1
00:00:00,020 -->
00:00:02,380
Anytime there's something global, anytime there's something big,
2
00:00:02,580 -->
00:00:05,140
anytime that something is on every single person's mind,
3
00:00:05,480 -->
00:00:07,600
scammers are out there trying to make money off of it.
4
00:00:09,140 -->
00:00:12,500
Right now, tens of thousands of fake World Cup websites are out there
5
00:00:12,730 -->
00:00:14,220
hunting for fans who are vulnerable.
6
00:00:14,500 -->
00:00:17,540
And my guest's team today is the one who found them.
7
00:00:17,860 -->
00:00:20,060
But that's not really what the episode's fully about
8
00:00:20,240 -->
00:00:23,920
because that same scam playbook really hits any major event
9
00:00:23,970 -->
00:00:26,640
and is a recurring pattern anytime there's something big.
10
00:00:26,880 -->
00:00:29,980
He also spent years fighting government surveillance at the EFF
11
00:00:30,000 -->
00:00:35,020
just watched a law reauthorized every six years for decades quietly fail to renew.
12
00:00:35,280 -->
00:00:37,720
By the end, you'll know how to spot a scam before you click,
13
00:00:38,000 -->
00:00:41,760
how it might be almost similar to bad marketing for some organizations,
14
00:00:42,080 -->
00:00:43,680
and how to spot the difference between those,
15
00:00:44,000 -->
00:00:48,140
and overall privacy and security advice that's especially shareable with friends and family.
16
00:00:48,360 -->
00:00:52,300
I also want to apologize as David's camera had some kind of flickering issue,
17
00:00:52,680 -->
00:00:54,740
so if you're a video listener, you might see some of that,
18
00:00:54,940 -->
00:00:58,220
but hopefully the audio is still good and you get all the value you need from this interview.
19
00:00:58,480 -->
00:00:59,040
Let's get into it.
20
00:00:59,360 -->
00:00:59,800
Welcome, David.
21
00:00:59,880 -->
00:01:03,720
from Mauerbyte. It's awesome to have you here. And I know we've been going back and forth for
22
00:01:03,860 -->
00:01:07,420
a while. And so I'm really excited to finally bring you on. Thank you. Yeah. Thanks so much
23
00:01:07,420 -->
00:01:11,540
for having me here. Thanks for carving out the time. I am thrilled to be here. Like I've said
24
00:01:11,740 -->
00:01:14,980
before, I run a podcast and so it is extremely cool to be
25
00:01:15,840 -->
00:01:19,560
it does that. I hate it. Look, we're off to a bad start with
26
00:01:19,760 -->
00:01:23,580
AI generated emojis. But I am very, very excited to be here.
27
00:01:24,040 -->
00:01:27,760
Very, very happy. Yeah. That feature is really annoying. Yeah. For audio listeners, we had the
28
00:01:27,780 -->
00:01:29,600
The macOS emojis come up there.
29
00:01:31,180 -->
00:01:33,100
So I want to hear about your history first
30
00:01:33,290 -->
00:01:35,980
before we dive into the weeds on the World Cup,
31
00:01:36,350 -->
00:01:37,720
the scam economy of the World Cup.
32
00:01:37,900 -->
00:01:39,620
But I want to also zoom out of the World Cup
33
00:01:39,630 -->
00:01:42,180
because I think it's always whatever the next big event is
34
00:01:42,280 -->
00:01:43,880
that's targeted by malicious actors.
35
00:01:44,840 -->
00:01:46,440
I know you have some history in policy,
36
00:01:47,260 -->
00:01:48,020
stalkerware, et cetera.
37
00:01:48,170 -->
00:01:50,600
So I want to dive into a lot of these really good topics.
38
00:01:50,790 -->
00:01:52,560
But I just want to ask about you and your history first
39
00:01:52,790 -->
00:01:54,160
and how you're at Malwarebytes,
40
00:01:54,190 -->
00:01:54,980
what you do for Malwarebytes,
41
00:01:55,120 -->
00:01:56,120
but also what you did before.
42
00:01:57,300 -->
00:02:21,420
Yeah, absolutely. So I actually got my career started just as a journalist, right? I was a legal affairs reporter working for different papers. So that is as simple as it sounds, covering trials, right? Covering lawsuits. Because I'm based in San Francisco, a lot of the stuff I was doing was covering like worker violation lawsuits against big tech, right? Things that were dealing with like Uber and like DoorDash, Lyft, all that kind of stuff where, you know, we were worried about like, are they employees? Are they contractors? All that kind of stuff.
43
00:02:21,860 -->
00:02:40,480
But during that time, while I'm covering the lawsuits that companies are facing, big tech is facing, Edward Snowden comes out and reveals the PRISM program, which is that the NSA was scooping up untold quantities of communications across the globe.
44
00:02:40,840 -->
00:03:00,640
And within those communications were Americans' communications. This program that's called Section 702, in trying to gather foreign intelligence, the NSA is also gathering messages that you and I could send to, you know, our friends who just simply live in another country. We are not suspected of a crime in that.
45
00:03:00,820 -->
00:03:11,140
However, when our communications get stored in these massive databases collected by the NSA, the FBI can actually go in there and read my messages without a warrant.
46
00:03:11,500 -->
00:03:14,100
We believe this is a flagrant violation of the Fourth Amendment, right?
47
00:03:14,420 -->
00:03:17,500
My information was collected even though I was not suspected of a crime.
48
00:03:17,740 -->
00:03:22,480
My information was read even though there was no warrant that was applied to access my information.
49
00:03:22,720 -->
00:03:24,460
And yet that's allowed as it stands right now.
50
00:03:24,520 -->
00:03:25,400
Like that is allowed.
51
00:03:26,380 -->
00:03:28,120
Our intelligence agencies do have that power.
52
00:03:28,380 -->
00:03:29,960
So I learned all about that.
53
00:03:30,020 -->
00:03:33,940
I became deeply interested in surveillance, deeply interested in government surveillance.
54
00:03:34,180 -->
00:03:35,780
I'm trying to fight against it, trying to limit it.
55
00:03:35,820 -->
00:03:39,860
And so I went to Electronic Frontier Foundation, which is a digital rights nonprofit.
56
00:03:40,860 -->
00:03:43,340
I spent a little bit of time there just doing exactly that, right?
57
00:03:43,860 -->
00:03:44,840
I would go to Congress.
58
00:03:45,220 -->
00:03:49,860
I would try to speak to Congress members, to senators, representatives, to their legislative
59
00:03:50,120 -->
00:03:52,720
directors, trying to limit NSA surveillance.
60
00:03:53,060 -->
00:03:58,080
There is a law that, you know, we've called it Section 702 here on the show already.
61
00:03:58,380 -->
00:04:02,640
There's a law that extends that and like it gets reauthorized every six years.
62
00:04:02,820 -->
00:04:04,880
And so when I was there, it was a reauthorization year.
63
00:04:05,120 -->
00:04:08,240
So I went to Congress and I said, this is wrong for these reasons.
64
00:04:08,760 -->
00:04:09,620
We want to limit it.
65
00:04:09,680 -->
00:04:10,600
We want to bring it back.
66
00:04:11,420 -->
00:04:18,340
If we're going to reauthorize Section 702, you know, that's a big, the way I think of it is like, if, if, if, I hope we don't, right?
67
00:04:18,459 -->
00:04:20,500
But if we do, can we get some warrant requirements?
68
00:04:20,940 -->
00:04:22,920
Can we limit the surveillance that captures Americans?
69
00:04:23,920 -->
00:04:24,900
Can we limit the remit?
70
00:04:25,100 -->
00:04:29,620
You know, we do know of violations that take place under Section 702.
71
00:04:29,800 -->
00:04:38,520
We do know of violations committed by the NSA and by the FBI because there's a secret court that actually publishes reports once in a while.
72
00:04:38,760 -->
00:04:40,800
We know it's too broad a law.
73
00:04:41,140 -->
00:04:41,580
We know this.
74
00:04:42,920 -->
00:04:44,000
We've tried to rein it in.
75
00:04:44,300 -->
00:04:47,260
When you fight the surveillance machine, I will be honest, they win a lot.
76
00:04:47,520 -->
00:04:49,520
They win most of the time.
77
00:04:50,080 -->
00:04:54,760
So I was there, again, just trying to limit surveillance in any way possible.
78
00:04:55,080 -->
00:04:56,200
And fun fact, this is kind of weird.
79
00:04:57,100 -->
00:04:59,940
Section 702, as of two weeks ago, has lapsed.
80
00:05:00,100 -->
00:05:01,200
They just didn't extend it.
81
00:05:02,220 -->
00:05:04,080
This happens all the time when I was there.
82
00:05:04,860 -->
00:05:06,060
It is really down to the wire.
83
00:05:06,320 -->
00:05:10,540
You know, you're following, like, house proceedings at midnight.
84
00:05:11,340 -->
00:05:12,980
And they're going like, well, it's going to lapse.
85
00:05:13,160 -->
00:05:14,020
It has lapsed.
86
00:05:14,080 -->
00:05:17,400
You know, we don't have this authority for two hours, three hours, four hours.
87
00:05:17,740 -->
00:05:20,160
But they always get it done.
88
00:05:20,800 -->
00:05:21,920
They always extend surveillance.
89
00:05:22,180 -->
00:05:23,520
This is the first time I've honestly seen it.
90
00:05:23,620 -->
00:05:25,900
I want to say here, I am shocked.
91
00:05:26,080 -->
00:05:26,920
This has never happened.
92
00:05:27,060 -->
00:05:28,220
I've never seen something like this.
93
00:05:28,600 -->
00:05:32,440
We just do not have a surveillance authority right now in the United States.
94
00:05:32,780 -->
00:05:34,300
Does that mean that surveillance isn't happening?
95
00:05:34,540 -->
00:05:35,080
Probably not.
96
00:05:36,500 -->
00:05:37,060
Probably not.
97
00:05:37,320 -->
00:05:39,080
There may be a retroactive law that is passed.
98
00:05:39,540 -->
00:05:40,560
There are tons of things.
99
00:05:40,600 -->
00:05:43,040
There are tons of machinations that Congress can conjure up.
100
00:05:43,360 -->
00:05:46,700
But right now, as it stands, Section 702 has lapsed.
101
00:05:46,960 -->
00:05:48,200
It is not in effect.
102
00:05:48,420 -->
00:05:51,440
That was a dream six or seven years ago when I was working.
103
00:05:51,860 -->
00:05:55,480
Now it feels like it's just a product of chaos, to be perfectly honest.
104
00:05:55,760 -->
00:05:57,380
So that's what I was doing.
105
00:05:57,470 -->
00:05:58,200
I came to Malarbytes.
106
00:05:58,400 -->
00:06:01,060
When you work at a digital rights nonprofit, you just fall in love with cybersecurity.
107
00:06:01,390 -->
00:06:02,520
You fall in love with online privacy.
108
00:06:03,280 -->
00:06:06,480
So I joined Malarbytes to do a lot of the same stuff.
109
00:06:06,880 -->
00:06:11,260
Write about privacy, advocate on privacy, get to learn a little bit more about cybersecurity.
110
00:06:11,640 -->
00:06:12,940
There's that whole other angle.
111
00:06:13,310 -->
00:06:14,780
I think they're deeply intertwined topics.
112
00:06:15,740 -->
00:06:20,520
And really, it is just to get a chance to make the Internet better for everyone.
113
00:06:20,780 -->
00:06:21,900
We just want to make it better online.
114
00:06:22,920 -->
00:06:23,520
That's what I'm trying to do.
115
00:06:24,880 -->
00:06:25,500
Yeah, really.
116
00:06:25,830 -->
00:06:30,280
I was going to ask you about your thoughts on the recent lapse of Section 702,
117
00:06:30,350 -->
00:06:31,580
but you beat me to it.
118
00:06:33,120 -->
00:06:36,060
Do you, before we get a little bit more into the World Cup stuff here,
119
00:06:38,039 -->
00:06:41,320
what does the behind the scenes of policy look like?
