes. One minute is better.
00:08:20
Speaker 2: One minute. All right, I'm changing it because I'm all about that. Back to the email hack. How can that hurt you? What are all the ways that the email hack can hurt you?
00:08:32
Speaker 3: So bad actors say if you own the person's email, you own the person. And truly, your email is the epicenter of everything. So for example, like with your email, if you need to reset your passcode, say for your Bank of America account, What's going to happen when that occurs? You're going to get an email to reset that passcode.
00:08:54
Speaker 2: And the bad actor does it.
00:08:55
Speaker 3: If he's inside of your email and he goes to reset your passcode for Bank of America, he gets the password reset via your email and he could do a lot of damage. So the most important tool that you need to protect is your actual email. And that means not using the same passcode for Gmail, let's say, as you do for Facebook, making sure you have two-factor authentication enabled for Gmail or whatever tool you use. And generally you should be in pretty good shape.
00:09:20
Speaker 2: Explain what two factor authentication is.
00:09:22
Speaker 3: So every time you log in, say to PayPal, right? You should be getting a one-time text message so that you not only log in with your username, which is often your email address and then your passcode, whatever that might be. Then you get a text message with a six digit code. That six digit code is that second factor, your phone being the second factor as well.
00:09:44
Speaker 2: So if you have two factor authentication engaged, Just having your password is useless to the bad actor, right? That's correct.
00:09:54
Speaker 3: So what the two-factor authentication does is it can make the password useless to the thief, even if they have access to it. access to your password.
00:10:01
Speaker 2: You got to have that, folks. You may think that it's a hassle. It's not. You used to have to go to the bank. That could have taken you a half an hour to an hour. So don't sweat the 30 seconds it takes to authenticate through a second device. What happens is... You try to log in, you put your password in, and then it will say, go to your phone and type in the code that we're sending there, or your email, and then it's a life, trust me, it's a lifesaver. There are other kinds of even more robust, I don't get to say the word robust very often, robust two-factor authentications. What about third-party apps like any third-party app.
00:10:53
Speaker 3: Like Authenticator?
00:10:54
Speaker 2: Yes.
00:10:55
Speaker 3: I can think Google offers Authenticator or Microsoft. One of them has one or the other. I personally don't use them myself, not because there's anything wrong with them, but I just prefer the two-factor authentication via my phone. It just streamlines things a little.
00:11:09
Speaker 2: Bit for me. Is the third-party one a little safer?
00:11:13
Speaker 3: Yes, it actually is a little bit safer.
00:11:14
Speaker 2: Okay. Now, what about the hardware... authentication device.
00:11:22
Speaker 3: So like something like a YubiKey. It's spelled Y-U-B-I-A-Key. YubiKey is one option.
00:11:29
Speaker 2: It's like a USB.
00:11:30
Speaker 3: It's like a USB. Those are fantastic. Obviously, if you lose it, you know, that could be problematic.
00:11:36
Speaker 2: We'll find out what makes them better after this on WBZ.
00:11:41
Speaker 1: You're on Nightside with Dan Ray on WBZ, Boston's news radio.
00:11:46
Speaker 2: All right, we're trying to save your life savings here. We have Robert Siciliano, who is a cybersecurity expert and is very valuable information. You should really have a pen and a paper. You're still never going to remember it. So you really do probably want to listen to this hour again, this hour of Night Sight. Go to NightSightOnDemand.com to go through this, as they say, with a fine-tooth comb. So we were talking about two-factor authentication, which, if you just joined us, is when, say, you try to log into something and use your password. You can't directly log in. You will be prompted to go to another device, your phone, if you're on your laptop. And they will send you a code over there, and you type it in. I love that. It just makes me feel– it can save the day. But there are different kinds of this 2FA is what it's called, the second two-party authentication, two-factor authentication. There's one where you have a hardware device. It's like a little USB. And it's said to be even more secure– How does it work and why is it more secure?
00:12:53
Speaker 3: So it offers the same security as, say, a one-time text message in regards to access. The vulnerability with the mobile phone or the app for two-factor authentication is what we call a man-in-the-middle attack. In other words, if somebody calls you posing as, say, your bank, and they say, you just received a text message for two-factor authentication. We need to reset your account. And you give them that second factor over the phone, there's the vulnerability. You've just been scammed. So the vulnerability is truly you, the human, our want and need to trust each other.
00:13:32
Speaker 2: And so this hardware thing, yes. Sorry, go ahead.
00:13:34
Speaker 3: Whereas the key, you have to physically hand it to somebody. And that's a whole different scenario.
00:13:39
Speaker 2: How do you mean hand it?
00:13:40
Speaker 3: Like literally that key is used to actually plug into the machine.
00:13:44
Speaker 4: Right.
00:13:45
Speaker 3: And that's the second factor versus, you know, plugging in a code that you'd get via your phone that you could be scammed over the phone or via email to give out to somebody.
00:13:54
Speaker 1: Right.
00:13:55
Speaker 2: Okay. By the way, we haven't spoken about your book. All this is in your book become a strategic human firewall, right?
00:14:02
Speaker 1: Yeah.
00:14:02
Speaker 3: Just check me out on Amazon. Just search for Robert Siciliano.
00:14:06
Speaker 4: Okay.
00:14:07
Speaker 2: And everything I'm talking about is in the book because I'm going to get the book.
00:14:12
Speaker 4: Yeah.
00:14:12
Speaker 1: Yeah.
00:14:12
Speaker 2: Because that way I can use that as a reference, right? I would have brought you one. Yes, of course. Yeah, you could have brought me one. That's right. That's right. I'll buy one. I'm happy to buy one. Let me check my notes here. What's next? Interesting. I mentioned to you earlier that I've been experimenting. I feel that I'm being swallowed up by the cyberverse in every way. Like I'm even now, or I was, even purchasing stuff from vending machines with a card. And I'm not real comfortable with that. For one thing, I hate getting that list of stuff I bought at the end of the month. It's so big, I can't even look at it. I can't check it to see if there are any bad purchases there because there's so many. And you get the name of the parent company. So if it's your gym, it doesn't say your gym. It says company ABC. And you say company ABC gym. Who's that? Who's that? So you do that to a couple of things and you give up and you just trust them. And I hate that.
00:15:15
Speaker 3: So when the merchant status, when the name of the merchant and the credit card receipt doesn't match up with the building or the restaurant or the store, that can be frustrating.
00:15:23
Speaker 2: Oh, yeah.
00:15:23
Speaker 3: So the best way to manage that, and I don't necessarily worry about credit card fraud. I use credit cards for everything. I actually don't use cash all that often, but I do still use cash, of course. As long as you set up what's called push notifications. So that means every single time you charge your card over the phone, via an app, online, you swipe at point of sale, in person. You get a text message or an email or a pop-up on your device. You get real-time notifications of those charges as they occur. That way, you are fully in tune in real-time with your activity.
00:16:01
Speaker 2: So is the text different than push notification? In one case, you go into your text app. In another one, it just pops up on the phone. Or is it the same thing?
00:16:11
Speaker 3: So actually, with each card... whether it's American Express or a visa from Marriott or a MasterCard with Hyatt, whatever the case is, every card issuer, every bank, they have their own methodology. Some, it's a text message. Some, it's a pop-up. Some, it's a different notification entirely. So You sometimes can choose, but in general, it's default what they offer. And so I'm getting dinged and popped ups all day, every day. And I'm okay with that because I want to know in real time.
00:16:48
Speaker 2: All right. Let's bring back the scenario of you get your Gmail hacked. They get your password. It seems to me that once the bad actors have gotten into your Gmail, your Google world that as long as they don't log out, they're in for as long as they want to be and can do cause you harm for ad infinitum time. Even if you change your password, it's only if they log out, they won't be able to get back in because you change your password. Uh, it seems like a very bad thing that they're in there forever. What can you do? Well, two things.
00:17:30
Speaker 3: If you, if you, once they get in, once they're in, uh, Generally, Google, let's say, is going to log out every device usually after 30 days anyways.
00:17:43
Speaker 2: I didn't realize that. I did some research and it said it was forever, but that's not the case?
00:17:49
Speaker 3: Well, it all depends on your security settings. So generally, Google is going to log you out after about 30 days, then you're going to have to log back in, generally. Can you set that?
00:17:58
Speaker 2: Why couldn't you set it for like a week or 24 hours?
00:18:01
Speaker 3: So sometimes it can be, you know, every, it could be 20 minutes depending on your settings.
00:18:06
Speaker 2: Where do you go to set that?
00:18:08
Speaker 3: Google it.
