Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Welcome,

Good Monday morning, everybody. Craig Peterson here. I was on with Jack Heath this morning. We talked about an article that Jack posted on Facebook about a Chinese National working for an American Military Contractor who gave our Military Secrets to China. Here we go with Jack.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Automated Machine Transcript:

Craig
Taking a laptop, even if you are not a Chinese spy, to China is has a high probability that information on that laptop disappears while you're over there.

Craig
Hey, good morning, everybody. Craig Peterson here. This morning Jack wrote about an article on Facebook about what's been happening here in New England with Chinese infiltration and spying on military companies and contractors. We got into it this morning. Here we go.

Jack Heath
On top of the lack of social technology, getting US pictures out of places like you know where the host city you have China, basically muscling technology and stealing it allegedly from us. You look at this 10-year engineer, Chinese born American who was just picked up over the weekend by the FBI for allegedly taking his secure Raytheon laptop to China on a trip last year. It is a federal offense for someone with high-security clearance to take technology capable of accessing things like our weapon system technology out of the country. Then the Harvard story. Last week, which you haven't heard much more about the professor, one or two professors charged with getting $50,000 a month from a bogus Chinese University, from the Chinese government to recruit and steal intellectual capital from Harvard. Those are big stories, and it shows the dichotomy between the people having access and the government using it to get more technology for the government and stealing our intellectual capital. Some interest there, and maybe a comment on that Craig Peterson joins us live in the author listener lines, our Tech Talk guy, Good morning, Craig.

Craig
Hey, good morning, jack. Yeah, and the last few months we've got this Chinese Harvard affiliated cancer researcher caught in December with 21 vials Cells stolen from a lab at a Boston hospital. We've got a Chinese Professor conducting surveillance Research at the University of Kansas indicted in August on charges for his ties to Chinese University. We've got a Chinese PLA Lieutenant posing as a student here at Boston University. The fact that she was a lieutenant in the Chinese military. She was a spy and a Chinese scholar. Another at the University of California. The list goes on and on. You talked a little bit, and you posted on Facebook about the Raytheon employee taking a laptop to China. The company told him not only was it against company policy to travel with a company computer that might have some proprietary information on it but was against federal law. And we see this a lot. There's a lot of ignorance out there amongst people who do take laptops with them to China. I've been warning about that for the last ten years because taking a portable computer, even if you are not a Chinese spy, to China presents a high probability of exfiltration of that data from that laptop while you're over there. Now the infiltration of soft targets in the last few years, our universities where Chinese students are coming over. As I mentioned earlier, Chinese military Lieutenants are coming over to universities posing as students and being assigned to research projects and stealing stuff. The federal ITAR requirements are ones we are dealing with all the time with some of our clients. We have military sub-subcontractors that are making things as simple as screws, Jack, and their products ultimately get used in some military system. Many of these companies are not being careful with our data, and it gets stolen. They have no clue that they're exposing all of us to these dangers.

Jack
Craig, I think you may know, I'm not sure, but I had the benefit of some of the knowledge learned when I was the US Army War College. I'll keep that quiet. One of the things I did learn is when you look at the global threats to our security in a lot of different things, and we're seeing differences right now with China. Everything in the last year or two or four years politically speaking has been Russia, Russia, the Russians, Russia, Russia, you know, you know, Vladimir Putin. However, the real threat is China. When you look at Russia, I'm not saying Russia did not try to metal. I'm not saying they won't try and metal, and they will try and battle and mess up in our elections. But China's looks like a real threat. They are from a technology stealing point of view, one of the businesses but penetrating universities. Raytheon is a pretty secure fourth-largest defense giant, the real stuff, real concern.

Craig
It is a considerable concern, and you know, we were talking about the military and You know, the, obviously the contractors and what China's doing. But you see what jacks are doing this to our regular businesses. I have a client that came to me, became a client who came to me because, as it turns out, something was weird with his email. When we started looking into it, and I had one of my fire jumper certified guys get into it more, we found Chinese backdoors in their systems that were actively exfiltrating data out. His designs, the ones he developed over his whole lifetime, he was getting ready to retire. Now the Chinese had all of his intellectual property, all the research methods used to make the products, his customer lists, his pricing. That means he gets to compete against his very own designs made by Chinese manufacturers and sold worldwide. His business is out of business, and we're not even talking about the military here.

Jack
All right Craig Peterson on this Monday morning. Appreciate it.

Craig
All right everybody, hopefully, you've been able to check it out online let me know what you think I've been posting these morning interviews over on YouTube and Facebook, doing them as audiograms. I do have all the camera gear, but it takes so much time, and I haven't had time to do it. Let me know what you think you do like these audiograms. By all means, subscribe to my YouTube channel or follow me over on Facebook and drop me a line - at me at Craig Peterson dot com. Take care of everybody. Be back tomorrow.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome,

Good Monday morning, everybody. Craig Peterson here. I was on with Jack Heath this morning. We talked about an article that Jack posted on Facebook about a Chinese National working for an American Military Contractor who gave our Military Secrets to China. Here we go with Jack.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Automated Machine Transcript:

Craig
Taking a laptop, even if you are not a Chinese spy, to China is has a high probability that information on that laptop disappears while you're over there.

Craig
Hey, good morning, everybody. Craig Peterson here. This morning Jack wrote about an article on Facebook about what's been happening here in New England with Chinese infiltration and spying on military companies and contractors. We got into it this morning. Here we go.