120
00:06:41,360 -->
00:06:44,560
Very briefly, I hear this a lot too back here.
121
00:06:44,660 -->
00:06:46,300
It's like, hey, I work on policy.
122
00:06:47,020 -->
00:06:50,119
And I feel like it's this big umbrella term that to regular people
123
00:06:50,140 -->
00:06:54,780
who haven't worked in policy like myself can mean a lot of things. And so what does that look like
124
00:06:54,940 -->
00:07:01,300
a day in a life? Excellent question, right? And I can't stand myself. I think the sort of
125
00:07:01,500 -->
00:07:07,600
gatekeeping that policy workers have within the realm. So really simply, you know, policy is stuff
126
00:07:07,700 -->
00:07:11,880
that affects how you and I get to interact with one another, right? It really is. It is the rules
127
00:07:11,930 -->
00:07:18,200
of the classroom. It is the rules of what you say, what you can say, what you get marked for.
128
00:07:18,840 -->
00:07:25,540
I know that we call it policy. I know that there's a ton of policy think tanks that, you know, are situated in Washington, D.C.
129
00:07:25,650 -->
00:07:30,600
I know there's a ton of people with policy jobs and we don't really know what they do in the most basic sense.
130
00:07:31,480 -->
00:07:39,560
What I was doing is I was reading laws that were being proposed by Congress saying, you know, we want to do this with electronic communications.
131
00:07:40,140 -->
00:07:46,560
And I would read those and I would say, this is bad for reasons A through Z, you know, and also trying to activate the public.
132
00:07:46,740 -->
00:07:50,680
You know, writing blogs is a big part of it. Going to speak, you know, is a big part of it.
133
00:07:51,040 -->
00:07:54,920
I would visit classrooms, you know, I would visit like high schools and middle schools talking about this stuff.
134
00:07:55,360 -->
00:08:01,980
And it's great. Like whenever you can get someone in the teens to care at all about government, it is a fantastic win.
135
00:08:02,200 -->
00:08:05,340
Really, what we're doing is we're trying to read proposed rules.
136
00:08:05,480 -->
00:08:08,380
We're trying to read how the government wants to change your life.
137
00:08:09,200 -->
00:08:11,000
They have a massive amount of power.
138
00:08:11,220 -->
00:08:18,800
They can change, again, the way your messages are stored, the way your messages are retrieved, the requirements for asking for your messages.
139
00:08:19,000 -->
00:08:20,960
And that also includes things like your location.
140
00:08:21,480 -->
00:08:34,580
That includes whether or not it's okay that when you visit a website, when you click around, you know, your behavior can be gathered into a data broker bundle and profile, and it can be used to target you with ads somewhere down the line.
141
00:08:34,659 -->
00:08:38,479
It can include the fact that you may not use Facebook.
142
00:08:38,800 -->
00:08:46,620
You may not log into Facebook, but Facebook sure knows a lot about you because other companies are telling Facebook about what you've done.
143
00:08:47,520 -->
00:08:53,180
All of that, all of that can be controlled, can be limited, can be made better for you because of policy.
144
00:08:53,380 -->
00:08:56,840
And again, at a very basic level, it's what is the government trying to do?
145
00:08:57,840 -->
00:08:59,940
Who's looking out for the everyday person?
146
00:09:00,880 -->
00:09:02,560
And how do you get those changes made?
147
00:09:02,880 -->
00:09:05,060
That's policy. It's got a lot of people.
148
00:09:05,660 -->
00:09:07,540
It's got too many people, I would say.
149
00:09:07,960 -->
00:09:11,100
And it has a lot of visits to offices with people who are dressed in suits,
150
00:09:11,680 -->
00:09:12,980
who maybe take a day off, please.
151
00:09:13,740 -->
00:09:15,260
You know, just, it's okay.
152
00:09:17,000 -->
00:09:19,460
Yeah, and so, you know, for the World Cup,
153
00:09:19,580 -->
00:09:21,540
I know that you, and or Mauerbeitz,
154
00:09:21,600 -->
00:09:24,800
maybe we can dig into how much you did or if you did all of that there.
155
00:09:24,980 -->
00:09:26,620
But you guys have been doing some coverage on the World Cup,
156
00:09:26,820 -->
00:09:30,160
not like you're doing commentating for the games.
157
00:09:30,180 -->
00:09:30,539
I wish.
158
00:09:32,500 -->
00:09:34,740
I'm actually, you know, the US game is going to be,
159
00:09:35,480 -->
00:09:36,740
like an hour after our call.
160
00:09:36,750 -->
00:09:38,220
So I'm going to watch that.
161
00:09:38,220 -->
00:09:40,720
And I watched Spain and Portugal.
162
00:09:40,920 -->
00:09:42,320
So I am following along here.
163
00:09:42,780 -->
00:09:44,540
I don't know if you read that crazy blog article
164
00:09:44,610 -->
00:09:46,140
of somebody who actually was able to get
165
00:09:46,460 -->
00:09:48,120
internal access to the FIFA systems
166
00:09:48,310 -->
00:09:51,520
and they had complete access to everything.
167
00:09:51,580 -->
00:09:52,860
They could have streamed anything to it.
168
00:09:52,870 -->
00:09:54,380
They had access to all the stream codes.
169
00:09:54,740 -->
00:09:55,980
I would really look into that
170
00:09:56,140 -->
00:09:58,620
because it was a very interesting oversight
171
00:09:58,690 -->
00:09:59,360
in their security.
172
00:09:59,600 -->
00:10:01,020
But you covered this more
173
00:10:01,320 -->
00:10:03,460
from the end user's perspective.
174
00:10:03,800 -->
00:10:06,160
People who are going online, they want to watch the World Cup.
175
00:10:07,519 -->
00:10:09,260
And you found some interesting stuff.
176
00:10:09,320 -->
00:10:11,360
And so I think it'd be interesting to unpack that a little bit.
177
00:10:11,380 -->
00:10:14,860
And then we can dive into the details and some takeaways to keep people safe,
178
00:10:14,940 -->
00:10:21,360
not just during the World Cup, but any major event where probably the same attackers are targeting people who are looking for something.
179
00:10:22,560 -->
00:10:23,060
Yeah, yeah.
180
00:10:23,300 -->
00:10:27,400
So what we found, and it's similar to what we find for any major event.
181
00:10:27,580 -->
00:10:29,540
You were kind of alluding to it earlier in the show.
182
00:10:29,840 -->
00:10:32,280
Anytime there's something global, anytime there's something big,
183
00:10:32,820 -->
00:10:35,620
COVID actually is another really good example of this.
184
00:10:35,620 -->
00:10:38,760
But anytime that something is on every single person's mind,
185
00:10:39,760 -->
00:10:42,380
scammers are out there trying to make money off of it, right?
186
00:10:42,400 -->
00:10:45,140
And so the World Cup is the world's news right now.
187
00:10:45,260 -->
00:10:48,220
And so we found plenty of examples of, for example,
188
00:10:48,280 -->
00:10:51,260
we found fake websites being just kind of drawn up overnight.
189
00:10:52,040 -->
00:10:57,080
And they were promising simply high-definition streams to matches, right?
190
00:10:57,240 -->
00:10:58,460
Hey, don't pay for anything.
191
00:10:58,620 -->
00:10:59,360
You don't have a TV.
192
00:10:59,680 -->
00:11:06,700
Just click on this and you can find a high definition stream of your team, of the match you want to watch.
193
00:11:07,020 -->
00:11:07,640
They're scams, right?
194
00:11:07,640 -->
00:11:09,360
In the sense that like sometimes it's not even a stream.
195
00:11:09,690 -->
00:11:10,520
Sometimes it's nothing.
196
00:11:10,690 -->
00:11:11,840
You click on these things and you get nowhere.
197
00:11:11,990 -->
00:11:13,540
But most of the time you're just getting ads.
198
00:11:13,710 -->
00:11:14,380
You're getting ads.
199
00:11:14,530 -->
00:11:15,580
You're getting malicious ads.
200
00:11:15,780 -->
00:11:16,760
You're just getting pop-ups.
201
00:11:17,060 -->
00:11:26,120
I think we're all pretty accustomed to this as someone who went to college and tried to watch streams, you know, just through ads.
202
00:11:26,400 -->
00:11:27,400
That's kind of what it was.
203
00:11:27,840 -->
00:11:28,260
They're annoying.
204
00:11:28,880 -->
00:11:30,200
They don't deliver what they're supposed to deliver.
205
00:11:30,600 -->
00:11:34,300
It's a way to generate ad revenue for a bunch of clandestine sites.
206
00:11:34,760 -->
00:11:36,900
And again, they're extremely easy to spin up.
207
00:11:37,420 -->
00:11:41,760
A lot of this work was done by my colleague, who's a threat researcher here.
208
00:11:42,540 -->
00:11:47,980
And pretty much what he's doing is he's looking online for people who are running campaigns to try and scam people.
209
00:11:48,560 -->
00:11:51,520
Some of the more interesting stuff we saw, though, was a couple of weeks ago.
210
00:11:51,780 -->
00:11:57,600
We saw websites being spun up for things like applying for a FIFA passport, right?
211
00:11:57,920 -->
00:12:02,640
So let's say you want to come to the United States to watch like an actual game, a match in person.
212
00:12:03,400 -->
00:12:05,120
Oh, just apply for this FIFA passport.
213
00:12:05,760 -->
00:12:06,940
Not a real thing, right?
214
00:12:07,210 -->
00:12:07,860
Not a thing whatsoever.
215
00:12:08,240 -->
00:12:09,100
That's not how it works.
216
00:12:09,200 -->
00:12:13,340
That's not how tourism works to enter, you know, the USA.
217
00:12:13,920 -->
00:12:20,739
You know, these sort of, again, FIFA passports or like FIFA visas or World Cup visas, all these kinds of things kind of being advertised.
218
00:12:21,520 -->
00:12:22,820
Pure scans, absolute pure scan.
219
00:12:23,120 -->
00:12:24,660
Not something that you need to apply for.
220
00:12:24,720 -->
00:12:25,560
Not something that exists.
221
00:12:26,020 -->
00:12:27,480
Not something that you're going to get your money back on.
222
00:12:27,680 -->
00:12:39,680
And we also saw a lot of obviously like cryptocurrency scams where there are sites that are alleging that they have a coin that is affiliated officially with FIFA or with any of the teams or with any other countries.
223
00:12:40,460 -->
00:12:44,540
And it's the same. I mean, a crypto scam is a crypto scam is a crypto scam, right?
224
00:12:45,140 -->
00:12:48,240
They're trying to gain your money. They're trying to get you to invest in something.
225
00:12:48,900 -->
00:12:51,560
That coin may exist. It may not exist, right?
226
00:12:51,740 -->
00:12:57,000
The entire infrastructure of the website may be fraudulent and it's just something to take your payment information.
227
00:12:57,140 -->
00:13:26,080
So we saw a lot of that. And then kind of usual, I think this is kind of almost almost endearing, you know, because you can see this kind of scam in person. It's rare to see in-person scams be recreated online. Just fake merchandise. Right. There's like that's like that's a classic scam. That's totally fine. We understand that one. There's no no crypto involved. There's no like shady website redirects. There's no adware being installed on your device. Just a fake piece of clothing. You know, why not? That's that one works in person. It probably works online as well.
228
00:13:26,140 -->
00:13:51,560
So we've seen a lot of that stuff. And again, all of it is, like I said, very much attached to a global piece of news that people are paying attention to. And my goodness, there's probably nothing better than the World Cup right now for a scam because it lasts weeks, right? It's not something that's happening one day. You know, like Black Friday, we do see scams based on Black Friday, fake sales from like real retailers, decoy websites made to look like real retailers.
229
00:13:52,120 -->
00:13:54,580
That kind of stuff lasts a week, maybe two at the most.
230
00:13:54,800 -->
00:13:57,320
The lead up to World Cup, World Cup itself,
231
00:13:57,620 -->
00:14:01,600
that's such a long period of time that you can run a lot of fake websites.