00:18:10
Speaker 2: I'll Safari it.
00:18:12
Speaker 1: Okay.
00:18:12
Speaker 2: I'll chat GPT it.
00:18:14
Speaker 3: There's a few different options. I know with my system, I'm logged out every 30 days. And that means that I have to, you know, reestablish myself, have it re-recognize my device.
00:18:24
Speaker 2: That's fine.
00:18:24
Speaker 3: And re-engage two-factor authentication.
00:18:26
Speaker 2: All right.
00:18:27
Speaker 3: But what that also means is if anybody else has my passcode and if they try to log in from their device, I'm going to get that second factor authentication. I'm going to get notifications. So they're not going to be able to get in because they don't have my phone. That being said, as long as you have that two-factor authentication, in most cases, you should be in pretty good shape.
00:18:44
Speaker 2: This is complicated, isn't it, folks? There are a lot of folks out there that don't have a computer. And, you know, we give them a hard time. But they're at home saying, see, I was right. You shouldn't have a computer. The thing is, folks, the world is forcing you to have a computer. Like to do my taxes. There's an app. I got a tax guy. Most tax people, you got to do some of this stuff. And to get paid for various things, you got to really– It's tough to get through life without all this now.
00:19:21
Speaker 3: Yeah, that's where we're at right now. Look, I'd be perfectly fine if there was no internet, if there was no mobile phones. I came here tonight on an 87 Harley that does not have a single piece of digital technology in it. It is just motor and metal.
00:19:34
Speaker 4: Right.
00:19:35
Speaker 2: I have a friend who's got a 2010 Challenger Red, and they need a new car. They don't want to get one because they don't want it packed with spyware.
00:19:45
Speaker 3: A computer, yeah, yeah.
00:19:46
Speaker 2: I'll be glad when they go back to knobs. Hopefully the car buying public is tired of that irritating screen. But we have limited time, so I should stay on topic here. So one can, this is really important, one can go into their Google settings and set how the amount of time that Google can stay open without auto shutting down. I would set it for 24 hours.
00:20:17
Speaker 3: I'm not 100% sure of that. I'm not 100% sure of that. I would search it out. It's been a while since I researched that. And Google continually changes the way that they do things. So like, for example, you know how you log into Facebook and everything's all moved around every so often?
00:20:33
Speaker 2: Yeah.
00:20:34
Speaker 3: Google has been doing that over the years too. So that may have changed. I would just go into security settings. I wouldn't necessarily worry about how quickly you're going to be logged out. And the main thing, the most important.
00:20:45
Speaker 2: Don't worry about the bad actor being able to be in there forever or for a month.
00:20:49
Speaker 3: As long as you're changing.
00:20:51
Speaker 2: Even after I've changed my password because he's already in.
00:20:54
Speaker 3: Google is not okay with a bad actor being on your device from a location that Google doesn't recognize the internet protocol address. They don't recognize your... Your device. Google's not okay with that.
00:21:07
Speaker 2: They might kick them off?
00:21:08
Speaker 3: They're going to kick them off.
00:21:09
Speaker 1: Oh. Yeah.
00:21:10
Speaker 3: In most cases, they will.
00:21:11
Speaker 2: I wish they would tell me that.
00:21:14
Speaker 3: So they know enough today that if somebody is logging into your machine from an IP address that Google is not familiar with where you generally operate.
00:21:25
Speaker 2: For some reason, I'm here one minute and I'm in Ohio 30 seconds later. Correct. They're going to know.
00:21:32
Speaker 3: It's come to the point where they're actually bumping you out of your own account more often than you might want to.
00:21:39
Speaker 2: Okay.
00:21:39
Speaker 3: So they're getting a little over the top in that regard, but that's not necessarily a bad thing.
00:21:45
Speaker 2: Okay. Well, time flies. It's time for another quick break, and we'll continue with the author of Strategic Human Firewall. That's not the whole title, is it? What's the actual whole title?
00:21:59
Speaker 3: The Strategic Human Firewall is what I aim for everybody.
00:22:02
Speaker 2: Okay. The Strategic Human Firewall. You're getting a little taste of all the stuff you need to know that's in this book. More with Robert in a moment on BZ.
00:22:11
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:22:16
Speaker 2: Here we go. We're continuing with Robert Cisleano, and he's the author of the book, the strategic human firewall. And he wants you to be a strategic human firewall because in this cyber world we live in, you are vulnerable. If you don't keep up, if you don't keep up, you're going to have a problem. If we can't recap everything we've done so far, we'll just continue. We hear about VPNs. You use a VPN, right? Yeah.
00:22:45
Speaker 3: On my mobile phone and my laptop, like I'm at the airport or a hotel, I'm at the resort. I log in to my VPN so that it encrypts my information over the free wireless network.
00:22:57
Speaker 2: Okay, so a VPN is a virtual private network?
00:23:01
Speaker 3: Exactly.
00:23:01
Speaker 2: Okay. And so what does it do and what does it not do? If you use a VPN, does that mean that bad actors can't get your passwords and stuff?
00:23:12
Speaker 3: It means if you are on a free wireless network, like Logan Airport, let's say, That is being used by hundreds, thousands of people. There's tools that somebody could deploy that can sniff out your data as it's traveling through the air. They call it Wi-Fi packets. The science behind this, and that science basically says that they can install hardware and software to literally sniff out that data and capture it. They can see what you're communicating, what you're transmitting on that free Wi-Fi network that is unencrypted. What the VPN does is it encrypts your information over that unencrypted network, plain and simple.
00:23:56
Speaker 2: So it's not going to help you that much if you're at home?
00:23:58
Speaker 3: Well, it could help you at home, too, if you're on unprotected Wi-Fi at home, sure.
00:24:05
Speaker 2: So if you're not, unless you're on some unprotected Wi-Fi, it doesn't help you?
00:24:11
Speaker 3: You don't necessarily need it.
00:24:12
Speaker 4: Okay.
00:24:15
Speaker 2: I was, you know, in anticipation of your day here, and I've been paying attention to things more carefully, I looked at my browsing history and realized, well, if someone gets my Google password and I'm using Google Chrome, maybe they can see everywhere I've been. Or maybe this is just on this machine. They can't see into this machine. I never know what's local and what's network, what they can get at and what they can't. Also, I noticed that Passwords get saved. When the machine asks you, do you want to save this password? And you say, yes, it saves it. If somebody gets into your Google world, can they see those passwords on your machine?
00:25:02
Speaker 3: So access to Google's servers versus access to your machine are two different things, locally versus virtually. I know that as long as you have updated hardware, updated software, updated browser, change your passcodes, have antivirus. You do these basic things, you're generally in good shape. Can they see your passcodes at Google? It's going to be hard. It's hard to hack Google. Google's just a behemoth that has the best security in the world. The vulnerability is not Google. The vulnerability is you. It's us.
00:25:36
Speaker 2: It's me. It's the human. It's our want and need.
00:25:38
Speaker 3: To trust each other. and us being scammed over the phone via email or text message. That's where the true vulnerability is.
00:25:49
Speaker 2: So basically, you don't have to worry about a bad actor getting into your Google world and getting into your machine and seeing stuff that's locally on the machine. You don't need to worry about them seeing your history or your passwords.
00:25:59
Speaker 3: I would not be so concerned about that as long as updated hardware, software, browser, changing passcodes, two-factor.
00:26:06
Speaker 2: Seems like you're leaving a little concern there.
00:26:10
Speaker 3: So look it. I got a phone call from Google Security.
00:26:13
Speaker 2: Two weeks ago.
00:26:13
Speaker 4: Oh, good.
00:26:13
Speaker 2: This is a good story.
00:26:14
Speaker 3: Two weeks ago, I got a call. On my caller ID, it said Google Security.
00:26:18
Speaker 4: Yeah.
00:26:18
Speaker 2: All right.
00:26:19
Speaker 3: Hello, Mr.
00:26:20
Speaker 2: Siciliano.
00:26:21
Speaker 3: This is Google Security. I'm like, yeah, I know. I'm looking at the caller ID. They're like, yes, is your phone number? And I'm like, yeah, you just called it. And is this your email address? I'm like, yes, that's my email address. And they said, by any chance, are you in Montreal, Canada? I'm like, no, I'm in Boston. They were like, well, we have reason to believe that somebody in Montreal, Canada is trying to log into your account right now. And I'm like, really? And I'm saying to myself, is this Google Security? because I don't think Google security will ever call anybody. And so now I'm kind of like.