Jack Heath
On top of the lack of social technology, getting US pictures out of places like you know where the host city you have China, basically muscling technology and stealing it allegedly from us. You look at this 10-year engineer, Chinese born American who was just picked up over the weekend by the FBI for allegedly taking his secure Raytheon laptop to China on a trip last year. It is a federal offense for someone with high-security clearance to take technology capable of accessing things like our weapon system technology out of the country. Then the Harvard story. Last week, which you haven't heard much more about the professor, one or two professors charged with getting $50,000 a month from a bogus Chinese University, from the Chinese government to recruit and steal intellectual capital from Harvard. Those are big stories, and it shows the dichotomy between the people having access and the government using it to get more technology for the government and stealing our intellectual capital. Some interest there, and maybe a comment on that Craig Peterson joins us live in the author listener lines, our Tech Talk guy, Good morning, Craig.

Craig
Hey, good morning, jack. Yeah, and the last few months we've got this Chinese Harvard affiliated cancer researcher caught in December with 21 vials Cells stolen from a lab at a Boston hospital. We've got a Chinese Professor conducting surveillance Research at the University of Kansas indicted in August on charges for his ties to Chinese University. We've got a Chinese PLA Lieutenant posing as a student here at Boston University. The fact that she was a lieutenant in the Chinese military. She was a spy and a Chinese scholar. Another at the University of California. The list goes on and on. You talked a little bit, and you posted on Facebook about the Raytheon employee taking a laptop to China. The company told him not only was it against company policy to travel with a company computer that might have some proprietary information on it but was against federal law. And we see this a lot. There's a lot of ignorance out there amongst people who do take laptops with them to China. I've been warning about that for the last ten years because taking a portable computer, even if you are not a Chinese spy, to China presents a high probability of exfiltration of that data from that laptop while you're over there. Now the infiltration of soft targets in the last few years, our universities where Chinese students are coming over. As I mentioned earlier, Chinese military Lieutenants are coming over to universities posing as students and being assigned to research projects and stealing stuff. The federal ITAR requirements are ones we are dealing with all the time with some of our clients. We have military sub-subcontractors that are making things as simple as screws, Jack, and their products ultimately get used in some military system. Many of these companies are not being careful with our data, and it gets stolen. They have no clue that they're exposing all of us to these dangers.

Jack
Craig, I think you may know, I'm not sure, but I had the benefit of some of the knowledge learned when I was the US Army War College. I'll keep that quiet. One of the things I did learn is when you look at the global threats to our security in a lot of different things, and we're seeing differences right now with China. Everything in the last year or two or four years politically speaking has been Russia, Russia, the Russians, Russia, Russia, you know, you know, Vladimir Putin. However, the real threat is China. When you look at Russia, I'm not saying Russia did not try to metal. I'm not saying they won't try and metal, and they will try and battle and mess up in our elections. But China's looks like a real threat. They are from a technology stealing point of view, one of the businesses but penetrating universities. Raytheon is a pretty secure fourth-largest defense giant, the real stuff, real concern.

Craig
It is a considerable concern, and you know, we were talking about the military and You know, the, obviously the contractors and what China's doing. But you see what jacks are doing this to our regular businesses. I have a client that came to me, became a client who came to me because, as it turns out, something was weird with his email. When we started looking into it, and I had one of my fire jumper certified guys get into it more, we found Chinese backdoors in their systems that were actively exfiltrating data out. His designs, the ones he developed over his whole lifetime, he was getting ready to retire. Now the Chinese had all of his intellectual property, all the research methods used to make the products, his customer lists, his pricing. That means he gets to compete against his very own designs made by Chinese manufacturers and sold worldwide. His business is out of business, and we're not even talking about the military here.

Jack
All right Craig Peterson on this Monday morning. Appreciate it.

Craig
All right everybody, hopefully, you've been able to check it out online let me know what you think I've been posting these morning interviews over on YouTube and Facebook, doing them as audiograms. I do have all the camera gear, but it takes so much time, and I haven't had time to do it. Let me know what you think you do like these audiograms. By all means, subscribe to my YouTube channel or follow me over on Facebook and drop me a line - at me at Craig Peterson dot com. Take care of everybody. Be back tomorrow.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome,

Good Monday morning, everybody. Craig Peterson here. I was on with Jack Heath this morning. We talked about an article that Jack posted on Facebook about a Chinese National working for an American Military Contractor who gave our Military Secrets to China. Here we go with Jack.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Automated Machine Transcript:

Craig
Taking a laptop, even if you are not a Chinese spy, to China is has a high probability that information on that laptop disappears while you're over there.

Craig
Hey, good morning, everybody. Craig Peterson here. This morning Jack wrote about an article on Facebook about what's been happening here in New England with Chinese infiltration and spying on military companies and contractors. We got into it this morning. Here we go.

Jack Heath
On top of the lack of social technology, getting US pictures out of places like you know where the host city you have China, basically muscling technology and stealing it allegedly from us. You look at this 10-year engineer, Chinese born American who was just picked up over the weekend by the FBI for allegedly taking his secure Raytheon laptop to China on a trip last year. It is a federal offense for someone with high-security clearance to take technology capable of accessing things like our weapon system technology out of the country. Then the Harvard story. Last week, which you haven't heard much more about the professor, one or two professors charged with getting $50,000 a month from a bogus Chinese University, from the Chinese government to recruit and steal intellectual capital from Harvard. Those are big stories, and it shows the dichotomy between the people having access and the government using it to get more technology for the government and stealing our intellectual capital. Some interest there, and maybe a comment on that Craig Peterson joins us live in the author listener lines, our Tech Talk guy, Good morning, Craig.