232
00:14:01,900 -->
00:14:03,600
You can run a lot of scams for quite a bit of time.
233
00:14:04,760 -->
00:14:06,140
Yeah, so if somebody's hearing this,
234
00:14:07,620 -->
00:14:10,460
and let's try to keep the advice universal.
235
00:14:10,560 -->
00:14:11,940
We can still use the World Cup, of course,
236
00:14:11,960 -->
00:14:13,420
because that's what's in right now.
237
00:14:13,620 -->
00:14:14,880
But this has been common in AI.
238
00:14:15,040 -->
00:14:17,420
I know when AI really blows up,
239
00:14:17,500 -->
00:14:19,720
you start seeing all these campaigns come out all at once,
240
00:14:19,900 -->
00:14:21,200
targeting people, searching for AI.
241
00:14:21,900 -->
00:14:25,360
So how does someone know they're about to engage with a scam?
242
00:14:25,840 -->
00:14:27,740
Like, what are kind of the telltale signs?
243
00:14:28,000 -->
00:14:29,100
How does someone recognize that?
244
00:14:29,220 -->
00:14:30,520
What should they do in those situations?
245
00:14:30,880 -->
00:14:33,060
Because I think it's easy to tell people it's happening,
246
00:14:33,340 -->
00:14:36,080
but no one really knows it's happening until after they've been scammed.
247
00:14:37,160 -->
00:14:42,340
Right. Such a difficult problem that I think most of the cybersecurity industry deals with.
248
00:14:42,520 -->
00:14:48,100
The folks who know what a scam looks like are not the folks that need the most protection in scams, right?
249
00:14:48,260 -->
00:14:50,020
Like, they are aware.
250
00:14:50,360 -->
00:14:54,860
We're trying to help people away from, like you said, just look out for World Cup scams.
251
00:14:55,040 -->
00:14:58,640
So really, really basic top, you know, top to bottom kind of list of stuff.
252
00:14:58,900 -->
00:15:01,980
Something that seems too good to be true is likely too good to be true, right?
253
00:15:02,120 -->
00:15:04,260
We see this also as like job scams, right?
254
00:15:04,820 -->
00:15:07,180
You get a text and boy, we're getting a lot of these these days, right?
255
00:15:07,300 -->
00:15:09,000
You get a text that says, hey, you can work remotely.
256
00:15:09,120 -->
00:15:10,480
You can make $5,000 a week.
257
00:15:10,700 -->
00:15:13,080
You can work for six hours, you know, a week.
258
00:15:13,300 -->
00:15:14,220
Like you're good to go.
259
00:15:14,540 -->
00:15:15,060
Too good to be true.
260
00:15:15,660 -->
00:15:16,260
There's a reason for it.
261
00:15:16,300 -->
00:15:16,980
It's because it's scam.
262
00:15:17,640 -->
00:15:22,040
Too good to be true is such an easy, easy, reliable thing to lean on for might be a scam.
263
00:15:22,700 -->
00:15:24,140
Urgency, number two, right?
264
00:15:24,480 -->
00:15:27,100
Something that is trying to get you to do something,
265
00:15:27,850 -->
00:15:30,360
either because there's like a fake time limit.
266
00:15:30,510 -->
00:15:34,360
I mean, sometimes you'll even see on a website, there's like a clock, there's a countdown.
267
00:15:34,820 -->
00:15:37,900
This deal is only good for so long, or this deal is running out,
268
00:15:38,240 -->
00:15:40,240
or any type of urgency language.
269
00:15:40,620 -->
00:15:44,500
Baked into urgency also is honestly threats.
270
00:15:45,020 -->
00:15:49,920
Like, we don't think about that all the time, but a lot of these scams have threats baked into them.
271
00:15:50,200 -->
00:15:52,560
Threats like extortion scams, right?
272
00:15:52,960 -->
00:15:59,420
Someone alleging that they have photos of you, that they have footage of you, they have webcam recordings of you.
273
00:15:59,680 -->
00:16:00,460
That's a threat, right?
274
00:16:00,460 -->
00:16:02,380
A threat to publish that kind of stuff.
275
00:16:02,540 -->
00:16:02,900
That's a threat.
276
00:16:02,970 -->
00:16:05,100
And it's baked into urgency, right?
277
00:16:05,480 -->
00:16:11,480
If you don't send this payment at a certain time, we're going to publish these photos or we're going to tell everyone in your contact list.
278
00:16:11,980 -->
00:16:14,440
That's something to also watch out for.
279
00:16:14,640 -->
00:16:18,020
And then I would say, as we were talking here again, anything based on like a global event,
280
00:16:18,420 -->
00:16:21,540
unfortunately, we do just have to have a heightened awareness around it.
281
00:16:22,700 -->
00:16:26,340
Because something, again, I go back to COVID for the last time that I think the world was
282
00:16:26,480 -->
00:16:27,920
thinking about the same thing, right?
283
00:16:28,200 -->
00:16:31,760
The scams are very different in the sense of they were like philanthropy scams.
284
00:16:32,180 -->
00:16:38,980
It was preying on that goodness in you, which was, hey, we're taking donations for a hospital.
285
00:16:39,500 -->
00:16:43,120
We're taking donations for the Red Cross, you know, for known organizations.
286
00:16:43,640 -->
00:16:48,160
That kind of stuff, again, we just have to watch out for anything that is globally relevant.
287
00:16:48,500 -->
00:16:51,380
We have to be aware of who's actually doing it, where it's coming from.
288
00:16:51,600 -->
00:16:53,320
So if you're being urged to do something, watch out.
289
00:16:54,080 -->
00:16:55,380
If it's too good to be true, watch out.
290
00:16:56,180 -->
00:16:57,900
If it's globally relevant, watch out.
291
00:16:58,220 -->
00:16:59,380
Yeah, I have a few follow-ups there.
292
00:16:59,440 -->
00:17:05,240
I mean, the first one, is there a reason you mentioned behaviors and not technologies as all of your defensives?
293
00:17:05,420 -->
00:17:06,640
Yeah, yeah, yeah, yeah.
294
00:17:07,280 -->
00:17:09,220
Yes, because the technology changes, right?
295
00:17:09,439 -->
00:17:10,640
This is kind of wild.
296
00:17:10,900 -->
00:17:17,140
To my understanding, the first piece of ransomware that was ever developed and sent was sent via floppy disk.
297
00:17:17,350 -->
00:17:23,000
And it was sent as though they were asking people who were working in AIDS research at the time.
298
00:17:23,030 -->
00:17:24,380
I believe this is the late 80s.
299
00:17:24,530 -->
00:17:32,220
If they would contribute to a research, to like an international effort to combine research to find out more about the AIDS epidemic as it was happening.
300
00:17:32,540 -->
00:17:42,900
And when you put this disk into your computer, after a certain number of reboots, you would get hit with, again, I believe this is the first case of ransomware.
301
00:17:43,060 -->
00:17:44,660
It's a different kind of ransomware, right?
302
00:17:44,740 -->
00:17:46,420
It's super rudimentary, super basic.
303
00:17:46,700 -->
00:17:49,220
But after a while, it just pops up like a text file.
304
00:17:49,560 -->
00:17:53,480
And the computer is like, I don't even think there's a way to undo it.
305
00:17:53,560 -->
00:17:55,580
I think it was just like, yeah, you're kind of done for.
306
00:17:55,840 -->
00:17:57,080
That was an earlier technology.
307
00:17:57,220 -->
00:18:01,000
And yet the behavior is somewhat the same there, right?
308
00:18:01,180 -->
00:18:03,240
preying on someone's like with COVID, right?
309
00:18:03,520 -->
00:18:04,620
Preying on how good they are,
310
00:18:04,770 -->
00:18:05,740
hoping that they can do something.
311
00:18:05,910 -->
00:18:08,700
But again, that was a global problem,
312
00:18:08,990 -->
00:18:10,180
still is a global problem.
313
00:18:10,420 -->
00:18:11,340
The technology will change.
314
00:18:11,510 -->
00:18:12,180
It will look different.
315
00:18:12,440 -->
00:18:14,660
You know, the messages that we used to get over email,
316
00:18:15,340 -->
00:18:17,260
right, those have moved to text messages.
317
00:18:17,900 -->
00:18:19,900
And I'm sure that the messages we get over text messages,
318
00:18:20,110 -->
00:18:21,820
those will one day change and they'll arrive,
319
00:18:21,980 -->
00:18:24,440
they already are, in social media inboxes, right?
320
00:18:24,720 -->
00:18:26,520
We see a lot of scams that don't come through text at all.
321
00:18:26,530 -->
00:18:27,320
They come through LinkedIn.
322
00:18:27,430 -->
00:18:28,160
They come through Facebook.
323
00:18:28,290 -->
00:18:29,400
They come through Instagram.
324
00:18:29,570 -->
00:18:30,280
They come through Signal.
325
00:18:30,340 -->
00:18:32,840
They come through any preferred communication platform.
326
00:18:33,080 -->
00:18:39,640
So, right, we can say, watch out for URLs with this, you know, instead of.com,.xyz.
327
00:18:39,760 -->
00:18:41,140
We can say that, and that's likely true.
328
00:18:42,179 -->
00:18:43,500
Tomorrow, that will be out of date.
329
00:18:44,340 -->
00:18:46,000
So instead, we're looking for behaviors.
330
00:18:46,460 -->
00:18:50,400
Yeah, so, I mean, this is a funny question, but it's a real question,
331
00:18:50,660 -->
00:18:53,180
because I think some people who might struggle with this a bit more than others,
332
00:18:53,600 -->
00:18:57,700
a lot of things you're describing can also be hard to separate from good marketing.
333
00:18:58,000 -->
00:19:04,060
You know, like people, like, let's just use a generic, very in your face, high marketing VPN.
334
00:19:04,720 -->
00:19:06,380
They're going to have countdowns on their website.
335
00:19:06,640 -->
00:19:08,620
They're going to be urging you about the threats out there.
336
00:19:08,780 -->
00:19:11,180
They're going to be talking about the World Cup.
337
00:19:11,430 -->
00:19:14,520
So they actually fit all of the criteria you listed out.
338
00:19:15,200 -->
00:19:20,460
So how can someone look at high marketing VPN A versus a scam VPN?
339
00:19:20,990 -->
00:19:23,120
Or, you know, this can be completely different.
340
00:19:23,980 -->
00:19:25,120
I want this to be universal.
341
00:19:25,270 -->
00:19:27,520
How can someone tell the difference in that situation?
342
00:19:28,580 -->
00:19:31,860
yeah this is something that bothers the hell out of me because you're absolutely right i particularly
343
00:19:32,020 -->
00:19:37,860
enjoy a band called the mountain goats right and uh on instagram they run promos and it says if you
344
00:19:37,880 -->
00:19:45,000
want if you want the promo code to just dm us the number of scams that start with unsolicited dms
345
00:19:45,620 -->
00:19:52,080
that should not be your approach to speaking to your real customer base about getting a promo code
346
00:19:52,080 -->
00:19:57,600
on a website right just put the promo code on the website it's not that secretive folks like
347
00:19:57,620 -->
00:20:06,500
It's okay. I'm not getting 70% off. I particularly hate, as you've identified here, that legitimate
348
00:20:06,940 -->
00:20:14,980
companies are now speaking to us with a level of urgency and a level of sometimes even like FOMO,
349
00:20:15,200 -->
00:20:21,380
fear of missing out, that is similar, that is akin to scam tactics as to how people can recognize,
350
00:20:21,740 -->
00:20:27,580
right, whether one is legitimate and one is not. Unfortunately, we do have to rely on things like
351
00:20:27,600 -->
00:20:28,480
Is that the real website?
352
00:20:28,820 -->
00:20:31,160
Does it have the padlock, you know, next to the URL?
353
00:20:31,540 -->
00:20:33,620
You know, is it an encrypted connection?
354
00:20:34,140 -->
00:20:39,040
I think a lot of people also sometimes they don't know if the website is legitimate.