00:26:49
Speaker 2: Yeah, there's no such thing, right? Well, there is, but I mean, people calling you, right?
00:26:54
Speaker 3: Google security is not going to call anybody. And so I'm kind of playing along with them, but at the same time, I'm checking my own accounts as I'm talking to them, to make sure that everything was secure.
00:27:04
Speaker 4: Right.
00:27:05
Speaker 3: And as I'm having a conversation with this person, he's telling me more about me, where I live, my address, my phone number, my email address. He had, enough information about me to con Vince me that they were Google. And in that process, he said, okay, so all we really need to do is reset your account to keep whoever is trying to get into your account out. I said, well, what does that process entail? He says, well, we're going to send you a one-time text message that you, all you have to do is click yes. And it's going to reset your account.
00:27:39
Speaker 2: So did, were you, were you wise to them yet at this point?
00:27:44
Speaker 3: Well, not a hundred percent.
00:27:45
Speaker 2: Wow.
00:27:46
Speaker 4: Because.
00:27:46
Speaker 2: And you're a super professional.
00:27:48
Speaker 3: Because they were really good at what they do.
00:27:50
Speaker 4: Yeah.
00:27:51
Speaker 2: Okay.
00:27:51
Speaker 3: But like, I know that Google doesn't generally call people and my account was secure and I am, this is what I do for a living, but I still want to trust other humans. And the person that I was speaking to was really good at what they did. And I said, listen, I'm not quite sure what's going on here. Can you at least send me like a case ID from Google? He's like, hold, please. Two seconds later, I get an email from Google. It was from Google with my case ID. It was perfect.
00:28:25
Speaker 2: So it looked like it wasn't really from Google.
00:28:27
Speaker 3: It was from Google. Yes, it was from Google. And I went right into the source code. And AI, Gemini's AI told me, yes, this email is from Google.
00:28:39
Speaker 4: Yeah.
00:28:40
Speaker 3: Everything about the, but it was forwarded through a different server. They manipulated a few different things. And in that process, I'm like, okay, can I speak to a supervisor, please? And the supervisor gets on the phone and repeated every single thing that this guy said to me. He's like, sir, at Google security, we take our client's security seriously. He says, if you don't reset this account, we can't guarantee that they're not going to get access to your account. So I go, I said, send me the text message. And they sent me the text message. And that was the moment of truth. I'm looking at a text message from Google that said, to reset your account, click yes. If you don't agree with this, click no. I was like.
00:29:22
Speaker 2: You had to decide.
00:29:23
Speaker 3: I had to decide. And I clicked no.
00:29:26
Speaker 4: Okay.
00:29:27
Speaker 2: And they were not legit, but they somehow routed their thing through Google.
00:29:32
Speaker 4: Yes.
00:29:33
Speaker 2: Oh, my God. So there's no hope. No, no, no.
00:29:35
Speaker 3: There's plenty of hope.
00:29:36
Speaker 2: Oh, God.
00:29:37
Speaker 3: But here's the deal. I don't know if my dad... would have survived that scam. I know my wife wouldn't. I'm not sure if my kids would have. I don't know that a lot of my clients would. Because it really took every ounce of my energy and strength to not click yes. The problem that night was I couldn't sleep. I was upset the rest of the day.
00:30:01
Speaker 2: Yes.
00:30:01
Speaker 3: I was upset the rest of the day.
00:30:02
Speaker 2: You still didn't know if you'd made a mistake by saying no.
00:30:05
Speaker 3: No, that's not it. I was upset that I came that close.
00:30:09
Speaker 2: Oh yeah. Okay.
00:30:10
Speaker 3: I came that close. This is what I do for a living.
00:30:13
Speaker 1: Okay.
00:30:14
Speaker 3: And it's because they, their technology was so perfect and they, they, they're, they checked my checks and balances. They had an answer for everything. And so as a result of that, like, I present that exact same scenario in my audiences, and I have screenshots of everything. You could see everything.
00:30:33
Speaker 2: It's part of your keynote speeches.
00:30:37
Speaker 4: Yeah.
00:30:37
Speaker 3: And I show everybody the source code and everything. Like, it was perfect. And the point of all of this is, like, as long as you're paying attention, as long as you know that, lookit, Google's not going to call you.
00:30:48
Speaker 2: You paid attention, and you almost got busted.
00:30:51
Speaker 3: I did. But I also didn't.
00:30:54
Speaker 4: Yeah. Yeah.
00:30:55
Speaker 2: I didn't.
00:30:56
Speaker 4: I know.
00:30:57
Speaker 3: And the lesson is Google is not going to call you. Bank of America, if they call you, call them back at a number that you know is legitimate.
00:31:05
Speaker 2: Yeah.
00:31:05
Speaker 3: PayPal's not going to call you. Best Buy's not going to call you. These companies are not going to pick up the phone and just call you and say, hey, we have reason to believe. They're just not going to do that. So as long as your BS radar is up, you should be fine.
00:31:20
Speaker 2: Yeah, I don't know. Yeah.
00:31:22
Speaker 3: Hey, I am an optimist.
00:31:25
Speaker 2: It was just luck. It was a flip of the coin with you pressing no.
00:31:29
Speaker 3: It wasn't a flip of the coin. It went against everything that I speak to.
00:31:33
Speaker 2: Yeah. It seems like the only way to survive is just say no, no, no, no, no, except I mentioned to you earlier, my bank actually tried to get in touch with me with something that I thought looked phony. And so I called them up and said, this looks phony. You really got to do it. And they said, yes, it's legit. But I even worry about Trying to find the phone number, Googling whatever customer service phone number and have a phony one pop up, a phony phone number.
00:32:01
Speaker 3: That's possible.
00:32:02
Speaker 2: One time I had checked an airline fare to Jerusalem. And then I said, all right, I'm going to buy it. So I Googled again, LL Airlines, and clicked on what to me was LL Airlines. Bought the ticket and only after purchasing the ticket– I found out it wasn't LL Airlines. It was some third-party seller. It was still– I think I paid her way too much. Yeah, that's possible.
00:32:32
Speaker 3: I've done stuff like that before.
00:32:33
Speaker 2: I did have really good– I think we all have. I had good seats, but it is such a minefield. We have Rick and Bill Ricker who has got some input here. We'll continue with Robert Cicilliano, author of Strategic Human Firewall, B1, after this on WBZ.
00:32:51
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:32:56
Speaker 2: We continue with Robert Siciliano, author of Strategic Human Firewall, How to Protect Yourself from Bad Actors on the Internet. By the way, Robert does keynote speeches. He's really good at it. And if you are in charge of or if you work at a company you think could benefit from this firewall wisdom, how do they contact you? I want to make sure this is worth your while today.
00:33:22
Speaker 3: I am online at protectnowllc.com. Again, that's protectnowllc.com.
00:33:28
Speaker 2: Protect Now, LLC. If you don't write it down, remember, there's always nightsideondemand.com. You'll listen through. You can scroll. I think you can probably scroll ahead to this point. Let's quickly go to Rick and Bill Ricker. Then we're going to find out about pig butchering, which is something you don't want. Okay, hi, Rick. Hey, Bradley.
00:33:52
Speaker 4: Hey, Robert, I requested you. Thank you.
00:33:56
Speaker 2: Oh, that was you. I'll make it.
00:33:59
Speaker 4: Well, I mean, I'm sure Bradley would have had you on at some point, but I really pushed it. I just want to say quickly, last November you were on. I remember you talking about how overseas, like, these guys can, like, pimp girls to either in the sex trade or to get money out of somebody overseas. Remember you were talking about that and how they use legitimate platforms and they'll stick with you and show you how to make money in the stock market, but it's all fake.
00:34:27
Speaker 2: We're going to talk about that exact thing coming up.
00:34:29
Speaker 1: Okay.
00:34:30
Speaker 3: That is pig butchery.
00:34:31
Speaker 1: Yeah.
00:34:32
Speaker 2: Oh, okay.
00:34:33
Speaker 3: That's pig butchery.
00:34:34
Speaker 4: I will just say this because I'm on the air now. My friend lost everything. He lost all of his retirement. He got involved in a situation like that, lost everything. And when I told him about it, because I told you I'm going to tell him, it was hard for me to explain to him. But he already knew. He was like, what do you want me to do? I'm sick. I'm going in for an operation. He went in for an operation a little bit later and died of COVID at the hospital. He couldn't even pay his rent anymore. And this guy was a smart guy. And he was a dear pal. He was only 74 years old. I was friends with him 28 years. And it was all because he got suckered in to exactly what you guys will talk about. So.