Craig
Hey, good morning, jack. Yeah, and the last few months we've got this Chinese Harvard affiliated cancer researcher caught in December with 21 vials Cells stolen from a lab at a Boston hospital. We've got a Chinese Professor conducting surveillance Research at the University of Kansas indicted in August on charges for his ties to Chinese University. We've got a Chinese PLA Lieutenant posing as a student here at Boston University. The fact that she was a lieutenant in the Chinese military. She was a spy and a Chinese scholar. Another at the University of California. The list goes on and on. You talked a little bit, and you posted on Facebook about the Raytheon employee taking a laptop to China. The company told him not only was it against company policy to travel with a company computer that might have some proprietary information on it but was against federal law. And we see this a lot. There's a lot of ignorance out there amongst people who do take laptops with them to China. I've been warning about that for the last ten years because taking a portable computer, even if you are not a Chinese spy, to China presents a high probability of exfiltration of that data from that laptop while you're over there. Now the infiltration of soft targets in the last few years, our universities where Chinese students are coming over. As I mentioned earlier, Chinese military Lieutenants are coming over to universities posing as students and being assigned to research projects and stealing stuff. The federal ITAR requirements are ones we are dealing with all the time with some of our clients. We have military sub-subcontractors that are making things as simple as screws, Jack, and their products ultimately get used in some military system. Many of these companies are not being careful with our data, and it gets stolen. They have no clue that they're exposing all of us to these dangers.

Jack
Craig, I think you may know, I'm not sure, but I had the benefit of some of the knowledge learned when I was the US Army War College. I'll keep that quiet. One of the things I did learn is when you look at the global threats to our security in a lot of different things, and we're seeing differences right now with China. Everything in the last year or two or four years politically speaking has been Russia, Russia, the Russians, Russia, Russia, you know, you know, Vladimir Putin. However, the real threat is China. When you look at Russia, I'm not saying Russia did not try to metal. I'm not saying they won't try and metal, and they will try and battle and mess up in our elections. But China's looks like a real threat. They are from a technology stealing point of view, one of the businesses but penetrating universities. Raytheon is a pretty secure fourth-largest defense giant, the real stuff, real concern.

Craig
It is a considerable concern, and you know, we were talking about the military and You know, the, obviously the contractors and what China's doing. But you see what jacks are doing this to our regular businesses. I have a client that came to me, became a client who came to me because, as it turns out, something was weird with his email. When we started looking into it, and I had one of my fire jumper certified guys get into it more, we found Chinese backdoors in their systems that were actively exfiltrating data out. His designs, the ones he developed over his whole lifetime, he was getting ready to retire. Now the Chinese had all of his intellectual property, all the research methods used to make the products, his customer lists, his pricing. That means he gets to compete against his very own designs made by Chinese manufacturers and sold worldwide. His business is out of business, and we're not even talking about the military here.

Jack
All right Craig Peterson on this Monday morning. Appreciate it.

Craig
All right everybody, hopefully, you've been able to check it out online let me know what you think I've been posting these morning interviews over on YouTube and Facebook, doing them as audiograms. I do have all the camera gear, but it takes so much time, and I haven't had time to do it. Let me know what you think you do like these audiograms. By all means, subscribe to my YouTube channel or follow me over on Facebook and drop me a line - at me at Craig Peterson dot com. Take care of everybody. Be back tomorrow.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

What a busy busy week in the world of technology.  We are going to hit several topics today.  Business Email Compromise attacks are running rampant through business. Failure to update older technology is putting businesses at risk. Facial recognition technology is being used but the issue is privacy and how to protect it.  Will hit Ransomware, Employee Training, Regulatory Compliance, Online job postings and what precipitated the most expensive divorce.  It is going to be a busy show -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

I've got some free online privacy training coming up.

I have been teaching courses on security for the FBI InfraGard's program. And now I'll share some of the step-by-step tips and tricks that we all can use to keep ourselves and our information safe online. And it won't cost you a dime.

---

Related Articles:

Most Businesses Attacked By Business Email Compromise Last Year

Keeping Legacy Software Safe

Concerns About Effectiveness and Privacy and Limiting Facial Recognition Adoption 

Downtime and Costs Double as Ransomware Attacks Hit Larger Businesses

Employee Training Key to Spotting Existing and Emerging Threats

Regulatory Compliance: The Perception and The Reality

WhatsApp, Hired Journalist With Saudi Enemies: The Reason Behind Jeff Bezos WhatsApp iPhone Hack

Searching For A Job Online -- FBI Warns About Rising Number Fake Employers
---

Automated Machine Generated Transcript:

Hey, hello, everybody, Craig Peterson here. Thanks for joining me, whether you are online listening to me on a streaming service, or listening on the radio on my website, kind of everywhere, we are going to be talking about most businesses now what's happening to them? How are they attacking to new statistics out, we'll be talking about how to keep some of your legacy software safe. If you're using Windows seven, or if you're using an older version of the software, because you haven't been keeping it up to date, which is like what all of us right? We're going to talk about what you can do some effectiveness, concerns about privacy, limited facial recognition, adoption, what's going on there. We talked a bit about that last weekend, downtime and costs. If they have gone up here. ransomware attacks are hitting businesses and individuals even harder than at any point in the past. So what's that all about? What are the simple things you can do to help protect yourself against it? We're going to talk about some employee training you need to do if you are a business person, regulatory compliance, what's the perception? What's the reality, we've seen a lot of businesses that are doing what we've been calling pencil whipping some of these forums that are trying to figure out whether or not they have complied with some of the laws, rules, and regulations. We're going to also talk about the Jeff Bezos phone hack today, and about a warning coming out from the FBI about job searches online. So a lot to talk about today. And we are going to start out with half of the organization's worldwide were successfully finished in 2019. But can't even talk right now. This is something that's very concerning. Now. It isn't as bad as it used to be phishing attacks used to be almost 100% effective. Of course, these are the types of attacks where someone sends an email. And the email is trying to get you to help this Prince in Nigeria, or whatever it might be. Those are phishing attacks, I've gotten a lot more sophisticated to the point where they are today, where we warn people to not even put information about who the employees are even physical access or addresses of the businesses, if they are not, obviously a walk-in type store because that is being used online by the bad guys. They go to your website, they figure out who the CEO is, who the CFO is, whatever information they might need. And then they use that now to go after you and go after you in a very bad way, frankly, because we are falling prey to it. And we're going to be talking more a little bit later on a couple more segments about what is the cost to businesses right now. Some of the phishing attacks, because you remember, they will use phishing for a number of different reasons, not the least of which is to get you to install malware on your computer. You know, unbeknownst to you, right? It's not as though you purposely are selling malware. But we're going to talk about that here in just a few minutes. There is a number of companies out there that do various types of simulated phishing attacks. And the idea behind these is that they will go ahead and send your employees emails that are based upon the latest phishing attacks, right, the type of phishing attacks that have been going on for the most part, and they will record whether or not each employee has clicked on a link that they shouldn't have clicked on. So obviously, when they click on it, it goes through the software that's tracking them and knows what they did. And you know, now they're in trouble, right? Because they did what they shouldn't have done and they will usually have some remedial training for these people to help to build awareness, help them understand what it is really what's going on what they should be doing what they maybe shouldn't be doing. All of that stuff pulled together. Well, one of the companies that does this fishing susceptibility testing along with the security awareness training is called proof point. And they take a look at all of their numbers and try and roll them together. So this report that I'm looking at right now is examining global data from nearly 50 million simulated phishing attacks that were sent by proof point customers over a one year period. And they also did third party survey responses for more than 600 information security professionals in all of the major countries out there, not some of the small ones. And they put this all together. So basically, it's 3500 working adults who are sitting paid for that part.

Now, here's what they found. Here are the tips for you. If you are a business person if you're responsible for it within an organization number one here in the Help Desk security article is effective security awareness training, must focus on the issues and behaviors that matter most in organizations' mission. Obviously, that's kind of corporate-speak, right? But he's saying that really what we have to do is look at what our assets are, what our mission is, as a company, and you know, value those what is the value of those, what should we be doing, when it comes to our data, the things that we if we lost, we would go out of business or we might get fined, that might come after us, etc, etc. So he goes on to say we recommend taking a people-centric approach to cybersecurity by blending organizational-wide awareness training initiatives, targeted threat driven education. The goal is to empower users to recognize and report attacks again, oh my gosh, you know, this is the sort of thing that you get from a PR agency, right? I doubt the guy actually said that. But it really is about people. We have various types of automation. If you have the basic stuff like you've got antivirus, and you've been listening to my show for a while, you know, anti-virus is zero percent effective against the latest types of attacks. And it is not effective at all. antivirus software in this day and age is pretty much useless.

Now, you should be using it as part of a bigger stack of security software and procedures and things. But bottom line, it's just not that useful. And they're also saying that end-user email reporting is critical. They're showing that the number of reported email messages jumped significantly last year. And that's a really big jump at about 67%. So make sure if anyone in your organization has any questions about an email, they're thinking it might be a fake, it might be, you know, a problem phishing, etc, that they forwarded to you. Now we'll go a step further because of my company mainstream, we go ahead and work with the FBI and state investigators. When there are serious problems. Obviously, we will work with the company to it's not as though we're going to squeal on them. But we haven't covered numerous foreign government and also organized crime hacks into businesses. So if you're not reporting it, nobody's going to know and nothing can be done about it. So here are the key takeaways from this last year. More than half it's 55%. I've surveyed organizations dealt with at least one successful phishing attack in 2019. That's a very big deal. That's a very scary thing, frankly. And info security professionals have reported a high frequency of social engineering attempts across all kinds of different methods. 88% reported spear-phishing attacks, 86 business email compromised attacks, those are the ones that are hurting our businesses most and those are the type of things where they're faking that they're a vendor or they're the owner and they're asking people to wire money around. So be very, very careful. smishing is fairly new, but 84% of the businesses are saying that they had SMS and text phishing attacks that's way up. 83% said fishing which is voice fishing, and 81% reported malicious USB drops isn't That's something 65% of the surveyed infosec professionals said that their organization experienced a ransomware infection in 2019. That is high, high high. Now, you know, the FBI advises to never pay a ransom. But a third of all organizations opted to pay the ransom. And we've seen that even in cities that have been attacked by ransom, or that they did pay ransoms. 32% did not have those who negotiated with attackers 9% were hit with follow up ransom demand, and 22% never got access to their data, even after paying the ransom. So keep that in mind. And the other statistic that I've seen before from the FBI says that even if you pay a ransom, the odds are only 50% that you'll get all of your data back. Remember, these guys aren't writing great software. In fact, most of them aren't even writing this software at all. And what that ultimately means is it buggy? What do they really care as long as they get some payments right? organizations are benefiting from the consequent model. 63% of organizations take corrective action with users who repeatedly make mistakes. So I think that's an important thing. Many working adults fail to follow cybersecurity best practices. 45% admit to password reuse, which is one of the biggest sins, frankly, that you can commit is reusing passwords on multiple sites, more than 50% do not password protect home networks. And 90% said they use employer-issued devices for personal activities. These are all things they shouldn't be doing. In addition, 32% of working adults were unfamiliar with VPN services. One of my pieces of training was about VPNs. You might find it I think it's still up on YouTube. But how VPN services are in some cases worse than not using a VPN at all, you've got to be careful because some of these VPN services that are out there, they're actually having new use their service so they can track you online, sell your information. So the VPN service is only charging a few bucks a month, or heaven forbid, free. You really have to wonder just how good is it. So follow those practices need to understand the common cybersecurity terms. I don't maybe I should do a little training on that one too so that people know what's up. And Millennials are continuing to underperform other age groups in fundamental fishing, and when ransomware awareness, so stick around when we come back, we're going to talk about keeping your legacy software safe. Are you still using Windows seven, eight or maybe something else? It's kind of old. Stick around. We'll be right back. You're listening to Craig Peterson on WGAN.