355
00:20:39,190 -->
00:20:41,260
So they resort to a thing like an app, right?
356
00:20:41,290 -->
00:20:47,960
I know a lot of folks don't know whether it's safe to do their banking on Chase.com or the
357
00:20:48,140 -->
00:20:48,600
Chase app.
358
00:20:48,810 -->
00:20:52,400
And I think this delineation only exists because of the way that we talk to people.
359
00:20:52,640 -->
00:20:57,560
You know, there should be the same level of assurance within customers to reach either
360
00:20:57,680 -->
00:21:01,560
you know, portal for an established provider. I kind of hate this, right? Because the answer
361
00:21:02,520 -->
00:21:06,840
depends on the person doing so much more management, right? I hate things where we
362
00:21:06,910 -->
00:21:12,480
have to manage more security. We have to manage more privacy. But unfortunately, it does feel like
363
00:21:12,560 -->
00:21:18,060
that is the thing where you have to know if the provider is legitimate. And you said here, right,
364
00:21:18,160 -->
00:21:23,720
like the VPN provider, like these kinds of tactics, you know, this is running out, this won't be back,
365
00:21:23,840 -->
00:21:27,840
you're going to lose out on this. I would say, and this is my recommendation to like a lot of things,
366
00:21:28,040 -->
00:21:33,060
just buy less things, just buy fewer things. I know that's not realistic. I know that's not what
367
00:21:33,090 -->
00:21:39,080
we can all do. I know that modern society makes us buy these things and I hate that. But if you do
368
00:21:39,240 -->
00:21:46,060
see that your provider is using those types of tactics, I would even say punish them a little
369
00:21:46,180 -->
00:21:52,880
bit. You can vote with your wallet. That's it. Yeah. Do you think that there is some responsibility
370
00:21:53,280 -->
00:21:56,040
for the people hosting software, hosting websites,
371
00:21:56,460 -->
00:21:59,420
and the developers in terms of how they present
372
00:21:59,520 -->
00:22:00,480
and where they're reaching their...
373
00:22:00,480 -->
00:22:01,860
Because that's kind of what you're speaking to there
374
00:22:01,980 -->
00:22:02,840
with the band on Instagram.
375
00:22:03,160 -->
00:22:05,900
You're kind of saying that it's their responsibility as well
376
00:22:05,940 -->
00:22:07,720
to help reduce the amount of scams.
377
00:22:07,800 -->
00:22:10,840
And actually, this is nowhere near that kind of scale.
378
00:22:11,600 -->
00:22:13,340
And I have a huge amount of respect for them.
379
00:22:13,360 -->
00:22:16,000
But one of the things I don't like about Signal
380
00:22:16,200 -->
00:22:19,280
is that they don't really get their foot in the door
381
00:22:19,280 -->
00:22:20,480
for so many Linux distros.
382
00:22:20,740 -->
00:22:26,120
And so what happens is we have all these community-built, unofficial signal packages out there for the Linux community.
383
00:22:26,210 -->
00:22:29,980
And I feel like that's a very dangerous position to put a signal user in.
384
00:22:30,130 -->
00:22:35,620
A very rare not-W, I think, from the signal team, in my opinion, of course.
385
00:22:35,820 -->
00:22:37,920
But is that kind of what you're saying?
386
00:22:38,080 -->
00:22:41,100
There's some responsibility that the people running stuff needs to have?
387
00:22:41,380 -->
00:22:42,720
I'm not saying signal specifically.
388
00:22:42,800 -->
00:22:43,380
That's my opinion.
389
00:22:43,490 -->
00:22:44,880
I don't want to put words in your mouth.
390
00:22:45,340 -->
00:22:46,160
Right, right, right.
391
00:22:46,250 -->
00:22:46,980
No, I totally understand.
392
00:22:47,180 -->
00:22:48,680
It's just a good example to have, right?
393
00:22:48,880 -->
00:22:49,480
It's on hand.
394
00:22:49,900 -->
00:22:50,580
Unequivocally, yes.
395
00:22:50,900 -->
00:23:01,360
I do think that it is up to the folks who are running these platforms, who are selling the software to recognize that some of their tactics are mirroring the tactics of scammers.
396
00:23:01,820 -->
00:23:07,760
I'm also going to go out and say that I never, you know, this is the classic thing, right?
397
00:23:07,860 -->
00:23:12,560
I don't ascribe malice to what could simply be like ignorance.
398
00:23:12,740 -->
00:23:16,080
Right. And I mean that in like the plainest, like non malicious sense.
399
00:23:16,860 -->
00:23:22,740
I think a lot of folks just may not know that this is what is happening, you know, through these social media platforms.
400
00:23:22,840 -->
00:23:25,300
They may not know that this is how scammers reach people.
401
00:23:25,540 -->
00:23:26,560
This is a very good example of this.
402
00:23:26,620 -->
00:23:26,900
My goodness.
403
00:23:27,120 -->
00:23:32,380
A few weeks ago, maybe a month or two ago, I saw an email in my inbox.
404
00:23:33,020 -->
00:23:34,640
I believe it was from Macy's.
405
00:23:35,020 -->
00:23:36,540
Macy's, I apologize if it wasn't you.
406
00:23:36,800 -->
00:23:37,340
No ill will here.
407
00:23:37,600 -->
00:23:45,480
But the subject line of the email was spaced out in between one letter, what, like letter, space, letter, space, letter, space, letter, space, all caps.
408
00:23:45,720 -->
00:23:47,600
And it was like 40% off like Macy's this weekend.
409
00:23:47,960 -->
00:23:52,560
I don't blame anyone at Macy's for not realizing that, you know, maybe 15 years ago, that was
410
00:23:52,640 -->
00:23:54,840
like the scam subject line.
411
00:23:55,140 -->
00:23:58,240
That was like, that was the way that we received scams.
412
00:23:58,800 -->
00:24:05,140
And realistically, there's probably just someone who wrote a subject line at Macy's who is
413
00:24:05,860 -->
00:24:07,360
20 years younger than I am.
414
00:24:07,400 -->
00:24:08,240
And that's okay.
415
00:24:08,580 -->
00:24:11,380
And that's like, they have a different internet.
416
00:24:11,560 -->
00:24:12,860
They have seen a different internet.
417
00:24:12,940 -->
00:24:18,340
So again, I think a lot of this is just folks don't know what scams look like all the time.
418
00:24:18,450 -->
00:24:21,380
They don't know what the scam tactics are because they're not in it every day.
419
00:24:21,630 -->
00:24:23,600
And so I'm not putting anyone on blast here.
420
00:24:23,760 -->
00:24:27,480
Again, like I said, I'm not ascribing malice, but I do think there is a responsibility.
421
00:24:28,040 -->
00:24:28,160
Absolutely.
422
00:24:28,410 -->
00:24:32,760
I think there's a responsibility to treat your customers in a way that it shouldn't mirror
423
00:24:33,130 -->
00:24:34,260
the way they're treated by scammers.
424
00:24:34,700 -->
00:24:38,320
What have you kind of learned during your time at Mauerbytes about this kind of issue?
425
00:24:38,460 -->
00:24:46,600
I believe you all, if I'm not mistaken, and I'm not a Mauerbytes customer, but I believe you guys have the free tool, which is more offline.
426
00:24:47,040 -->
00:24:47,900
It's not offline.
427
00:24:48,090 -->
00:24:52,120
You guys have to download the definitions and everything, but it's more designed to run locally on your system.
428
00:24:52,300 -->
00:24:54,120
And then you have more active scanning tools.
429
00:24:54,340 -->
00:24:59,040
How do you feel about those tools fitting in somebody's workflow, whether it's Mauerbytes or any other tool out there?
430
00:24:59,370 -->
00:25:01,420
Or do you think that this is more behavioral, like you were saying?
431
00:25:02,380 -->
00:25:07,160
Yeah, I think that we always want, and I think this is cybersecurity in general.
432
00:25:07,320 -->
00:25:16,100
We want to help people either before a crisis occurs or as a crisis is occurring, right?
433
00:25:16,220 -->
00:25:20,880
And so a crisis occurring can be, I replied to a scam message, you know, I sent money,
434
00:25:21,020 -->
00:25:22,980
you know, which is hard to come back from.
435
00:25:23,520 -->
00:25:27,460
Or I downloaded something, I opened a PDF, I clicked that link in the email.
436
00:25:27,740 -->
00:25:31,399
And so something like the free scanner, right, that Malwarebytes has had, you know, since
437
00:25:31,420 -->
00:25:38,320
day one, that's supposed to help with a very, very classic problem, which is a piece of malware has
438
00:25:38,460 -->
00:25:41,920
showed up on your device. We're just going to find it. We're going to take it off. We still do that.
439
00:25:42,120 -->
00:25:46,860
That is still free. And I think that still plays a big role in like just day to day cybersecurity.
440
00:25:47,360 -->
00:25:51,460
Right. But as we've seen, right, cybersecurity threats have evolved dramatically. Right. It is
441
00:25:51,600 -->
00:25:57,259
not just malware gets installed on your device. It is you reply to a message on LinkedIn or you
442
00:25:57,280 -->
00:26:04,200
believe something, you believe an email, you believe that this website actually is taking
443
00:26:04,440 -->
00:26:08,580
donations for, again, let's say like the Red Cross. At that point, we need to help folks
444
00:26:09,000 -->
00:26:14,020
when they're seeing the thing, right, before they've engaged with it. And so the millions of
445
00:26:14,140 -->
00:26:19,620
ways you can land on a bad website or receive a bad message, that just means we have to do that
446
00:26:19,720 -->
00:26:24,820
much more. And so we have things, right? We have a VPN as well. We believe that like the VPN is
447
00:26:24,840 -->
00:26:30,280
part of just like a larger approach towards online privacy. You know, I don't, I personally don't
448
00:26:30,620 -->
00:26:35,400
want my internet service provider seeing what I do online. I think that's, I think they have no
449
00:26:35,470 -->
00:26:39,840
business there. You guys use Azure servers for that, right? That we do. Yeah, yeah, yeah. Love
450
00:26:39,980 -->
00:26:44,880
them. Entirely RAM-based servers. So we can't store any data. Like physically, we cannot store data.
451
00:26:45,400 -->
00:26:51,580
And so if we get a request for data, it's not that we say, no, you can't have it. It's more,
452
00:26:51,620 -->
00:26:53,100
no, the data doesn't exist, right?
453
00:26:53,440 -->
00:26:54,980
And that's like a lovely, lovely thing.
454
00:26:55,100 -->
00:26:57,460
We've been audited by a third-party provider as well,
455
00:26:57,580 -->
00:26:58,520
a group of researchers,
456
00:26:58,880 -->
00:27:01,300
to just simply prove that we are saying what we're saying.
457
00:27:01,420 -->
00:27:02,760
I think that kind of stuff is so important
458
00:27:03,440 -->
00:27:04,720
because it's so hard to just trust.
459
00:27:05,220 -->
00:27:08,000
I added Azure to our VPN chart recently
460
00:27:08,200 -->
00:27:09,760
and it kind of shocked
461
00:27:09,980 -->
00:27:12,240
because I hadn't heard of it before I added it.
462
00:27:12,380 -->
00:27:14,120
And when I added it to our chart, I'm like, oh wow.
463
00:27:14,120 -->
00:27:15,660
And I had to look at the history and I was like,
464
00:27:15,740 -->
00:27:18,600
oh, because in my head, you guys were still using Mulvad,
465
00:27:18,700 -->
00:27:20,360
but then you guys switched over to Azure.
466
00:27:20,660 -->
00:27:23,040
but it marks off pretty much all the same stuff.
467
00:27:23,130 -->
00:27:23,940
It's a really good provider.
468
00:27:24,690 -->
00:27:25,280
So it was a good choice.
469
00:27:25,520 -->
00:27:28,360
Yeah, just to kind of wrap it up on that question
470
00:27:28,520 -->
00:27:29,440
about what we provide.