00:35:15
Speaker 2: That's a sad, sad story.
00:35:17
Speaker 4: I know.
00:35:18
Speaker 2: I know, Bradley.
00:35:19
Speaker 4: He lives right down the street from the Paradise. Saw some great shows with him. I'll tell you another time about that.
00:35:24
Speaker 1: But he was a great pal.
00:35:26
Speaker 2: But you're going to talk about pig butchering.
00:35:28
Speaker 4: And, Robert, you're a blessing to the greater community and anyone that's listening. And everyone just, period. Because you could help them from, yeah, from losing everything.
00:35:41
Speaker 2: You can help.
00:35:42
Speaker 4: I'll let you guys go.
00:35:43
Speaker 2: I'm tight on time here. I want to make sure we get the pig. Thank you. Okay, Robert, you're going to give the detailed version of that. The sad, sad story. You got the end game of that. We'll find out how that happened right now. Go ahead.
00:35:56
Speaker 3: So real quick, like every single time you get those wrong number text messages, You know, hey, Robert, we're supposed to meet for lunch tomorrow. You're like, who's this? And the moment you respond with who's this, you're already going down the rabbit hole.
00:36:08
Speaker 2: Other ones are, hey, are you still okay? I haven't heard from you in a while.
00:36:13
Speaker 3: Exactly.
00:36:13
Speaker 2: And you're supposed to go, do I know you? Or something like that.
00:36:19
Speaker 3: 100% of the time, there is a human on the other end of that text message, generally who is a victim of human trafficking. hold up somewhere in Southeast Asia on a compound that there might be, you know, a couple thousand of those same people being held against their will. And all day, every day, they're sending out text messages and they have a script. And once you react, once you respond, they're like, oh, hey, hi, my name is Isla. And they send a picture of this like pretty girl. And then the dialogue begins.
00:36:51
Speaker 2: Humans are so awful, aren't they?
00:36:53
Speaker 3: Well, the awful humans are.
00:36:54
Speaker 2: Give them half a chance and they're just the worst.
00:36:56
Speaker 3: The sociopaths and the psychopaths and the hardcore narcissists are awful. But what most people don't realize is that as much as 25% of all of humanity wakes up every day a little lonely.
00:37:08
Speaker 4: Yeah.
00:37:08
Speaker 3: And it's that loneliness that compels us to react and respond to these text messages. And the criminals know that if they can get somebody on the line that's a little lonely, that if they communicate with that person 6, 8, 10, 12 times a day, good morning, dear, how did you sleep last night?
00:37:23
Speaker 1: I know.
00:37:24
Speaker 3: Good afternoon, dear. I'm having lunch. What are you having today? Good night, dear. I hope you sleep well.
00:37:29
Speaker 2: You're better off, uh, befriending chat GPT. Right.
00:37:33
Speaker 3: And that happens like all day, every day when you're communicating with them, what happens to your loneliness after a week?
00:37:39
Speaker 2: In a, in a, like 60 seconds, uh, go through what happens. Uh, and, uh, What they'll try to do to you and when.
00:37:48
Speaker 3: Once you are in their web, within a week or two, they're going to get you on a WhatsApp video call, which I've been on WhatsApp video call with these scammers, with the victims of the human trafficking. And usually it's like a young female. And she is saying, hey, you know, like I've been investing in crypto, making 80% on my return returns.
00:38:07
Speaker 2: And they say this offhandedly, like it's no big deal.
00:38:10
Speaker 3: Like it's no big deal.
00:38:11
Speaker 2: Your interest... is peaked.
00:38:13
Speaker 1: Yeah.
00:38:13
Speaker 2: And you say, what?
00:38:14
Speaker 4: Ooh.
00:38:14
Speaker 3: And you are already intertwined with this person. You already trust them. You're already like, you know, having a hard time sleeping every night because you're thinking about them all the time because they're infiltrating your whole mind and body. And once they say crypto, you're like, sign me up because I'll do whatever you say. That's how that works. It's unfortunate.
00:38:32
Speaker 4: Yeah.
00:38:32
Speaker 2: I feel, you know, and we're all going, I would never do that. But there's a lot of stuff you, you get, suckered into online. And you just, you just don't know because they're experts.
00:38:47
Speaker 3: This is why you want to become a strategic human firewall head on a swivel.
00:38:51
Speaker 2: And that's why you want to buy the book. And that's why you want to have Robert as your keynote speaker. We've got 30 seconds to give me the, how to get in touch with you again.
00:39:01
Speaker 3: I'm online at protect now, LLC.com again, protect now, LLC.com or just Google Robert Siciliano. If you can spell it.
00:39:09
Speaker 2: Okay, Robert's taking off now on his motorbike. Be very careful out there.
00:39:14
Speaker 1: I will.
00:39:15
Speaker 2: It's dangerous. It's a dangerous world now. We have Michael Coyne checking in with us next to talk about the dramatic day in the Clancy trial.
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:00:06
Speaker 2: Well, settle in. There's a lot going on. We have a firecracker of a show tonight. You may want to jot this down because there's probably going to be so much information and so much entertainment that you won't be able to absorb it all at once. You may need to go back and listen again. If you want to share it as well, you can. It's NightsideOnDemand.com. NightsideOnDemand.com. Speaking of. com, well, that takes into the cyber world, where it's a big, bad, and scary world. It's a dangerous world. And you've got to keep on your toes. And you've got to actually know what's going on. And towards that end, we have a fantastic guest tonight, the triumphant return of Robert Siciliano. Thanks for coming in.
00:00:53
Speaker 3: My pleasure.
00:00:53
Speaker 2: Thank you. I really appreciate that you come in. I love to actually see you in person and hang out. But I also love the information you give. You remind me of things that I didn't know, and you tell us new things that we all need to know. So here's what we're going to do. We're going to start out this way. Before we get into this, let me tell you, we're going to inform you about a thing called pig butchering.
00:01:21
Speaker 4: Yeah.
00:01:21
Speaker 2: And you don't want to be the pig that gets butchered, do you? Well, if you don't listen, it could happen to you. So there you go. Google is ubiquitous. It's everywhere. A lot of people use Gmail. That must be 90% of people use Gmail.
00:01:41
Speaker 3: I think 85% of the general public has a Gmail address.
00:01:44
Speaker 1: Okay.
00:01:45
Speaker 2: And so many of you use Gmail, and Google also owns other things like YouTube, right?
00:01:53
Speaker 4: Yep.
00:01:54
Speaker 2: Okay. And so, I don't know, you really have to be careful out there. Let's do this. Let's pretend that you got, and it could happen, somebody got your Google password, it was on the dark net or something, and you don't know what to do. You don't know what kind of risk you're in. You don't know what actions to take. You don't know what you could have done before. You don't know what you should do now. It's very likely that this could happen to you. So, Maybe we can prevent it, and if it does happen, maybe we can help you keep the damage to a minimum. So, Robert, what are some of the ways that the bad people can get your login information?
00:02:42
Speaker 3: Well, number one, and most people don't know this, there are, on average, between 2,500 and 3,500 data breaches every single year. Okay, so in 10 years, we're looking at, you know... 25,000 to 30,000 data breaches, right?
00:02:57
Speaker 2: You mean in the United States, in the world or?
00:03:00
Speaker 3: Globally.
00:03:01
Speaker 1: Okay.
00:03:01
Speaker 3: Okay. And a good portion of them are actually here in the US, a good portion of them, UK and so on. And those data breaches contain our personal information, names, addresses, phone numbers, email addresses, account numbers, and many passwords. So if you do your own research, you'd find that there's probably about 300 billion of our records on the dark web, 300 billion with a B. And of those 300 billion records, about 25 billion of them are actually passwords. And so bad actors, they're not necessarily hacking. They just log in. And once they log in, they own you. If they have access to your email, that's where they can do the absolute most amount of damage. So the idea is do the basic things like never using the same passcode twice ever.
00:03:54
Speaker 2: Meaning for different applications.
00:03:56
Speaker 4: Yeah.
00:03:57
Speaker 3: So for example, like you have a different passcode for Gmail as you do for Facebook, a different passcode for eBay as you do for Amazon and so on. Never using the same passcode twice. And people say, well, how do you remember them? Well, you don't remember them. I don't remember them.
00:04:10
Speaker 1: At all.
00:04:11
Speaker 2: Of course, you don't remember.
00:04:12
Speaker 3: The password manager that you have, which you should have a password manager, remembers your passwords for you. Then people say, well, what if the password manager gets hacked? I'm not worried about that. I've had a password manager since 2004, and I'm good. If you use a password manager... They use bank-level military-grade encryption, and you should be fine.