Hey, welcome back, everybody, Craig Peterson here. If you have a computer that's been around for a few years, have you stopped and had a close look to see if it's reached its end of life. Now I'm not talking about the hardware is about to fail or fall apart. You know, that's something I think you can deal with and everybody knows to deal with. And more importantly, if the hardware falls apart and stops working, you have to deal with it. But what about the software that's on your computer? What about the software that is, has been installed and it has been there for who knows how long? When was the last time you actually updated it I walk into customers' new customers all of the time, and they are running really old software? And man, I can't tell you how many times I've walked into a place and they've got a database. It's Microsoft SQL Server, server, and they have just got a development version there. They're in. In fact, they bought the software. And the software vendor gave them a free development version of SQL Server. Even though it's in production, even though they're supposed to be paying for a full license, I see it all the time. And then because they don't have a full license, in fact, they don't even have a legal license to use it in the business environment. The next problem happens, which is they've never updated SQL Server. We used to see this all the time with Windows where people were using a hacked version of Microsoft Windows, versions of Windows that were never licensed, never licensed properly. We don't see that as much anymore. But what we are seeing is software that's passed the end of life including windows As of mid-January January 14, 2020, Windows seven Microsoft is no longer supported for security updates, at least unless you pay Microsoft a small boatload full of money. They are providing it, but they are charging money for it. And now the last subscription I saw for security updates for Windows seven was about $80,000 a year. Now, I don't know about you, but I think that's a little bit pricey. So now you end up with the problem of Okay, so I am running old software, maybe even Windows XP, we see that all the time in the manufacturing business, where they're controlling systems and control systems running XP. So what do you do now? Because if you upgrade your base operating system, that means there is software that you're running that may not work with the new version of Windows. And frankly, that's probably the number one reason we see from people who don't upgrade and don't want to upgrade because it's could end up being a very bad thing for them a lot of pain, right? Well, Windows seven is already past its support window. And we're Windows Server 2008 will officially be ended just this past week. So if you're running Windows Server, which a lot of businesses are, right, you're using Active Directory server as much as I don't like it. Most of our customers use it because there's not really a whole lot of other options for them. But it's really significant here that these older operating systems are no longer going to get routine security updates and patches going forward. Windows seven, believe it or not, is 10 years old now. And it's still in style. It still works. And according to StatCounter, Windows seven is still deployed on one out of every four Windows machines. So That means you are probably like everybody else out there and is still running Windows seven or some of your machines. And part of the reason for that may be because you're concerned about doing the upgrade, right, and update. So we're going to talk a little bit about that some things that you can do. But first of all, I want to give you a couple of warnings, because I think I might have to get you out of that feeling of invulnerability that you might have Windows 720 19, there were more than 1000 vulnerabilities that were found over 1000 in just 2019. ingest windows seven alone. So businesses are facing a very real security risk by using any of these products after their security updates pass.