471
00:27:29,670 -->
00:27:30,480
Because again, like I said,
472
00:27:30,560 -->
00:27:32,900
there's so many different ways you can receive a threat
473
00:27:33,260 -->
00:27:34,100
and you can encounter a threat.
474
00:27:34,320 -->
00:27:36,760
We have all these different things that we hope, right,
475
00:27:37,100 -->
00:27:40,580
are non-intrusive and that we do the work for you, right?
476
00:27:40,880 -->
00:27:43,720
That includes such a growing list of products and features.
477
00:27:44,300 -->
00:27:45,760
We have something called Personal Data Remover
478
00:27:45,930 -->
00:27:48,100
to help you remove yourself online, you know,
479
00:27:48,140 -->
00:27:53,400
but a lot of that is we're supposed to be doing the work, not you. I think we had this promise
480
00:27:54,020 -->
00:27:59,040
many years ago that it didn't matter who you were online, right? The earliest internet said it
481
00:27:59,200 -->
00:28:04,000
didn't matter what your name was. It didn't matter what your real name was. It didn't matter where
482
00:28:04,080 -->
00:28:09,540
you were born. It didn't matter how much you made. And I think we've really seen that over the past
483
00:28:09,720 -->
00:28:14,120
15 to 20 years. It extremely matters. I think there's a group of companies, big tech companies,
484
00:28:14,180 -->
00:28:15,400
that that's what matters most.
485
00:28:15,580 -->
00:28:17,460
It matters most what my zip code is.
486
00:28:17,590 -->
00:28:19,380
It matters most what my salary is
487
00:28:19,890 -->
00:28:22,880
because that will help an advertiser target me with an ad.
488
00:28:23,030 -->
00:28:26,320
And that will give money to a large company like Meta.
489
00:28:26,540 -->
00:28:28,280
I don't think that should be the internet we keep making.
490
00:28:28,700 -->
00:28:30,100
I don't think that should be that at all.
491
00:28:30,320 -->
00:28:31,920
And so we do have to make some tools
492
00:28:32,080 -->
00:28:34,280
that I think are honestly adversarial
493
00:28:34,740 -->
00:28:36,720
against the modern surveillance economy.
494
00:28:36,870 -->
00:28:38,420
And so we're trying to do that as well.
495
00:28:38,860 -->
00:28:40,040
Yeah, I was going to ask you about this later,
496
00:28:40,260 -->
00:28:42,580
but you brought it up now, so I'll start now.
497
00:28:42,780 -->
00:28:44,960
but what's your guys' relationship with big tech companies?
498
00:28:45,100 -->
00:28:47,860
I think I was exposed to this concept for the first time in Cyprus
499
00:28:48,160 -->
00:28:50,840
when I was with some of these ad-blocking people
500
00:28:51,140 -->
00:28:54,720
from Brave, from Ghostory, all these common ad-blockers.
501
00:28:55,160 -->
00:28:57,340
They were talking about the overall principle
502
00:28:57,440 -->
00:28:59,600
of first versus third-party tracking.
503
00:28:59,840 -->
00:29:03,100
I think it's DuckDuckGo specifically in their app tracking
504
00:29:03,140 -->
00:29:04,080
that they do on Android.
505
00:29:04,320 -->
00:29:07,700
They actually block Facebook, but only when it's a third-party tracker.
506
00:29:08,000 -->
00:29:11,400
If you download the Facebook app, DuckDuckGo won't block the Facebook app.
507
00:29:11,760 -->
00:29:15,500
But if you download a totally unrelated app and it has a Facebook tracker, they will block that.
508
00:29:15,970 -->
00:29:19,940
So there's this overall idea of trying to reel in those big tech companies.
509
00:29:20,540 -->
00:29:23,460
And so I was curious what your guys' relationship was with that.
510
00:29:23,510 -->
00:29:28,920
Because a lot of times these big tech companies also aren't part of keeping someone safe online for reasons you just cited.
511
00:29:29,490 -->
00:29:33,200
So is there a role where you're with the companies, against the companies,
512
00:29:33,660 -->
00:29:38,800
or is that something that you're somewhat neutral to and your job is just keeping people's cybersecurity safe?
513
00:29:40,360 -->
00:29:42,700
Yeah, I think that's a lovely way to think about it, right?
514
00:29:42,940 -->
00:29:43,860
Are we with the companies?
515
00:29:43,920 -->
00:29:44,540
Are we against them?
516
00:29:44,540 -->
00:29:45,000
Are we neutral?
517
00:29:45,260 -->
00:29:49,020
The cleanest answer I can give is that we're with consumers, right?
518
00:29:49,140 -->
00:29:52,160
And sometimes being with consumers is being anti-company.
519
00:29:52,360 -->
00:29:55,800
Like there's no way to torture that concept.
520
00:29:56,140 -->
00:29:57,140
We have a product, right?
521
00:29:57,340 -->
00:30:02,060
Browser card, which is a browser plugin entirely free, and it blocks third-party trackers by
522
00:30:02,180 -->
00:30:02,400
default.
523
00:30:02,780 -->
00:30:06,820
It also helps you find out if you're on a scam website or if there's anything that's kind
524
00:30:06,860 -->
00:30:08,920
of suspicious going on at a URL.
525
00:30:09,460 -->
00:30:13,060
But it's a third-party tracker blocker, right?
526
00:30:13,560 -->
00:30:17,780
And when you make something that blocks third-party tracking,
527
00:30:18,220 -->
00:30:23,700
there is a part of you, again, that is protecting the consumer against a company,
528
00:30:24,000 -->
00:30:25,080
against a big tech company.
529
00:30:25,480 -->
00:30:26,920
Those are one and the same thing.
530
00:30:27,080 -->
00:30:31,400
We also have analyzed our own website before to answer,
531
00:30:31,880 -->
00:30:33,100
can we get rid of some of this stuff?
532
00:30:33,380 -->
00:30:34,820
Can we get rid of some of the tracking?
533
00:30:35,190 -->
00:30:38,280
The way that we record a visitor.
534
00:30:38,620 -->
00:30:47,780
I think so many of the tools that exist for running websites right now have tracking baked in that getting rid of some of that stuff is actually much harder than we would assume.
535
00:30:48,140 -->
00:30:50,640
I actually, I run a site on something called Ghost.
536
00:30:50,880 -->
00:30:54,540
And Ghost is, I think, one of the only publishing platforms.
537
00:30:54,940 -->
00:30:55,440
Yeah, right.
538
00:30:55,840 -->
00:30:59,840
It's one of the only publishing platforms that I know of, period, that lets you turn off tracking.
539
00:31:00,080 -->
00:31:01,440
So I don't know who visits my website.
540
00:31:01,740 -->
00:31:03,200
I don't know how many people visit my website.
541
00:31:03,240 -->
00:31:04,560
I don't know who opens the newsletter.
542
00:31:04,700 -->
00:31:05,500
I have no clue.
543
00:31:05,920 -->
00:31:07,700
And I'm allowed to make that decision.
544
00:31:08,160 -->
00:31:10,660
Whereas I used to have a site on WordPress and it's like, here you go, man.
545
00:31:10,820 -->
00:31:11,900
Here's every single person who visited.
546
00:31:12,160 -->
00:31:12,940
Here's what it looks like.
547
00:31:13,200 -->
00:31:14,780
Here's what country we think they came from.
548
00:31:15,080 -->
00:31:19,000
Again, Malwarebytes has analyzed our own use of trackers before to limit them.
549
00:31:19,160 -->
00:31:25,000
We believe in being like, again, sometimes being on the side of the consumer is being against a company.
550
00:31:25,620 -->
00:31:26,540
And that's totally fine.
551
00:31:26,740 -->
00:31:27,880
That's what we need to protect people from.
552
00:31:28,020 -->
00:31:29,860
If that's what they need, that's what they need.
553
00:31:30,140 -->
00:31:34,900
Yeah, just because I know there's going to be some people wondering, can you expand on, I guess, from your perspective,
554
00:31:35,040 -->
00:31:39,120
necessity for having at least some analytics and what it looks like to do those more privately
555
00:31:39,330 -->
00:31:43,280
versus not privately? Because I think some people just think it's either not private or private.
556
00:31:43,430 -->
00:31:46,680
So do you mind expanding a bit? I feel like it'd be incomplete if I didn't ask that.
557
00:31:47,380 -->
00:31:52,700
Oh, yeah, absolutely. Yeah. So there are things, right, where we have to know, I think,
558
00:31:53,740 -->
00:31:58,240
particularly things about malware, right? We do have to know how many people are being affected
559
00:31:58,380 -->
00:32:01,440
by a certain type of malware. And so this is actually getting into like malware statistics,
560
00:32:01,640 -->
00:32:07,980
you know, malware like data and telemetry. When we know what threats are hitting a populace,
561
00:32:08,080 -->
00:32:14,040
a user body, we can make our product better. It's honestly just that kind of simple.
562
00:32:14,520 -->
00:32:21,740
Now, can I go in and can I look up a user and can I see what they were hit with? Absolutely not.
563
00:32:22,040 -->
00:32:29,839
Like, absolutely not. The most I've ever been able to see is detection counts, right, for types of
564
00:32:29,860 -->
00:32:36,020
malware. That's my understanding of our, you know, how we look at what is important for making our
565
00:32:36,190 -->
00:32:39,980
product better. I think we're always going to need that, right? And I think a lot of websites, if we
566
00:32:40,040 -->
00:32:43,360
want to relate to websites, are going to feel the same way, right? They're going to need to see
567
00:32:43,760 -->
00:32:46,980
something as simple as like, are they getting traffic from a different country? And should
568
00:32:46,980 -->
00:32:51,540
they start supporting, let's say, translation services for that country, right? Are they
569
00:32:51,950 -->
00:32:58,419
getting a number of like errors from a certain region? And why is that? There needs to be some
570
00:32:58,440 -->
00:33:03,980
level of basic reporting to see both, you know, what's going wrong and what's going right. I work
571
00:33:04,140 -->
00:33:08,760
on Mauerbytes Labs, which is the blog. We need to know what the people read. Like we need to know,
572
00:33:08,940 -->
00:33:13,900
like, did this do well? Because that helps us become better journalists. Like it helps us see,
573
00:33:14,160 -->
00:33:18,100
okay, this is a story that's important to the people. And this is a story that isn't. And
574
00:33:18,340 -->
00:33:22,020
sometimes, right, a story that doesn't get clicks is still deeply important for news coverage.
575
00:33:22,440 -->
00:33:27,419
That doesn't lead 100% what we're doing. But we want to know if we're being useful. We want to
576
00:33:27,440 -->
00:33:32,740
know if we're being helpful. And we have a comment section, right? But who the hell wants to comment
577
00:33:32,900 -->
00:33:38,440
sometimes? That's another bar that you have to go through. So yeah, there are just some certain
578
00:33:38,600 -->
00:33:43,580
forms of analytics where to know that your website is functional, you do have to measure how people
579
00:33:43,780 -->
00:33:49,020
reach it and when and the experience they're having. Yeah, I think the analytic company is
580
00:33:49,300 -->
00:33:53,779
also really important. I saw you guys use Plausible, which has a much better privacy policy than Google
581
00:33:53,780 -->
00:33:56,040
or some of these other companies, which I think is pretty cool.
582
00:33:56,400 -->
00:33:59,820
Kind of the next big thing I want to open up here
583
00:33:59,820 -->
00:34:01,640
is the coalition against stalkerware,
584
00:34:01,740 -->
00:34:03,980
which I know is something that you guys have worked on.
585
00:34:04,120 -->
00:34:06,220
I only learned about this recently right before the interview.
586
00:34:06,460 -->
00:34:08,179
So do you want to touch on it a little bit
587
00:34:08,720 -->
00:34:10,060
for somebody who hasn't heard of it before?
588
00:34:11,060 -->
00:34:11,740
Yeah, absolutely.
589
00:34:12,139 -->
00:34:16,020
So stalkerware is this term that the public have agreed to use
590
00:34:16,220 -->
00:34:18,899
for mobile apps, particularly on Android,
591
00:34:19,240 -->
00:34:21,560
that can spy on a user non-consensually.