00:04:30
Speaker 2: Okay.
00:04:30
Speaker 3: Explain to the folks what a password manager is. So it's a software, you know, like any other software. Generally, when you download it, you install it, it plugs into your browser, Safari, Chrome, Edge, and so forth. So it's like a little icon up there. When you log into a website, when you go to a website, the password manager will pop up and say, hey, you want us to enter the passcode? And you click a button, and it enters the username and passcode in for you. And or you can use the password manager to actually get to that website. So it's really a time and efficiency and privacy and security.
00:05:03
Speaker 2: It's great. I think password manager was an app where you have all the passwords and you go to it, you put in a master password and it has all your usernames and passwords. Is that different?
00:05:13
Speaker 3: You said it better than me.
00:05:15
Speaker 2: Is it better?
00:05:16
Speaker 3: That is correct. That is correct. That is what a password manager is.
00:05:19
Speaker 4: Okay.
00:05:19
Speaker 1: Yeah, yeah.
00:05:20
Speaker 2: Here's a question. A lot of times when you're logging into something, a thing pops up that says, save password for this device. And it says, always, never, and something else. Is it bad to save the password for that device?
00:05:33
Speaker 3: Well, it all depends on the device that you're on. So generally, like if you're on your own device, your own laptop, your own desktop, versus like the library computer, you know, which people still do. Generally, the answer is yes, it's okay to do that. Honestly, I don't do that the majority of the time. I let my password manager log in pretty much every time with the exception of like Amazon and Google.
00:05:58
Speaker 4: Huh.
00:05:59
Speaker 2: So can bad actors get into your computer and find the saved password?
00:06:05
Speaker 3: So I'm not so worried about them getting into my computer or your computer, unless like right now, if you're in a windows machine, you are supposed to be on windows 11, you know, windows 11 is the latest, greatest operating system, the most secure operating system that they currently offer. If you're in like Windows 8, well, you're extremely vulnerable. It's like you're driving a Pinto with bald tires. You know what I mean? So as long as you're like on the latest updated version of Windows or the latest updated version of Mac, so the latest hardware, the latest software, generally you should be in pretty good shape maintaining updates for your browser, updates for your operating system. Like these are the basic one-on-one things.
00:06:44
Speaker 4: Okay.
00:06:44
Speaker 3: And as long as you're updated, generally you should be fine. And a hacker was going to have a harder time getting on your machine. Okay.
00:06:52
Speaker 2: And I mean, I have random questions that don't have necessarily chronological order. Is it more dangerous? I wrote them down as I thought of them. Is it more dangerous to use a banking mobile app on your phone than it is to do your online banking at your desktop at home?
00:07:12
Speaker 3: So I do both frequently. And I would say that like they're both equally secure and and equally have the same vulnerabilities. The vulnerabilities are, of course, like if your mobile phone, let's say, is not password protected, and you'd be surprised how many millions of people do not password protect their mobile phone. If your mobile phone is not password protected, and it's lost or worse, stolen, what do they have access to?
00:07:40
Speaker 2: Everything.
00:07:40
Speaker 3: Everything, okay? So that's what the vulnerability is. That's truly what the vulnerability is.
00:07:46
Speaker 2: Just the other day, the phone asked me, how long before it shuts off if it's inactive? I think the default might have been five minutes. I switched it to two minutes. Is that a good plan?
00:07:58
Speaker 3: Yeah, two minutes or one minute. One minute might not be enough time. Like I just used Apple Pay. Because if somebody finds it and it's open, they can keep it open just by keeping it active. That's correct. Or they could go right into it and they could shut off the.
00:08:14
Speaker 2: Timer.
00:08:15
Speaker 3: So two minutes generally is fine for functionality purposes. One minute is better.
00:08:20
Speaker 2: One minute. All right, I'm changing it because I'm all about that. Back to the email hack. How can that hurt you? What are all the ways that the email hack can hurt you?
00:08:32
Speaker 3: So bad actors say if you own the person's email, you own the person. And truly, your email is the epicenter of everything. So for example, like with your email, if you need to reset your passcode, say for your Bank of America account, What's going to happen when that occurs? You're going to get an email to reset that passcode.
00:08:54
Speaker 2: And the bad actor does it.
00:08:55
Speaker 3: If he's inside of your email and he goes to reset your passcode for Bank of America, he gets the password reset via your email and he could do a lot of damage. So the most important tool that you need to protect is your actual email. And that means not using the same passcode for Gmail, let's say, as you do for Facebook, making sure you have two-factor authentication enabled for Gmail or whatever tool you use. And generally you should be in pretty good shape.
00:09:20
Speaker 2: Explain what two factor authentication is.
00:09:22
Speaker 3: So every time you log in, say to PayPal, right? You should be getting a one-time text message so that you not only log in with your username, which is often your email address and then your passcode, whatever that might be. Then you get a text message with a six digit code. That six digit code is that second factor, your phone being the second factor as well.
00:09:44
Speaker 2: So if you have two factor authentication engaged, Just having your password is useless to the bad actor, right? That's correct.
00:09:54
Speaker 3: So what the two-factor authentication does is it can make the password useless to the thief, even if they have access to it. access to your password.
00:10:01
Speaker 2: You got to have that, folks. You may think that it's a hassle. It's not. You used to have to go to the bank. That could have taken you a half an hour to an hour. So don't sweat the 30 seconds it takes to authenticate through a second device. What happens is... You try to log in, you put your password in, and then it will say, go to your phone and type in the code that we're sending there, or your email, and then it's a life, trust me, it's a lifesaver. There are other kinds of even more robust, I don't get to say the word robust very often, robust two-factor authentications. What about third-party apps like any third-party app.
00:10:53
Speaker 3: Like Authenticator?
00:10:54
Speaker 2: Yes.
00:10:55
Speaker 3: I can think Google offers Authenticator or Microsoft. One of them has one or the other. I personally don't use them myself, not because there's anything wrong with them, but I just prefer the two-factor authentication via my phone. It just streamlines things a little.
00:11:09
Speaker 2: Bit for me. Is the third-party one a little safer?
00:11:13
Speaker 3: Yes, it actually is a little bit safer.
00:11:14
Speaker 2: Okay. Now, what about the hardware... authentication device.
00:11:22
Speaker 3: So like something like a YubiKey. It's spelled Y-U-B-I-A-Key. YubiKey is one option.
00:11:29
Speaker 2: It's like a USB.
00:11:30
Speaker 3: It's like a USB. Those are fantastic. Obviously, if you lose it, you know, that could be problematic.
00:11:36
Speaker 2: We'll find out what makes them better after this on WBZ.
00:11:41
Speaker 1: You're on Nightside with Dan Ray on WBZ, Boston's news radio.
00:11:46
Speaker 2: All right, we're trying to save your life savings here. We have Robert Siciliano, who is a cybersecurity expert and is very valuable information. You should really have a pen and a paper. You're still never going to remember it. So you really do probably want to listen to this hour again, this hour of Night Sight. Go to NightSightOnDemand.com to go through this, as they say, with a fine-tooth comb. So we were talking about two-factor authentication, which, if you just joined us, is when, say, you try to log into something and use your password. You can't directly log in. You will be prompted to go to another device, your phone, if you're on your laptop. And they will send you a code over there, and you type it in. I love that. It just makes me feel– it can save the day. But there are different kinds of this 2FA is what it's called, the second two-party authentication, two-factor authentication. There's one where you have a hardware device. It's like a little USB. And it's said to be even more secure– How does it work and why is it more secure?
00:12:53
Speaker 3: So it offers the same security as, say, a one-time text message in regards to access. The vulnerability with the mobile phone or the app for two-factor authentication is what we call a man-in-the-middle attack. In other words, if somebody calls you posing as, say, your bank, and they say, you just received a text message for two-factor authentication. We need to reset your account. And you give them that second factor over the phone, there's the vulnerability. You've just been scammed. So the vulnerability is truly you, the human, our want and need to trust each other.
00:13:32
Speaker 2: And so this hardware thing, yes. Sorry, go ahead.
00:13:34
Speaker 3: Whereas the key, you have to physically hand it to somebody. And that's a whole different scenario.
00:13:39
Speaker 2: How do you mean hand it?
00:13:40
Speaker 3: Like literally that key is used to actually plug into the machine.
00:13:44
Speaker 4: Right.
00:13:45
Speaker 3: And that's the second factor versus, you know, plugging in a code that you'd get via your phone that you could be scammed over the phone or via email to give out to somebody.