But you know, can you migrate? Yeah, obviously the answers. Yes. Can you do it quickly? Well, Not necessarily quickly, and certainly not immediately for most people. So most businesses are finding they're using the sound supported software for months, years or even decades later. And Kaspersky research, which is a Russian company that does all kinds of stuff when it comes to security, they got some pretty decent security software. But the problem you and I think you might find with their security software is it's from Russia, and the US, the federal government has come out and said, Don't use Kaspersky. So I can see that I can see why they're saying that but they're reporting that 40% of very small businesses, so 40% of businesses under about 10 employees, and about 48% of small and mid-sized businesses. So the bigger businesses that should have the ability to do upgrades are still using unsupported software and software that's approaching the end of support. So you got to be very, very careful, okay. And if you're a manufacturing company, or you have industrial control systems, you might have an H HVAC and an air conditioning system in your building that is hooked up to your network connection, so that the technicians can get in remotely to look for problems, maybe the systems call home, to let them know that, you know, your coolant pressures too low or whatever the problem might be. Those types of systems can be some of the worst to some of those, as I mentioned, before, we're finding we're still running Windows XP. And that is way, way out of date. So you know, have a look at all of those to man, we could go on for a long time about the problems that we've seen, and some of the problems that you need to take care of. But when we're talking about 24 seven operations, so we're moving on to the next level. Business kind of manufacturing or maybe you have a help desk where people call it 24/7. And those systems are up and online the whole time, it becomes even more important becomes even more critical. If a new vulnerability is discovered, I really have to emphasize here you have to take extra precautions. So what do you do in the meantime to protect yourself, here are some tips for those of us that are still running older software? And as I said, we're talking about what 50 60% of us frankly, our and a third of us are running unsupported versions of Windows. Number one you could do is buy extended support. Now, this is probably the least attractive option for companies that don't have a lot of cash lying around but it is the most secure. If you're an enterprise customer, you which means, by the way, you have to use any enterprise versions of Windows, not the stuff you got when you bought your laptop from staples or, or just from regular old Dell, okay? But enterprise customers can pay Microsoft for extended support through January 2023. Now, it's very expensive. Okay, so the price is going up every year. So be very careful with it. We're talking about million dollars worth of expensive, okay, so very, very big deal. If you're still running Windows XP, the cost for extended support for an organization with 10,000 plus machines leveled out at just under $2 million a year. real money. It's crazy money. So that's probably out of the question for most of us. So next up, here's what I've done for a lot of customers and I can help you with this if you need this as well. But there are ways to isolate both older machines from your regular network and I'm not just talking about going ahead and doing some network segmentation. I'm talking about having special internal firewalls to isolate these machines, okay, old decommissioned and non-supported operating systems and software that cannot be patched, have to be isolated. Obviously, you also would need to limit user access to the machines and limit what they are doing on those machines and try and keep them safe. And watch for what is called out of band fixes. Some vendors may still issue critical fixes, but you know, keep an eye on it. It could be dangerous. All right sticking around. We're going to talk about this new facial recognition technology that London is adopting. I talked about it this week, a little bit on my radio and TV appearances. But we're going to get into a little bit more because it is coming here to the US as well. Stick around you're listening to Craig Peterson WGAN Online.

Welcome, everybody. Craig Peterson here and online at Craig Peterson dot com. If you haven't already, make sure you sign up for my email comes out every week on Saturday mornings typically is when we get it all done on time so that it's out for the show. But I do go through some of the most important articles for the week, a lot of security stuff including what the number one patch that you need to make to your systems. So that comes out at least monthly, my newsletter and these patches are patches to software that is attacking right then and there in the wild. In other words, it isn't just patched for the sake of patching. It's this is a serious problem. And if you don't deal with this problem right away, you could become a victim. So you've got to really kind of keep an eye on that. That is part of my newsletter that comes out and you can get that by just going to Craig peterson.com slash subscribe. Well, we're going to talk right now about the effectiveness and privacy here live and limiting facial recognition adoption. This is something we talked about a little bit about last week as well. Of course, we talked about this company that's out there doing facial recognition stuff that's really kind of scares me, because they went and they crawled all of the public photos they could find from sites like Twitter and Facebook and some of these photo-sharing sites. They pulled them all together, 3 billion of them, and they put them into a database, the company's called clear view, and they recorded where they got those photos from, and then they've been offering it right now. To the police, obviously they had ideas about offering it to other people is, you know, ultimately, but the police have access to it. And that's been a problem. because nothing's 100% plus at where do we draw? At what point? Do we draw a line saying, hey, my privacy extends even to those things that I posted online? This is a fine line. It's a real problem. And as we've talked about before on my show, ultimately, the law, legs far behind the technology, technology comes up with something new. And then the rules or regulations, follow the laws, which are all coming out well after the fact. Now, sometimes, they try and pass laws beforehand. And that ends up being a problem because we don't know what all the problems are going to be. So it's a catch 20 too, right? You can't, you shouldn't really put the laws in place until we have the real problems. And then you're not going to see the real problems with the laws until they're in place. So we're talking about something like this. That's not a perfect technology. How far can they go? Now we know that if you are arrested, and they can take your picture, and your fingerprints, I've been doing that for a very long time. There have been a number of court cases about whether or not they can take your DNA. And of course, it doesn't have to be blood anymore. They can just do a mouth swab. They can get your DNA even from your hair, and know a few mixed results there. I know, basically, from everything I've read, the courts have come down on the side of if you are arrested and convicted, then they'll grab your DNA, and that's been used to solve some crimes. And in fact, facial recognition has been used to solve some crimes. as well. But should we have the privacy in our papers basically in our documents? And they argue many times police in court, hey, listen, if you're out on a public roadway, you have no expectation of privacy. And, you know, I frankly, I don't disagree with that. I don't think you do have an expectation of privacy. But should it be legal for the police to be tracking you your license plate, taking pictures of you as you go through intersections? Again, where's that line drawn? And when we're talking about the facial recognition databases, these things are often wrong. They've got a success rate of less than 70%. But what is going to happen when their success rate is 99% that they are showing accurately, who you are 99% of the time.