592
00:34:21,720 -->
00:34:22,700
They hide themselves from view.
593
00:34:22,899 -->
00:34:28,639
Sometimes they're disguised as like benign settings apps or photo editors, but their capabilities are rather extreme.
594
00:34:28,860 -->
00:34:32,179
They can see photos. They can see videos. They can retrieve deleted photos.
595
00:34:32,460 -->
00:34:38,300
They can record calls. They can keep those calls and make them accessible to another party.
596
00:34:38,460 -->
00:34:45,740
They can see GPS location. They can see GPS location history so they can show where someone has been for over, you know, I think about two weeks.
597
00:34:46,000 -->
00:34:52,780
I've tested them on test devices I have owned to kind of get a view into me, which is a bizarre experiment to run.
598
00:34:53,080 -->
00:35:04,480
But it's funny knowing that I have this type of app on my own dummy device and seeing what it can access is still shocking, even though I know 100% I'm the person running the experiment.
599
00:35:04,660 -->
00:35:08,480
And I'm still shocked at the level of invasion into my own life.
600
00:35:08,740 -->
00:35:11,700
They can turn off Wi-Fi remotely, which I think is horrid.
601
00:35:11,760 -->
00:35:12,480
I think that's terrible.
602
00:35:12,500 -->
00:35:15,340
I think that's a way to limit someone's communication capabilities.
603
00:35:15,560 -->
00:35:18,420
They can look at a screen as it's being used.
604
00:35:18,740 -->
00:35:22,440
They can hijack a camera to take photos without a person knowing.
605
00:35:22,840 -->
00:35:26,680
They can listen to a device's microphone, the audio that's being patched in.
606
00:35:26,840 -->
00:35:32,360
So if you have a phone on a table during a conversation, they can kind of listen to what's happening, what that conversation is.
607
00:35:32,660 -->
00:35:40,540
These, again, these apps are dubbed as stalkerware because, lo and behold, they are used in situations of stalking and domestic abuse, domestic violence.
608
00:35:41,300 -->
00:35:52,860
So many years ago, well, I say many, but maybe about six years ago, several cybersecurity companies, Malarbytes included, we got together with the National Network to End Domestic Violence, with Electronic Frontier Foundation, with a couple of other nonprofits.
609
00:35:53,820 -->
00:35:58,080
And we created a coalition, the Coalition Against Stockerware.
610
00:35:58,820 -->
00:36:01,120
And it was a simple, simple premise.
611
00:36:01,240 -->
00:36:11,240
What if someone could download any of our apps and they could trust that we would find whether or not one of these types of apps, you know, these invasive mobile apps was on their device, right?
612
00:36:11,620 -->
00:36:14,280
We know how to improve the detection capabilities of everyone.
613
00:36:14,990 -->
00:36:18,360
That way, protect everyone better and really just get the word out, right?
614
00:36:18,510 -->
00:36:18,980
Get the word out.
615
00:36:19,280 -->
00:36:19,800
Talk about this.
616
00:36:20,040 -->
00:36:20,560
Communicate it.
617
00:36:20,680 -->
00:36:24,780
I present every single year at a tech summit run by National Network to End Domestic Violence.
618
00:36:25,140 -->
00:36:28,900
Just telling people about what this threat is, what it looks like, what it can access and how they can stay safe.
619
00:36:29,090 -->
00:36:30,560
I think it's just a good thing.
620
00:36:30,640 -->
00:36:31,520
It's like a wonderful thing.
621
00:36:31,620 -->
00:36:35,100
It's like one of the things that you launch and you're happy about it and you're proud of it.
622
00:36:35,260 -->
00:36:44,460
And if people have questions about this, like if they have a question, honestly, about anything StockAware related, we have an email partners at StopStockAware.org.
623
00:36:44,740 -->
00:36:46,800
You know, StopStockAware.org, the website as well.
624
00:36:47,060 -->
00:36:49,940
Legitimately, if you just email us, we love that stuff.
625
00:36:50,180 -->
00:36:51,540
We love answering questions.
626
00:36:51,640 -->
00:36:55,580
We are so about just answering questions, helping people out, pulling our minds together.
627
00:36:55,840 -->
00:36:57,780
I think the organization is huge now.
628
00:36:57,900 -->
00:37:00,560
The coalition is at least 20-something members.
629
00:37:00,810 -->
00:37:03,680
One of us will have an answer about whatever it is.
630
00:37:04,100 -->
00:37:05,260
Whatever it is, we're going to have an answer.
631
00:37:06,060 -->
00:37:06,900
That's the coalition.
632
00:37:07,090 -->
00:37:07,940
We're still in effect today.
633
00:37:08,320 -->
00:37:10,800
We meet when we can, once a month on a good month.
634
00:37:11,900 -->
00:37:15,580
We are in so many countries that we sometimes just can't meet.
635
00:37:15,860 -->
00:37:16,820
Like, you can't meet at 3 a.m.
636
00:37:17,020 -->
00:37:18,120
The time differences are insane.
637
00:37:18,440 -->
00:37:19,300
But that's what we do.
638
00:37:19,400 -->
00:37:20,440
We're very, very happy with it.
639
00:37:20,700 -->
00:37:21,660
Yeah, it's great.
640
00:37:21,860 -->
00:37:22,620
I'm such a fan of it.
641
00:37:22,740 -->
00:37:24,700
Yeah, so people hear about this, and I'm sure they go,
642
00:37:24,760 -->
00:37:29,380
oh, that's spooky, imagining just pretty much the equivalent of someone standing behind them
643
00:37:29,620 -->
00:37:33,820
secretly their entire day. And it's easy to start, like, let's say someone's driving right now,
644
00:37:34,040 -->
00:37:37,800
listening to this, they're going, oh my gosh, is this on my phone? How can I know? It's easy to get
645
00:37:37,860 -->
00:37:41,800
in your head when you hear about it. So what are kind of the signs that someone can look for,
646
00:37:41,940 -->
00:37:45,040
or if they really just want the peace of mind? Or maybe you can also talk prevention,
647
00:37:45,540 -->
00:37:49,540
kind of what are the main things, maybe the top three in all these areas that you think people
648
00:37:49,660 -->
00:37:54,080
should know about? Yeah, absolutely. This is something I've been talking about for so long,
649
00:37:54,180 -->
00:37:59,580
Right. And it's such a good opportunity to get to talk about it. One of the most difficult things I'd say for someone who's worried about this.
650
00:38:00,000 -->
00:38:04,620
And I completely understand. Right. You hear these capabilities. They are scary. They are frightening.
651
00:38:04,850 -->
00:38:13,260
I think a lot of the problems, though, with, let's say, diagnosing whether or not someone has this on their device is that you cannot diagnose this based off of symptoms.
652
00:38:13,560 -->
00:38:21,380
Right. The symptoms here really, really plainly that we hear about directly is that someone knows something they're not supposed to.
653
00:38:21,620 -->
00:38:28,220
Right. Someone knew a conversation I had that I thought was private. Someone knew where I was that I thought was private.
654
00:38:28,560 -->
00:38:33,060
Someone knows that I visited my mom, that I went to my sister's last night. Someone knows that I was at a bar.
655
00:38:33,340 -->
00:38:38,800
All of these things. Right. It's someone knowing something they shouldn't and kind of using that information for control.
656
00:38:39,080 -->
00:38:54,640
What makes this so difficult, again, to diagnose strictly as, oh, there is stalkerware or a stalkerware type app on your device, is that a lot of that information can also be stolen through things like Bluetooth trackers, right?
657
00:38:55,010 -->
00:39:00,000
We know that tiles and Apple AirTags, that they're abused, right?
658
00:39:00,230 -->
00:39:06,440
We know that there are precautionary measures by these companies, but we know that these are slipped into purses, into jackets.
659
00:39:06,900 -->
00:39:09,460
They're hidden behind license plates on cars.
660
00:39:09,760 -->
00:39:11,440
We know that they're abused to reveal location.
661
00:39:11,760 -->
00:39:14,520
We know, as Malwarebytes has done a lot of this research before,
662
00:39:14,800 -->
00:39:16,180
we know that accounts are abused.
663
00:39:17,160 -->
00:39:21,080
Abusive exes know the passwords of their ex-partners.
664
00:39:21,880 -->
00:39:24,780
And you can find out so much from something as simple as,
665
00:39:25,080 -->
00:39:26,920
let's say, your Gmail password.
666
00:39:27,360 -->
00:39:29,460
Because some people, it's not just their email.
667
00:39:30,120 -->
00:39:32,460
It's also where they store their photos.
668
00:39:32,940 -->
00:39:36,160
And you can also know a lot from an Instagram password.
669
00:39:36,460 -->
00:39:43,280
You can know a lot based on the fact whether or not you were tagged in someone's photo the night before, whether or not you're in someone's story.
670
00:39:43,440 -->
00:39:45,740
Your privacy is not managed only by you.
671
00:39:45,820 -->
00:39:46,880
It's also managed by your friends.
672
00:39:47,520 -->
00:39:53,840
So there are so many ways that this information can be revealed, can be exposed through so many different means.
673
00:39:54,060 -->
00:40:00,980
Right. It's not just a stock aware type app, a monitoring app that we say, hey, let's not race to conclusions.
674
00:40:01,480 -->
00:40:03,160
Let's not worry. There's so many things we can do.
675
00:40:03,640 -->
00:40:08,660
So if you do want peace of mind, right, our free tool has a scanner.
676
00:40:09,400 -->
00:40:17,380
And I always say that if someone is in a situation of domestic violence, to not run the scanner immediately before they have a safety plan.
677
00:40:17,820 -->
00:40:25,920
Because if we go in there and we find this type of app and we withdraw it, if we remove it, the abuser also loses access to the device.
678
00:40:26,170 -->
00:40:28,900
That could cause anger. That could cause another emergency, right?
679
00:40:29,000 -->
00:40:31,920
So we're not in there saying, hey, do this for your safety planning.
680
00:40:32,240 -->
00:40:33,240
We are a cybersecurity company.
681
00:40:33,520 -->
00:40:35,680
We do not have those kinds of guides and rules.
682
00:40:36,040 -->
00:40:40,140
However, the National Network to End Domestic Violence is phenomenal on this.
683
00:40:40,290 -->
00:40:42,920
The National Domestic Violence Hotline is phenomenal on this.
684
00:40:43,040 -->
00:40:44,240
They know about these threats.
685
00:40:44,350 -->
00:40:45,900
They know about tech-enabled abuse.
686
00:40:46,030 -->
00:40:47,180
They know about stalkerware.
687
00:40:47,400 -->
00:40:49,780
So we always say, again, if you are in this situation,
688
00:40:50,340 -->
00:40:53,700
please, please, please have a safety plan in place first.
689
00:40:54,120 -->
00:40:56,320
In terms of preventing, in terms of, you know,
690
00:40:56,390 -->
00:40:57,900
hey, how do I make sure this doesn't happen on me?
691
00:40:58,100 -->
00:41:00,680
Every single case of a stalkerware-type app I've seen before,
692
00:41:00,940 -->
00:41:06,000
Every single case is installed locally, is installed on the device, has access to the
693
00:41:06,180 -->
00:41:06,360
device.
694
00:41:06,440 -->
00:41:07,120
It is not remote.
695
00:41:07,340 -->
00:41:09,640
We implore people to always have device passcodes.
696
00:41:10,120 -->
00:41:10,900
Like that's it.
697
00:41:11,060 -->
00:41:13,600
Now, I know that's easier said than done in a lot of situations.
698
00:41:13,840 -->
00:41:14,760
Some people share devices.
699
00:41:15,160 -->
00:41:19,660
Some people in abusive relationships are coerced into not having a password or into having
700
00:41:19,680 -->
00:41:20,420
a shared password.
701
00:41:20,760 -->
00:41:24,600
But again, device access is like the first step.
702
00:41:24,920 -->
00:41:27,280
So device passcodes are super, super important.
703
00:41:27,780 -->
00:41:31,740
After that, we're getting into situations of like, how do you stay safe against an abuser?