00:13:54
Speaker 1: Right.
00:13:55
Speaker 2: Okay. By the way, we haven't spoken about your book. All this is in your book become a strategic human firewall, right?
00:14:02
Speaker 1: Yeah.
00:14:02
Speaker 3: Just check me out on Amazon. Just search for Robert Siciliano.
00:14:06
Speaker 4: Okay.
00:14:07
Speaker 2: And everything I'm talking about is in the book because I'm going to get the book.
00:14:12
Speaker 4: Yeah.
00:14:12
Speaker 1: Yeah.
00:14:12
Speaker 2: Because that way I can use that as a reference, right? I would have brought you one. Yes, of course. Yeah, you could have brought me one. That's right. That's right. I'll buy one. I'm happy to buy one. Let me check my notes here. What's next? Interesting. I mentioned to you earlier that I've been experimenting. I feel that I'm being swallowed up by the cyberverse in every way. Like I'm even now, or I was, even purchasing stuff from vending machines with a card. And I'm not real comfortable with that. For one thing, I hate getting that list of stuff I bought at the end of the month. It's so big, I can't even look at it. I can't check it to see if there are any bad purchases there because there's so many. And you get the name of the parent company. So if it's your gym, it doesn't say your gym. It says company ABC. And you say company ABC gym. Who's that? Who's that? So you do that to a couple of things and you give up and you just trust them. And I hate that.
00:15:15
Speaker 3: So when the merchant status, when the name of the merchant and the credit card receipt doesn't match up with the building or the restaurant or the store, that can be frustrating.
00:15:23
Speaker 2: Oh, yeah.
00:15:23
Speaker 3: So the best way to manage that, and I don't necessarily worry about credit card fraud. I use credit cards for everything. I actually don't use cash all that often, but I do still use cash, of course. As long as you set up what's called push notifications. So that means every single time you charge your card over the phone, via an app, online, you swipe at point of sale, in person. You get a text message or an email or a pop-up on your device. You get real-time notifications of those charges as they occur. That way, you are fully in tune in real-time with your activity.
00:16:01
Speaker 2: So is the text different than push notification? In one case, you go into your text app. In another one, it just pops up on the phone. Or is it the same thing?
00:16:11
Speaker 3: So actually, with each card... whether it's American Express or a visa from Marriott or a MasterCard with Hyatt, whatever the case is, every card issuer, every bank, they have their own methodology. Some, it's a text message. Some, it's a pop-up. Some, it's a different notification entirely. So You sometimes can choose, but in general, it's default what they offer. And so I'm getting dinged and popped ups all day, every day. And I'm okay with that because I want to know in real time.
00:16:48
Speaker 2: All right. Let's bring back the scenario of you get your Gmail hacked. They get your password. It seems to me that once the bad actors have gotten into your Gmail, your Google world that as long as they don't log out, they're in for as long as they want to be and can do cause you harm for ad infinitum time. Even if you change your password, it's only if they log out, they won't be able to get back in because you change your password. Uh, it seems like a very bad thing that they're in there forever. What can you do? Well, two things.
00:17:30
Speaker 3: If you, if you, once they get in, once they're in, uh, Generally, Google, let's say, is going to log out every device usually after 30 days anyways.
00:17:43
Speaker 2: I didn't realize that. I did some research and it said it was forever, but that's not the case?
00:17:49
Speaker 3: Well, it all depends on your security settings. So generally, Google is going to log you out after about 30 days, then you're going to have to log back in, generally. Can you set that?
00:17:58
Speaker 2: Why couldn't you set it for like a week or 24 hours?
00:18:01
Speaker 3: So sometimes it can be, you know, every, it could be 20 minutes depending on your settings.
00:18:06
Speaker 2: Where do you go to set that?
00:18:08
Speaker 3: Google it.
00:18:10
Speaker 2: I'll Safari it.
00:18:12
Speaker 1: Okay.
00:18:12
Speaker 2: I'll chat GPT it.
00:18:14
Speaker 3: There's a few different options. I know with my system, I'm logged out every 30 days. And that means that I have to, you know, reestablish myself, have it re-recognize my device.
00:18:24
Speaker 2: That's fine.
00:18:24
Speaker 3: And re-engage two-factor authentication.
00:18:26
Speaker 2: All right.
00:18:27
Speaker 3: But what that also means is if anybody else has my passcode and if they try to log in from their device, I'm going to get that second factor authentication. I'm going to get notifications. So they're not going to be able to get in because they don't have my phone. That being said, as long as you have that two-factor authentication, in most cases, you should be in pretty good shape.
00:18:44
Speaker 2: This is complicated, isn't it, folks? There are a lot of folks out there that don't have a computer. And, you know, we give them a hard time. But they're at home saying, see, I was right. You shouldn't have a computer. The thing is, folks, the world is forcing you to have a computer. Like to do my taxes. There's an app. I got a tax guy. Most tax people, you got to do some of this stuff. And to get paid for various things, you got to really– It's tough to get through life without all this now.
00:19:21
Speaker 3: Yeah, that's where we're at right now. Look, I'd be perfectly fine if there was no internet, if there was no mobile phones. I came here tonight on an 87 Harley that does not have a single piece of digital technology in it. It is just motor and metal.
00:19:34
Speaker 4: Right.
00:19:35
Speaker 2: I have a friend who's got a 2010 Challenger Red, and they need a new car. They don't want to get one because they don't want it packed with spyware.
00:19:45
Speaker 3: A computer, yeah, yeah.
00:19:46
Speaker 2: I'll be glad when they go back to knobs. Hopefully the car buying public is tired of that irritating screen. But we have limited time, so I should stay on topic here. So one can, this is really important, one can go into their Google settings and set how the amount of time that Google can stay open without auto shutting down. I would set it for 24 hours.
00:20:17
Speaker 3: I'm not 100% sure of that. I'm not 100% sure of that. I would search it out. It's been a while since I researched that. And Google continually changes the way that they do things. So like, for example, you know how you log into Facebook and everything's all moved around every so often?
00:20:33
Speaker 2: Yeah.
00:20:34
Speaker 3: Google has been doing that over the years too. So that may have changed. I would just go into security settings. I wouldn't necessarily worry about how quickly you're going to be logged out. And the main thing, the most important.
00:20:45
Speaker 2: Don't worry about the bad actor being able to be in there forever or for a month.
00:20:49
Speaker 3: As long as you're changing.
00:20:51
Speaker 2: Even after I've changed my password because he's already in.
00:20:54
Speaker 3: Google is not okay with a bad actor being on your device from a location that Google doesn't recognize the internet protocol address. They don't recognize your... Your device. Google's not okay with that.
00:21:07
Speaker 2: They might kick them off?
00:21:08
Speaker 3: They're going to kick them off.
00:21:09
Speaker 1: Oh. Yeah.
00:21:10
Speaker 3: In most cases, they will.
00:21:11
Speaker 2: I wish they would tell me that.
00:21:14
Speaker 3: So they know enough today that if somebody is logging into your machine from an IP address that Google is not familiar with where you generally operate.
00:21:25
Speaker 2: For some reason, I'm here one minute and I'm in Ohio 30 seconds later. Correct. They're going to know.
00:21:32
Speaker 3: It's come to the point where they're actually bumping you out of your own account more often than you might want to.
00:21:39
Speaker 2: Okay.
00:21:39
Speaker 3: So they're getting a little over the top in that regard, but that's not necessarily a bad thing.
00:21:45
Speaker 2: Okay. Well, time flies. It's time for another quick break, and we'll continue with the author of Strategic Human Firewall. That's not the whole title, is it? What's the actual whole title?
00:21:59
Speaker 3: The Strategic Human Firewall is what I aim for everybody.
00:22:02
Speaker 2: Okay. The Strategic Human Firewall. You're getting a little taste of all the stuff you need to know that's in this book. More with Robert in a moment on BZ.
00:22:11
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:22:16
Speaker 2: Here we go. We're continuing with Robert Cisleano, and he's the author of the book, the strategic human firewall. And he wants you to be a strategic human firewall because in this cyber world we live in, you are vulnerable. If you don't keep up, if you don't keep up, you're going to have a problem. If we can't recap everything we've done so far, we'll just continue. We hear about VPNs. You use a VPN, right? Yeah.
00:22:45
Speaker 3: On my mobile phone and my laptop, like I'm at the airport or a hotel, I'm at the resort. I log in to my VPN so that it encrypts my information over the free wireless network.
00:22:57
Speaker 2: Okay, so a VPN is a virtual private network?
00:23:01
Speaker 3: Exactly.