Now, the next problem with companies like ClearView AI as far as I'm concerned government agencies is how safe is our data in their hands. When you get to the databases that hold the images, they are going to ultimately have vulnerabilities. So our, you know, our biometric information, our pictures, all the way through our fingerprint, Iris scans, the way we walk our pace, the way we speak. All of that's biometrics. Now, if you lose your password, you can reset your password and have a new one. If you lose the pin for your ATM card, you can go ahead and get a new one, right? It's pretty simple to do. But what happens if the government the state government or federal government has your photo and it's stolen, you cannot change your face. You can not change your biometrics at all. So is there any way for us to be able to trust that our privacy is going to be protected? And the answer is frankly, no. And is there any way we can stop the distribution of our facial data? Some states sell all of the driver's license data. Most states, I think now to whoever will pay for it. So the answer to that question, is there any way we can prevent the distribution of official data? The answer to that is frankly, no. And when we consider the damage that the leak of these types of databases could cause, cause it is freak, it's just, it's overwhelming. It's overwhelming to me. It's overwhelming to you. And I think we've got to be a lot more careful. Now. I mentioned this database company called Clearview AI. That scrubbed the internet found all 3 billion pictures pulled them in, kept track of where it saw the pictures. This is a big problem. But they say hey, listen because they're getting sued right now. It's okay so somebody by the name of great Graham Cluley he went to clear view an eyes website and had a look around and what they found is that you can have your photo removed. Yes, yes indeed. Now, they never asked you for permission to use your photo for their app that they're selling to the FBI homeland security agencies all around the world. No, no, no. All you have to do to have your photo removed from Clearview AI is are you ready? Um, this is straight from like a screenshot from their website. You can send an email to privacy dash requests at clear view.ai. And then you just submit a name a headshot, a photo of a government-issued ID to facilitate the processing of your request. Well, what if you're concerned about this company's clear view to AI, losing your data in the first place? Do you really want to send them a picture of your passport or your driver's license, which now most driver's licenses are federally compliant? Is that really what you want to do? Well, I think it's a real problem. Twitter has sent a cease and desist letter to them. Saying that clear view AI violated the policies over at Twitter, demanding any collected data be deleted. I would expect that Facebook is probably going to do something similar, as will these other websites that are out there where they have been scraped and They obviously the website had to find out about it. And now we're seeing London's Metropolitan Police Service, starting to use live facial recognition technology to scan public areas for suspected criminals. They've been trialing this technology for two years. And they're going to have this up and running by February 2020 going to be linked to a database of suspects. So, again, this is a problem. Facial recognition technology is just not accurate. What can you do? Well, I think we should all be sending letters to our representatives in Congress in our statehouses, and letters complaining to Twitter and Facebook, about companies like ClearView AI, you'll find this articles or articles about it up on my website at Craig Peterson, calm and of course, listening to me on WGAN, stick around with me Get back we're going to talk about the costs of ransomware in q4 2019 and today.

Hey, welcome back, everybody, Craig Peters on here and WGAN online course at Craig Peterson dot com. That's Peterson. With n Oh, well, we know what downtime is right? businesses have it. And it can really cause havoc, especially a long amount of downtime. When businesses get hit with a major outage, and it can be caused by a fire flooding the major server crash when they're hit with that sort of thing. It can be devastating. And most frankly, businesses are out of business within six months, with small-medium businesses, basically the larger ones. Well, by law because of Sarbanes Oxley, they have to be able to get back online if they're publicly traded within four hours. Now, a lot of businesses don't do that. Although they shouldn't be doing it and You know, frankly my business we are set up to be able to get back online pretty darn quickly, because you just can't afford the bad PR the bad customer relationship and the lack of sales that come in because you're down, right? Nobody can get it anything. Well, there are new and more sophisticated ransomware attacks that are really hitting businesses today and everything from large companies to little guys from state governments to the federal government. And some of these are considered to be the deep pocket target. Now you and I, we can get hit with ransomware. And to us, a $500 ransom might be real money. What is it half of the American households could not come up with $500 for an emergency expense and two, right. So I'm not saying that it wouldn't be devastating to get ransomware if you are a small office, Home Office, Or if the if it's your basically just your home computers. But ransomware costs now have more than doubled in the fourth quarter of 2019. According to the latest statistics, so the average ransomware payment has doubled. It is now at almost $85,000. That's in one quarter. So in the third quarter of 2019, the average ransom payment was about 41,000. That's the third quarter. So let's see what the third quarter last year September. Let's see November or October, November, December is the fourth quarter. And so it would be September, August in July. So July, August, September, the average payment for ransomware was 41,000. And then, in October, November, December, there we go. It's $4,000 that is absolutely huge. So I did a little bit of digging to try and figure out why did it surge so much? Well, apparently it's because they are using some ransomware software. It's called RealLoc. And I always have a hard time with this one, so doing co key B and they are going after the enterprise space. Now enterprise space typically means a medium or large business, as opposed to a small business. But in this space, criminals can really exhort extort serious money, deep pockets for seven-figure ransom payouts. So here is a quote, researchers some cover were saying q4 ransomware actors also began exfiltrating data from victims and threatening its release if the rain Sim was not paid. So it's not just ransomware getting onto your computer and encrypting your files and saying, Hey, listen, if you want your data back, you're going to have to pay us, which as you already know, you usually don't get your data back, right. But they are saying, we have your data, and we're going to let it go. And there's a big case about this late last year, and the chairman of the company was but this company had had its data stolen, and it there was an extortion angle on it. They're trying to get money from the company, saying, hey, if you don't pay us all of this ransom, we're going to release the data. And the company said, Okay, well do it because we're not going to pay that ransom. And the bad guys did release it. Okay.