704
00:41:31,920 -->
00:41:34,540
And again, we're a cybersecurity company, so we're not the pros on that.
705
00:41:35,220 -->
00:41:37,500
But I can tell you that device passcodes are super important.
706
00:41:37,760 -->
00:41:38,720
I know it sounds really basic.
707
00:41:38,820 -->
00:41:39,760
I know it sounds really simple.
708
00:41:40,220 -->
00:41:41,480
It is that simple.
709
00:41:41,560 -->
00:41:42,180
It is that basic.
710
00:41:42,860 -->
00:41:45,640
It's a powerful, powerful gate against this stuff.
711
00:41:46,080 -->
00:41:51,060
I assume that you guys treat this separately from government-based spyware, things like Pegasus,
712
00:41:51,260 -->
00:41:54,420
or do you kind of group this in the same bucket from your perspective?
713
00:41:54,740 -->
00:41:56,079
This is different, 100%.
714
00:41:56,100 -->
00:41:59,360
Thank you so much for asking about it, because I do think that I know this.
715
00:41:59,510 -->
00:42:04,220
I know that some folks will come to us with questions about Pegasus specifically.
716
00:42:05,000 -->
00:42:11,820
I've done presentations, again, for these audiences, for domestic violence, like advocates for support groups and networks.
717
00:42:12,520 -->
00:42:14,600
And I get questions directly about Pegasus.
718
00:42:15,220 -->
00:42:21,340
Things like Pegasus, which is a nation-state surveillance program, right?
719
00:42:21,480 -->
00:42:23,680
I think it's best to not think of Pegasus as an app.
720
00:42:23,740 -->
00:42:33,020
I think it's best to think of Pegasus as like an economy at this point, a clandestine surveillance economy that is supported by oppressive governments.
721
00:42:33,480 -->
00:42:35,300
Like, that's it. They're oppressive governments.
722
00:42:35,640 -->
00:42:39,820
You never read a story about like Pegasus was used to stop a credible attack, right?
723
00:42:40,040 -->
00:42:51,880
You read stories about, this is true, Pegasus was used to spy on health scientists in Mexico who personally came out against or they personally favored us attacks on sodas.
724
00:42:52,260 -->
00:42:56,040
they're like yeah so does bad we we support attacks on it hit with pegasus that doesn't
725
00:42:56,040 -->
00:43:00,800
make any sense you see pegasus used on daughters of royalty uh again in oppressive regimes who are
726
00:43:00,810 -->
00:43:06,000
trying to escape you see pegasus used against journalists against human rights dissidents you
727
00:43:06,000 -->
00:43:10,060
know um activists that's the reputation pegasus has from public reporting and again that is
728
00:43:10,150 -->
00:43:16,339
something that we classify to be perfectly honest i don't know if we find pegasus like and i you know
729
00:43:16,360 -->
00:43:26,760
I say that like as nakedly, honestly, as I can, because the folks I do know who find Pegasus, right, Amnesty International, and there's a lab out of the University of Toronto.
730
00:43:27,260 -->
00:43:28,100
I think it's Citizen Lab.
731
00:43:28,400 -->
00:43:32,920
They do very, very difficult technical work in identifying whether Pegasus is on a device.
732
00:43:33,520 -->
00:43:43,240
And that requires a sort of iCloud backup process where you create a copy of your device and then Citizen Lab is able to analyze that backup.
733
00:43:43,640 -->
00:43:45,060
Pegasus is installed without a click.
734
00:43:45,500 -->
00:43:47,420
You know, Pegasus is installed without anything.
735
00:43:47,680 -->
00:43:49,840
Like, it is a devil of software.
736
00:43:50,120 -->
00:43:52,000
It is absolutely dreadful.
737
00:43:52,210 -->
00:43:53,900
It is highly technically capable.
738
00:43:54,300 -->
00:43:59,920
It exists in the margins of what we understand of, like, computing.
739
00:44:00,300 -->
00:44:01,380
And they just keep doing it.
740
00:44:01,880 -->
00:44:03,800
You know, we keep finding exploits.
741
00:44:03,870 -->
00:44:04,900
We keep shutting them down.
742
00:44:04,970 -->
00:44:09,920
And I say we, I mean, all credit to, again, Citizen Lab, Amnesty International, to Google
743
00:44:10,090 -->
00:44:10,500
Project Zero.
744
00:44:10,810 -->
00:44:13,960
All credit goes to these insanely capable researchers.
745
00:44:14,660 -->
00:44:19,960
But NSO Group, who makes Pegasus, has funding to keep finding and keep purchasing exploits.
746
00:44:20,220 -->
00:44:21,920
So yeah, that's a different class.
747
00:44:22,120 -->
00:44:23,520
That is world surveillance, man.
748
00:44:23,740 -->
00:44:26,160
That's a different, different caliber.
749
00:44:26,700 -->
00:44:27,780
It's such a beast.
750
00:44:28,460 -->
00:44:32,000
Yeah, before I get a little bit more into your own privacy stack here,
751
00:44:32,370 -->
00:44:35,860
you kind of mentioned it's mostly on Android devices, these stockware apps.
752
00:44:36,320 -->
00:44:37,360
Do you want to expand on that a bit?
753
00:44:38,180 -->
00:44:39,500
Yes, thanks for the opportunity there.
754
00:44:39,760 -->
00:44:41,120
So it is mostly on Android devices.
755
00:44:41,540 -->
00:44:49,800
To be clear, also, I have never personally seen a stockholder type app work on iOS natively.
756
00:44:50,040 -->
00:44:51,260
Like, I just haven't seen it.
757
00:44:51,260 -->
00:44:54,900
I've seen some that require jailbreaking a device.
758
00:44:55,360 -->
00:44:58,440
What I've seen more often is an install path.
759
00:44:58,520 -->
00:45:01,880
I've seen apps that say, you know, this works on Android and iOS.
760
00:45:02,260 -->
00:45:08,980
And when you get down into like the nitty gritty, the install, the requirement is that an iCloud password is required to install.
761
00:45:10,020 -->
00:45:10,500
I'm sorry, man.
762
00:45:10,620 -->
00:45:13,440
Once you have an iCloud password, that's not like a monitoring application.
763
00:45:13,800 -->
00:45:14,680
That's just account abuse.
764
00:45:15,120 -->
00:45:17,280
That's just, hey, you have access to someone's account.
765
00:45:17,500 -->
00:45:20,100
And yeah, okay, you can see their photos, their videos.
766
00:45:20,410 -->
00:45:22,060
If they back up their messages, their messages.
767
00:45:22,150 -->
00:45:24,400
If they back up their notes app, you know, you can see their notes.
768
00:45:24,800 -->
00:45:27,620
That's a very different type of, it's still abuse.
769
00:45:28,100 -->
00:45:30,760
It's still surveillance in a way, but it's a different kind of install.
770
00:45:31,100 -->
00:45:33,020
We do see it, however, on Android.
771
00:45:33,150 -->
00:45:37,380
And I actually think one of the reasons for that is actually a lot clearer than some people might think.
772
00:45:37,540 -->
00:45:39,740
Android is the number one operating system in the world.
773
00:45:40,020 -->
00:45:45,800
Actually, by the number of devices that it runs on, Android is the number one operating system in the world.
774
00:45:46,080 -->
00:45:46,940
And that's it.
775
00:45:47,260 -->
00:45:51,940
Like, these developers are trying to make a quick buck off of a terrible piece of software.
776
00:45:52,380 -->
00:45:59,120
They're going to make this piece of software for the biggest, you know, they're going to cast the widest net for the most fish, right, to put a dreadful metaphor on it.
777
00:45:59,200 -->
00:46:00,300
They're going to keep making it on Android.
778
00:46:00,620 -->
00:46:02,720
Also, sometimes these apps get shut down.
779
00:46:02,920 -->
00:46:08,380
I've spoken to a researcher before who said that they have personally, like, investigated multiple of these apps before.
780
00:46:08,900 -->
00:46:11,260
And they said the code base is pretty much a copy-paste job, right?
781
00:46:11,440 -->
00:46:11,940
It's just the same.
782
00:46:12,400 -->
00:46:14,320
And so they're like, I think what people are doing,
783
00:46:14,440 -->
00:46:15,900
what developers are doing,
784
00:46:16,600 -->
00:46:18,120
is that they are copying and pasting
785
00:46:18,480 -->
00:46:20,560
and they're republishing as many times as possible.
786
00:46:21,020 -->
00:46:23,100
And if they get one taken down, oh, well, that's fine.
787
00:46:23,180 -->
00:46:25,760
They have 12 other shops in 12 other countries
788
00:46:25,950 -->
00:46:27,080
with 12 different websites.
789
00:46:27,600 -->
00:46:28,460
They're just going to keep doing that.
790
00:46:28,650 -->
00:46:31,120
And they're going to get the scraps of payment that they can
791
00:46:31,270 -->
00:46:32,800
through a numbers game, a pure numbers game.
792
00:46:33,100 -->
00:46:35,920
So it runs, again, we've seen it
793
00:46:36,490 -->
00:46:38,460
only in the strictest sense on Android.
794
00:46:39,519 -->
00:46:43,200
So you don't think that there's technical differences,
795
00:46:43,780 -->
00:46:47,300
like sideloading being a little bit easier on Android,
796
00:46:47,450 -->
00:46:50,600
and also maybe how it's a little bit easier to get system-wide access on Android?
797
00:46:50,670 -->
00:46:53,840
Do you think that's also a part of it, or do you think it's mostly just popular?
798
00:46:54,110 -->
00:46:55,400
Yeah, that's a part of it.
799
00:46:55,520 -->
00:46:58,060
I think I always front-load with Android being popular,
800
00:46:58,370 -->
00:47:00,960
because I think a lot of our audience, when we talk about this stuff,
801
00:47:01,050 -->
00:47:01,900
they just want to know if they're safe.
802
00:47:02,630 -->
00:47:06,060
And I am always so worried about saying,
803
00:47:06,320 -->
00:47:10,740
The message being anyone in this audience who has an Android, you're not safe, right?
804
00:47:10,830 -->
00:47:13,000
I don't want that to be the message that they get.
805
00:47:13,210 -->
00:47:16,320
And so I try and front load with like, actually, there's financial reasons.
806
00:47:16,640 -->
00:47:17,440
There's logistical reasons.
807
00:47:17,840 -->
00:47:18,240
But you're right.
808
00:47:18,390 -->
00:47:19,500
Android is a more open environment.
809
00:47:19,690 -->
00:47:20,340
I used to have an Android.
810
00:47:20,390 -->
00:47:20,900
I loved it.
811
00:47:20,990 -->
00:47:26,660
You know, but the level of access that you can have and the ethos, you know, of like what
812
00:47:26,840 -->
00:47:30,500
you're allowed to load, like you said, side loading for everything I love.
813
00:47:30,740 -->
00:47:31,840
I love that environment.
814
00:47:32,340 -->
00:47:36,160
It does allow strictly third-party apps not listed on Google Play.
815
00:47:36,960 -->
00:47:38,120
I mean, you can drag and drop the stuff.
816
00:47:39,400 -->
00:47:39,740
That's it.
817
00:47:39,760 -->
00:47:42,120
You can drag and drop the stuff, and it's very easy to load.
818
00:47:42,180 -->
00:47:43,180
Double-edged sword, yeah.
819
00:47:43,800 -->
00:47:48,800
Do you want to just quickly touch on kind of your own tools you use behind the scenes,
820
00:47:49,200 -->
00:47:50,900
whether they're privacy, security-related,
821
00:47:51,380 -->
00:47:53,440
just to give people some insight on what you do behind the scenes
822
00:47:53,500 -->
00:47:58,000
and maybe some recommendations you have to share with people before we head out?
823
00:47:58,820 -->
00:47:59,500
Yeah, absolutely.
824
00:47:59,860 -->
00:48:00,920
So super basic, right?
825
00:48:01,060 -->
00:48:02,240
I tell everybody to do this.