00:23:01
Speaker 2: Okay. And so what does it do and what does it not do? If you use a VPN, does that mean that bad actors can't get your passwords and stuff?
00:23:12
Speaker 3: It means if you are on a free wireless network, like Logan Airport, let's say, That is being used by hundreds, thousands of people. There's tools that somebody could deploy that can sniff out your data as it's traveling through the air. They call it Wi-Fi packets. The science behind this, and that science basically says that they can install hardware and software to literally sniff out that data and capture it. They can see what you're communicating, what you're transmitting on that free Wi-Fi network that is unencrypted. What the VPN does is it encrypts your information over that unencrypted network, plain and simple.
00:23:56
Speaker 2: So it's not going to help you that much if you're at home?
00:23:58
Speaker 3: Well, it could help you at home, too, if you're on unprotected Wi-Fi at home, sure.
00:24:05
Speaker 2: So if you're not, unless you're on some unprotected Wi-Fi, it doesn't help you?
00:24:11
Speaker 3: You don't necessarily need it.
00:24:12
Speaker 4: Okay.
00:24:15
Speaker 2: I was, you know, in anticipation of your day here, and I've been paying attention to things more carefully, I looked at my browsing history and realized, well, if someone gets my Google password and I'm using Google Chrome, maybe they can see everywhere I've been. Or maybe this is just on this machine. They can't see into this machine. I never know what's local and what's network, what they can get at and what they can't. Also, I noticed that Passwords get saved. When the machine asks you, do you want to save this password? And you say, yes, it saves it. If somebody gets into your Google world, can they see those passwords on your machine?
00:25:02
Speaker 3: So access to Google's servers versus access to your machine are two different things, locally versus virtually. I know that as long as you have updated hardware, updated software, updated browser, change your passcodes, have antivirus. You do these basic things, you're generally in good shape. Can they see your passcodes at Google? It's going to be hard. It's hard to hack Google. Google's just a behemoth that has the best security in the world. The vulnerability is not Google. The vulnerability is you. It's us.
00:25:36
Speaker 2: It's me. It's the human. It's our want and need.
00:25:38
Speaker 3: To trust each other. and us being scammed over the phone via email or text message. That's where the true vulnerability is.
00:25:49
Speaker 2: So basically, you don't have to worry about a bad actor getting into your Google world and getting into your machine and seeing stuff that's locally on the machine. You don't need to worry about them seeing your history or your passwords.
00:25:59
Speaker 3: I would not be so concerned about that as long as updated hardware, software, browser, changing passcodes, two-factor.
00:26:06
Speaker 2: Seems like you're leaving a little concern there.
00:26:10
Speaker 3: So look it. I got a phone call from Google Security.
00:26:13
Speaker 2: Two weeks ago.
00:26:13
Speaker 4: Oh, good.
00:26:13
Speaker 2: This is a good story.
00:26:14
Speaker 3: Two weeks ago, I got a call. On my caller ID, it said Google Security.
00:26:18
Speaker 4: Yeah.
00:26:18
Speaker 2: All right.
00:26:19
Speaker 3: Hello, Mr.
00:26:20
Speaker 2: Siciliano.
00:26:21
Speaker 3: This is Google Security. I'm like, yeah, I know. I'm looking at the caller ID. They're like, yes, is your phone number? And I'm like, yeah, you just called it. And is this your email address? I'm like, yes, that's my email address. And they said, by any chance, are you in Montreal, Canada? I'm like, no, I'm in Boston. They were like, well, we have reason to believe that somebody in Montreal, Canada is trying to log into your account right now. And I'm like, really? And I'm saying to myself, is this Google Security? because I don't think Google security will ever call anybody. And so now I'm kind of like.
00:26:49
Speaker 2: Yeah, there's no such thing, right? Well, there is, but I mean, people calling you, right?
00:26:54
Speaker 3: Google security is not going to call anybody. And so I'm kind of playing along with them, but at the same time, I'm checking my own accounts as I'm talking to them, to make sure that everything was secure.
00:27:04
Speaker 4: Right.
00:27:05
Speaker 3: And as I'm having a conversation with this person, he's telling me more about me, where I live, my address, my phone number, my email address. He had, enough information about me to con Vince me that they were Google. And in that process, he said, okay, so all we really need to do is reset your account to keep whoever is trying to get into your account out. I said, well, what does that process entail? He says, well, we're going to send you a one-time text message that you, all you have to do is click yes. And it's going to reset your account.
00:27:39
Speaker 2: So did, were you, were you wise to them yet at this point?
00:27:44
Speaker 3: Well, not a hundred percent.
00:27:45
Speaker 2: Wow.
00:27:46
Speaker 4: Because.
00:27:46
Speaker 2: And you're a super professional.
00:27:48
Speaker 3: Because they were really good at what they do.
00:27:50
Speaker 4: Yeah.
00:27:51
Speaker 2: Okay.
00:27:51
Speaker 3: But like, I know that Google doesn't generally call people and my account was secure and I am, this is what I do for a living, but I still want to trust other humans. And the person that I was speaking to was really good at what they did. And I said, listen, I'm not quite sure what's going on here. Can you at least send me like a case ID from Google? He's like, hold, please. Two seconds later, I get an email from Google. It was from Google with my case ID. It was perfect.
00:28:25
Speaker 2: So it looked like it wasn't really from Google.
00:28:27
Speaker 3: It was from Google. Yes, it was from Google. And I went right into the source code. And AI, Gemini's AI told me, yes, this email is from Google.
00:28:39
Speaker 4: Yeah.
00:28:40
Speaker 3: Everything about the, but it was forwarded through a different server. They manipulated a few different things. And in that process, I'm like, okay, can I speak to a supervisor, please? And the supervisor gets on the phone and repeated every single thing that this guy said to me. He's like, sir, at Google security, we take our client's security seriously. He says, if you don't reset this account, we can't guarantee that they're not going to get access to your account. So I go, I said, send me the text message. And they sent me the text message. And that was the moment of truth. I'm looking at a text message from Google that said, to reset your account, click yes. If you don't agree with this, click no. I was like.
00:29:22
Speaker 2: You had to decide.
00:29:23
Speaker 3: I had to decide. And I clicked no.
00:29:26
Speaker 4: Okay.
00:29:27
Speaker 2: And they were not legit, but they somehow routed their thing through Google.
00:29:32
Speaker 4: Yes.
00:29:33
Speaker 2: Oh, my God. So there's no hope. No, no, no.
00:29:35
Speaker 3: There's plenty of hope.
00:29:36
Speaker 2: Oh, God.
00:29:37
Speaker 3: But here's the deal. I don't know if my dad... would have survived that scam. I know my wife wouldn't. I'm not sure if my kids would have. I don't know that a lot of my clients would. Because it really took every ounce of my energy and strength to not click yes. The problem that night was I couldn't sleep. I was upset the rest of the day.
00:30:01
Speaker 2: Yes.
00:30:01
Speaker 3: I was upset the rest of the day.
00:30:02
Speaker 2: You still didn't know if you'd made a mistake by saying no.
00:30:05
Speaker 3: No, that's not it. I was upset that I came that close.
00:30:09
Speaker 2: Oh yeah. Okay.
00:30:10
Speaker 3: I came that close. This is what I do for a living.
00:30:13
Speaker 1: Okay.
00:30:14
Speaker 3: And it's because they, their technology was so perfect and they, they, they're, they checked my checks and balances. They had an answer for everything. And so as a result of that, like, I present that exact same scenario in my audiences, and I have screenshots of everything. You could see everything.
00:30:33
Speaker 2: It's part of your keynote speeches.
00:30:37
Speaker 4: Yeah.
00:30:37
Speaker 3: And I show everybody the source code and everything. Like, it was perfect. And the point of all of this is, like, as long as you're paying attention, as long as you know that, lookit, Google's not going to call you.
00:30:48
Speaker 2: You paid attention, and you almost got busted.
00:30:51
Speaker 3: I did. But I also didn't.
00:30:54
Speaker 4: Yeah. Yeah.
00:30:55
Speaker 2: I didn't.
00:30:56
Speaker 4: I know.
00:30:57
Speaker 3: And the lesson is Google is not going to call you. Bank of America, if they call you, call them back at a number that you know is legitimate.
00:31:05
Speaker 2: Yeah.
00:31:05
Speaker 3: PayPal's not going to call you. Best Buy's not going to call you. These companies are not going to pick up the phone and just call you and say, hey, we have reason to believe. They're just not going to do that. So as long as your BS radar is up, you should be fine.
00:31:20
Speaker 2: Yeah, I don't know. Yeah.
00:31:22
Speaker 3: Hey, I am an optimist.
00:31:25
Speaker 2: It was just luck. It was a flip of the coin with you pressing no.
00:31:29
Speaker 3: It wasn't a flip of the coin. It went against everything that I speak to.
00:31:33
Speaker 2: Yeah. It seems like the only way to survive is just say no, no, no, no, no, except I mentioned to you earlier, my bank actually tried to get in touch with me with something that I thought looked phony. And so I called them up and said, this looks phony. You really got to do it. And they said, yes, it's legit. But I even worry about Trying to find the phone number, Googling whatever customer service phone number and have a phony one pop up, a phony phone number.
00:32:01
Speaker 3: That's possible.
00:32:02
Speaker 2: One time I had checked an airline fare to Jerusalem. And then I said, all right, I'm going to buy it. So I Googled again, LL Airlines, and clicked on what to me was LL Airlines. Bought the ticket and only after purchasing the ticket– I found out it wasn't LL Airlines. It was some third-party seller. It was still– I think I paid her way too much. Yeah, that's possible.
00:32:32
Speaker 3: I've done stuff like that before.
00:32:33
Speaker 2: I did have really good– I think we all have. I had good seats, but it is such a minefield. We have Rick and Bill Ricker who has got some input here. We'll continue with Robert Cicilliano, author of Strategic Human Firewall, B1, after this on WBZ.
00:32:51
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:32:56
Speaker 2: We continue with Robert Siciliano, author of Strategic Human Firewall, How to Protect Yourself from Bad Actors on the Internet. By the way, Robert does keynote speeches. He's really good at it. And if you are in charge of or if you work at a company you think could benefit from this firewall wisdom, how do they contact you? I want to make sure this is worth your while today.
00:33:22
Speaker 3: I am online at protectnowllc.com. Again, that's protectnowllc.com.
00:33:28
Speaker 2: Protect Now, LLC. If you don't write it down, remember, there's always nightsideondemand.com. You'll listen through. You can scroll. I think you can probably scroll ahead to this point. Let's quickly go to Rick and Bill Ricker. Then we're going to find out about pig butchering, which is something you don't want. Okay, hi, Rick. Hey, Bradley.
00:33:52
Speaker 4: Hey, Robert, I requested you. Thank you.
00:33:56
Speaker 2: Oh, that was you. I'll make it.
00:33:59
Speaker 4: Well, I mean, I'm sure Bradley would have had you on at some point, but I really pushed it. I just want to say quickly, last November you were on. I remember you talking about how overseas, like, these guys can, like, pimp girls to either in the sex trade or to get money out of somebody overseas. Remember you were talking about that and how they use legitimate platforms and they'll stick with you and show you how to make money in the stock market, but it's all fake.
00:34:27
Speaker 2: We're going to talk about that exact thing coming up.
00:34:29
Speaker 1: Okay.
00:34:30
Speaker 3: That is pig butchery.
00:34:31
Speaker 1: Yeah.
00:34:32
Speaker 2: Oh, okay.
00:34:33
Speaker 3: That's pig butchery.
00:34:34
Speaker 4: I will just say this because I'm on the air now. My friend lost everything. He lost all of his retirement. He got involved in a situation like that, lost everything. And when I told him about it, because I told you I'm going to tell him, it was hard for me to explain to him. But he already knew. He was like, what do you want me to do? I'm sick. I'm going in for an operation. He went in for an operation a little bit later and died of COVID at the hospital. He couldn't even pay his rent anymore. And this guy was a smart guy. And he was a dear pal. He was only 74 years old. I was friends with him 28 years. And it was all because he got suckered in to exactly what you guys will talk about. So.
00:35:15
Speaker 2: That's a sad, sad story.
00:35:17
Speaker 4: I know.
00:35:18
Speaker 2: I know, Bradley.
00:35:19
Speaker 4: He lives right down the street from the Paradise. Saw some great shows with him. I'll tell you another time about that.
00:35:24
Speaker 1: But he was a great pal.
00:35:26
Speaker 2: But you're going to talk about pig butchering.
00:35:28
Speaker 4: And, Robert, you're a blessing to the greater community and anyone that's listening. And everyone just, period. Because you could help them from, yeah, from losing everything.
00:35:41
Speaker 2: You can help.
00:35:42
Speaker 4: I'll let you guys go.
00:35:43
Speaker 2: I'm tight on time here. I want to make sure we get the pig. Thank you. Okay, Robert, you're going to give the detailed version of that. The sad, sad story. You got the end game of that. We'll find out how that happened right now. Go ahead.
00:35:56
Speaker 3: So real quick, like every single time you get those wrong number text messages, You know, hey, Robert, we're supposed to meet for lunch tomorrow. You're like, who's this? And the moment you respond with who's this, you're already going down the rabbit hole.
00:36:08
Speaker 2: Other ones are, hey, are you still okay? I haven't heard from you in a while.
00:36:13
Speaker 3: Exactly.
00:36:13
Speaker 2: And you're supposed to go, do I know you? Or something like that.
00:36:19
Speaker 3: 100% of the time, there is a human on the other end of that text message, generally who is a victim of human trafficking. hold up somewhere in Southeast Asia on a compound that there might be, you know, a couple thousand of those same people being held against their will. And all day, every day, they're sending out text messages and they have a script. And once you react, once you respond, they're like, oh, hey, hi, my name is Isla. And they send a picture of this like pretty girl. And then the dialogue begins.
00:36:51
Speaker 2: Humans are so awful, aren't they?
00:36:53
Speaker 3: Well, the awful humans are.
00:36:54
Speaker 2: Give them half a chance and they're just the worst.
00:36:56
Speaker 3: The sociopaths and the psychopaths and the hardcore narcissists are awful. But what most people don't realize is that as much as 25% of all of humanity wakes up every day a little lonely.
00:37:08
Speaker 4: Yeah.
00:37:08
Speaker 3: And it's that loneliness that compels us to react and respond to these text messages. And the criminals know that if they can get somebody on the line that's a little lonely, that if they communicate with that person 6, 8, 10, 12 times a day, good morning, dear, how did you sleep last night?
00:37:23
Speaker 1: I know.
00:37:24
Speaker 3: Good afternoon, dear. I'm having lunch. What are you having today? Good night, dear. I hope you sleep well.
00:37:29
Speaker 2: You're better off, uh, befriending chat GPT. Right.
00:37:33
Speaker 3: And that happens like all day, every day when you're communicating with them, what happens to your loneliness after a week?
00:37:39
Speaker 2: In a, in a, like 60 seconds, uh, go through what happens. Uh, and, uh, What they'll try to do to you and when.
00:37:48
Speaker 3: Once you are in their web, within a week or two, they're going to get you on a WhatsApp video call, which I've been on WhatsApp video call with these scammers, with the victims of the human trafficking. And usually it's like a young female. And she is saying, hey, you know, like I've been investing in crypto, making 80% on my return returns.
00:38:07
Speaker 2: And they say this offhandedly, like it's no big deal.
00:38:10
Speaker 3: Like it's no big deal.
00:38:11
Speaker 2: Your interest... is peaked.
00:38:13
Speaker 1: Yeah.
00:38:13
Speaker 2: And you say, what?
00:38:14
Speaker 4: Ooh.
00:38:14
Speaker 3: And you are already intertwined with this person. You already trust them. You're already like, you know, having a hard time sleeping every night because you're thinking about them all the time because they're infiltrating your whole mind and body. And once they say crypto, you're like, sign me up because I'll do whatever you say. That's how that works. It's unfortunate.
00:38:32
Speaker 4: Yeah.
00:38:32
Speaker 2: I feel, you know, and we're all going, I would never do that. But there's a lot of stuff you, you get, suckered into online. And you just, you just don't know because they're experts.
00:38:47
Speaker 3: This is why you want to become a strategic human firewall head on a swivel.
00:38:51
Speaker 2: And that's why you want to buy the book. And that's why you want to have Robert as your keynote speaker. We've got 30 seconds to give me the, how to get in touch with you again.
00:39:01
Speaker 3: I'm online at protect now, LLC.com again, protect now, LLC.com or just Google Robert Siciliano. If you can spell it.
00:39:09
Speaker 2: Okay, Robert's taking off now on his motorbike. Be very careful out there.
00:39:14
Speaker 1: I will.
00:39:15
Speaker 2: It's dangerous. It's a dangerous world now. We have Michael Coyne checking in with us next to talk about the dramatic day in the Clancy trial.