826
00:48:02,340 -->
00:48:05,400
I tell just everybody, if you're using Google Chrome, please stop using Google Chrome.
827
00:48:05,640 -->
00:48:06,040
I use Brave.
828
00:48:06,120 -->
00:48:09,320
I also use Mauerbytes' browser plugin, BrowserGuard.
829
00:48:09,440 -->
00:48:11,920
Any third-party tracker blocker, right?
830
00:48:12,080 -->
00:48:14,760
That's what I'm trying to also use with my browser.
831
00:48:15,020 -->
00:48:17,900
I know it's silly that those are like the two things that I recommend because they're
832
00:48:18,040 -->
00:48:22,400
so simple, but I do think most of our audience is looking for like one thing to do.
833
00:48:22,640 -->
00:48:23,280
And I think that's fine.
834
00:48:23,340 -->
00:48:24,760
But if you're trying to do more, absolutely.
835
00:48:25,140 -->
00:48:27,240
This is something I've been trying to do for, I'd say, a year.
836
00:48:27,480 -->
00:48:29,620
I am trying to just get rid of Google, like in my life.
837
00:48:29,940 -->
00:48:31,560
I have gotten rid of Chrome.
838
00:48:31,720 -->
00:48:32,740
I've gotten rid of Google search.
839
00:48:32,900 -->
00:48:34,500
I do not use Google Maps anymore.
840
00:48:34,860 -->
00:48:36,840
I am trying to get myself off of Google Drive.
841
00:48:37,340 -->
00:48:40,080
So I'm taking all of my photos and relevant information that I can.
842
00:48:40,180 -->
00:48:41,600
I'm trying to put them on Proton Drive.
843
00:48:42,100 -->
00:48:44,880
Also trying to get rid of Gmail and move to ProtonMail.
844
00:48:45,000 -->
00:48:45,780
That takes time, right?
845
00:48:46,020 -->
00:48:48,520
And it's okay that this process takes time.
846
00:48:48,740 -->
00:48:49,140
It's okay.
847
00:48:49,460 -->
00:48:50,500
It's like, that's entirely fine.
848
00:48:50,620 -->
00:48:53,300
I have deactivated what I can for my socials.
849
00:48:53,740 -->
00:48:56,760
I have like removed my data that I can.
850
00:48:56,780 -->
00:49:00,000
You can do a data removal, a data deletion request from Facebook.
851
00:49:00,280 -->
00:49:01,780
I recommend that.
852
00:49:01,820 -->
00:49:02,460
I think that's great.
853
00:49:02,740 -->
00:49:05,340
I also use Mauerbytes as tools, right?
854
00:49:05,600 -->
00:49:13,660
I use our personal data remover to get my name, my biographical information off of what are called like people search sites, right?
855
00:49:13,880 -->
00:49:18,720
So if someone wants to find my phone number, I think they could have very easily have done that maybe a year ago.
856
00:49:19,200 -->
00:49:25,740
Now, a little bit harder, again, because Mauerbytes goes through and it makes these requests and says, hey, David's making a request to pull that information down.
857
00:49:25,840 -->
00:49:27,280
I think that stuff is lovely.
858
00:49:27,340 -->
00:49:27,940
I think that's wonderful.
859
00:49:28,579 -->
00:49:30,920
Yeah, that's, I'd say, the technological stack.
860
00:49:31,180 -->
00:49:32,100
And it's a super basic stack.
861
00:49:32,240 -->
00:49:32,520
Again, right?
862
00:49:32,540 -->
00:49:33,420
I just use a different browser.
863
00:49:33,580 -->
00:49:34,520
I use a different search engine.
864
00:49:34,640 -->
00:49:35,500
I don't think that's that crazy.
865
00:49:36,000 -->
00:49:37,620
Behaviorally, I ask every single person
866
00:49:37,700 -->
00:49:39,560
if I can post a photo, you know, about them.
867
00:49:39,800 -->
00:49:40,680
Like that's, I think that,
868
00:49:40,740 -->
00:49:41,820
I think they have a right to privacy.
869
00:49:42,200 -->
00:49:43,400
I don't post a lot of photos.
870
00:49:43,700 -->
00:49:45,780
I do not share my location with anybody.
871
00:49:46,080 -->
00:49:47,900
My wife does not share her location with me.
872
00:49:48,080 -->
00:49:50,140
We do not believe in that level of monitoring
873
00:49:50,420 -->
00:49:51,720
in a romantic relationship.
874
00:49:51,880 -->
00:49:52,360
We just don't.
875
00:49:52,380 -->
00:49:53,620
I know a lot of people do.
876
00:49:53,940 -->
00:49:54,400
We don't.
877
00:49:54,600 -->
00:49:57,760
we have conversations about what is private and what is not private.
878
00:49:58,760 -->
00:50:01,500
Behaviorally, it's really just trying to be a privacy maximalist.
879
00:50:01,660 -->
00:50:05,040
I think it's important that people have the agency to be who they want to be.
880
00:50:05,160 -->
00:50:07,700
And I think that, I know this kind of sounds kind of crazy,
881
00:50:07,780 -->
00:50:10,160
I think even posting a photo of someone without their consent,
882
00:50:10,560 -->
00:50:13,820
even if it's on Instagram, I think that carves out a little bit of their agency.
883
00:50:14,120 -->
00:50:15,360
And so I try not to do those things.
884
00:50:15,500 -->
00:50:19,960
I think it's just everyone should own and act on who they are in their own right.
885
00:50:20,220 -->
00:50:22,800
And privacy is the path towards that.
886
00:50:23,820 -->
00:50:25,520
So yeah, it's just, that's it.
887
00:50:25,620 -->
00:50:27,440
It's just not telling people what I do.
888
00:50:28,400 -->
00:50:28,680
That's it.
889
00:50:28,820 -->
00:50:29,140
Cool.
890
00:50:29,230 -->
00:50:30,480
Well, do you have any final words, David,
891
00:50:30,720 -->
00:50:32,300
before we head off?
892
00:50:33,240 -->
00:50:35,300
Yeah, I would say thank you so much.
893
00:50:35,800 -->
00:50:37,040
Obviously, thank you for this time.
894
00:50:37,500 -->
00:50:38,440
But for folks at home,
895
00:50:38,650 -->
00:50:40,580
I would say that one of the most annoying things I hear
896
00:50:40,580 -->
00:50:41,640
is that people think that privacy
897
00:50:41,690 -->
00:50:42,940
is about having something to hide.
898
00:50:43,180 -->
00:50:46,420
I just try whenever, whenever, whenever possible
899
00:50:46,780 -->
00:50:47,640
to help people understand
900
00:50:47,860 -->
00:50:49,680
privacy is not about having something to hide.
901
00:50:49,800 -->
00:50:51,600
Privacy is about having the opportunity
902
00:50:52,000 -->
00:50:52,820
to choose who you are.
903
00:50:53,020 -->
00:50:58,660
that that's it. There are so many things at play that want to determine who you are for money,
904
00:50:58,860 -->
00:51:04,060
right? Targeted advertising wants to determine who you are for money. There are governments that want
905
00:51:04,140 -->
00:51:08,820
to determine who you are for their own purposes. There are family members who want to determine
906
00:51:08,850 -->
00:51:13,820
who you are, sometimes maliciously, sometimes not. There are romantic partners. Privacy is the space
907
00:51:13,850 -->
00:51:17,040
where you're allowed to be who you are. And importantly, privacy is the space where you
908
00:51:17,280 -->
00:51:22,460
are allowed to be wrong about something and to grow from it. So I think, you know, some of the
909
00:51:22,480 -->
00:51:27,320
things that we do and we did is like maybe 13 year olds. It's okay, you know, to be wrong about
910
00:51:27,480 -->
00:51:32,760
something as a child. And I worry that we're removing that period of time where you can be
911
00:51:32,800 -->
00:51:37,000
an oaf, you can make some blunders, you can be silly, you can be embarrassing, you know, you don't
912
00:51:37,000 -->
00:51:41,380
have to be on video to be like, I think it's too high a price. And I'm not even saying about like,
913
00:51:41,620 -->
00:51:45,220
I'm not even trying to like talk about kids who are on like, video games, like,
914
00:51:46,100 -->
00:51:50,020
doling out hate speech. Like, it's not even that. It's just like, you know, you see a kid who's
915
00:51:50,040 -->
00:51:53,700
dancing awkwardly at a high school dance
916
00:51:53,740 -->
00:51:55,720
and the internet blows up on him.
917
00:51:55,760 -->
00:51:57,060
And it's like, why are we doing this?
918
00:51:57,540 -->
00:51:59,860
Everyone is afforded privacy to be a little silly,
919
00:52:00,060 -->
00:52:02,000
be a little oafish, be a little you
920
00:52:02,360 -->
00:52:05,240
in a way that does not bring judgment so immediately.
921
00:52:05,440 -->
00:52:06,460
So yeah, that's all.
922
00:52:06,760 -->
00:52:08,000
Got it. Well, thank you so much, David.
923
00:52:08,060 -->
00:52:09,200
There was a lot of good insight here.
924
00:52:10,120 -->
00:52:10,960
And I hope that people,
925
00:52:12,280 -->
00:52:14,280
I like the way that you spoke on privacy
926
00:52:14,340 -->
00:52:15,140
is just a broader mission,
927
00:52:15,380 -->
00:52:18,380
but also more the specifics like the scam advice,
928
00:52:18,680 -->
00:52:20,200
which is universal, not just the World Cup.
929
00:52:20,340 -->
00:52:22,620
I know it's huge right now, and I know you guys are seeing that back there.
930
00:52:22,820 -->
00:52:25,300
I really appreciate you coming on and sharing all this good advice,
931
00:52:25,470 -->
00:52:27,660
and I hope that it's useful for everyone who listened.
932
00:52:27,920 -->
00:52:29,400
I want to thank you for your time as well, David.
933
00:52:30,220 -->
00:52:33,440
Thank you for everything, and I'd love to have you back on sometime.
934
00:52:34,440 -->
00:52:34,760
Thank you.
935
00:52:35,680 -->
00:52:36,580
That's great. Thank you so much.
936
00:52:36,790 -->
00:52:37,780
Thanks to all your listeners, my goodness.
937
00:52:38,300 -->
00:52:40,560
What really stuck with me here in this interview with David
938
00:52:40,880 -->
00:52:44,460
is how a lot of the things he focused on were behavior-based.
939
00:52:45,280 -->
00:52:48,360
I think it's always a good reminder that when technology changes,
940
00:52:48,620 -->
00:52:51,320
the humans behind the technology typically don't.
941
00:52:51,350 -->
00:52:54,320
And so even when we see these scams get more and more sophisticated,
942
00:52:55,140 -->
00:52:58,640
ultimately the same fundamental truths are overall true.
943
00:52:58,870 -->
00:53:01,260
And I think that's why David really leaned into those
944
00:53:01,600 -->
00:53:03,260
for his advice on avoiding these things.
945
00:53:03,640 -->
00:53:06,640
And it's also a lot easier to share that advice with friends and family.
946
00:53:06,790 -->
00:53:08,820
It was also great to hear about his advocacy work
947
00:53:08,850 -->
00:53:10,740
and what it looks like to actually be involved.
948
00:53:10,850 -->
00:53:14,640
And I hope that can inspire some of you to get involved locally in your issues as well.
949
00:53:14,840 -->
00:53:18,380
If you want to stay ahead of things and get ahead of whatever's going on
950
00:53:18,380 -->
00:53:22,460
digital threats out there. I recommend checking out the surveillance support newsletter down in
951
00:53:22,500 -->
00:53:27,540
the description. It's built for doing just that. It's free. I publish it every Wednesday. There's
952
00:53:27,540 -->
00:53:32,620
no ad network deciding what you see. So you just get that email newsletter inbox with just the news
953
00:53:32,620 -->
00:53:37,160
you need to know and what to do about it to stay active in the fight. Thanks so much for watching,
954
00:53:37,400 -->
00:53:39,100
and I'll see you next time on Techlore.