Now there's third-party claims over the data breaches now that start to come in. But let's break down some of these costs. So if and then I'll get into what you can Due to help prevent some of these problems, but the cost ransomware attacks can vary. Obviously, if you're going to pay a ransom, there's one cost, right? Then the remediation which can be very expensive, if you get hit by ransomware remediation companies can cost you in the hundreds of thousands of dollars, then that's frankly, where you bring us in and we have a couple of people with their fire jumpers certified over at Main stream.net it can easily cost you $100,000 to try and get all of that stuff all your data back, right, get back in business, but all the hardware devices you're gonna have to do upgrade so all of this stuff you've been dragging your feet on you probably gonna have to do so it couldn't be quarter of a million up to two or $3 million for bigger company. Now there are also some other costs, besides the lost revenue from downtime because now you might have a bad reputation out there. Brand damage can occur here if the business interruption severe enough. If your clients are noticing that you can't do business if you are a provider upstream-downstream, it can be very, very bad. Now in addition to the ransomware payments skyrocketing according to threat post calm, the average downtime that a ransomware attack causes for a company also increased from 12.1 days in the third quarter to 16.2 days in the fourth quarter. That is absolutely nuts. Now, we have been doing a lot of remediation really for businesses. And one of the things we do for the bigger businesses if they are a public company or their division of a publicly-traded company is we put in equipment on-site for them. So that if their main servers go down, the new, the other equipment, our equipment that's on-site can take over and it can take over in a matter of minutes. So there's like almost no downtime, the only thing that might be lost is 15 minutes or 30 minutes, whatever it was since the last snapshot was taken and pushed to us. And then we push that data. Sometimes we do it through leased lines sometimes to do it through the public Internet. We push that data to our data center. And then it's encrypted while it is over the customer site and before it gets sent to us. So it's encrypted as it goes over the by the public Internet or some form of a leased line. It's encrypted when we get here so that we can now sneakernet if we have to, right. So the building, let's say it burns down, we can immediately recover. And then we take that data and we say snapshot it. And we keep snapshots for a year or more sometimes depends. public companies need to keep seven years of some of these snapshots like the email of the working files, especially companies that are manufacturing something where you have to keep it in, in some cases indefinitely. Like we did some stuff for saffron, which makes blades for jet turbans. And they have to keep their data for a minimum of I think it's, is it 20 years, you know, whatever the service life is of the engine those blades are put into. So that's what we do for publicly traded companies. Now that's not cheap. But they don't, you know, it just blows my mind how many of these companies that can afford it just aren't doing it? So when you look at these statistics and say that we're talking about 16.2 days of downtime if you get hit with ransomware how much revenue is that to them? Especially those companies that are making hundreds of thousands of dollars a day, they're going to lose that revenue because their manufacturing lines going to be down or their sales are departments going to be offline or their shipping or warehouse or maybe everything which is, which has happened to another division of a public company that we did the work for 25 years. Okay. So very, very, very expensive. And the third Post article goes on to say that this increase from 12 days of downtime to over 16 days of downtime was linked to a higher prevalence of ransomware attacks against these bigger companies, the larger enterprises, which are often left scrambling to try and get their systems back up for weeks. Now, again, that's something we've been doing forever and that's something You need to be doing if you're just a small company, having an offsite backup is critical. Having multiple generations of backup is critical. Because what happens if your systems are corrupted because ransomware has come in, has taken them over. And now your backup and backup backs up the encrypted data. So now you don't even have the data before the ransomware hits. Now you're completely stuck, right? Because your computer is encrypted, your data is encrypted on your computer. And your data is encrypted in your backup because you just backed up or just as bad or maybe even worse is your backing your systems up to a locally attached disk, right. You plug in one of those nice little USB drives. Guess what the ransomware is doing? It is encrypting that backup drive and it's also spreading to your Active Directory server and Your business, and it's spreading to all of the other computers in your business. It does this normally anything it can see any shares any mounts, it's going to encrypt. And that's why it takes so long. And that's why for our clients that need higher availability, because you are required to have a full disaster recovery plan in place if you're a publicly-traded company or division of a publicly-traded company, and you have to be back on in four hours. That's why we have equipment sitting there on-site with multiple generations of backups, in case something like this happens in case it gets through. Okay, so nowadays, we've got some working descriptors that are pretty good for some of the ransoms that happen. So you have about a 2010 to 20% chance that the data that has been encrypted will be you'll be able to decrypt it Cisco Talos per usual is one of the lead investigators, researchers and all of this. Those are the guys that we use Cisco talus guys. They're just absolutely amazing. They're the ones that back us up. RDP Remote Desktop protocol compromises people misusing VPN. It just goes on and on my brain spins when I think about all of this, but the costs have doubled in q4. So make sure you are doing the right thing. You have good backups, you have multiple generations, that at least one generation is stored off-site, if not multiple generations. And if you aren't doing that, or if you're, you know, ISP MSP isn't doing it for you. It's time to change because the costs are going way up. You're listening to Craig Peterson, stick around. We'll be back here after the top of the hour with more about fishing. What's been going on?

Hello everybody, Craig Peterson here. Welcome back. I am on WGAN radio and many other stations actually throughout New England but I'm glad you're joining me right now. Also, of course online, your favorite streaming site and Craig Peterson dot com. Well, today we've already talked about most businesses are attacked by business email compromised last year and what that means what are the new types of spear-phishing scams going on? You guys are learning a lot from some of these, just that the terms if you understand the terms you are ahead of almost everybody else out there. We talked about keeping legacy software safe that things like Windows seven, heaven forbid Windows XP or now windows eight is also legacy no longer supported with software patches. We also talk before the top of the hour concerns about effectiveness of some privacy when it comes to facial recognition software. Should we be doing more about that there's a lot of concerns about the adoption and then downtime and costs have doubled in the last quarter? So q3 versus q4 2019. They doubled when it comes to ransomware attacks a very big deal. And it's interesting how they're doing it. I just got a text from my son and my son is as well as a couple of other family members. Somebody who works with me in the business. It's, you know, mainstream is kind of a family business. We've had many people over the years working for us. Now we've got about 60 different people who are working in different parts of the company. But when it comes right down to it, it really is kind of a family business. So he just sent me a message that he saw an app News. And of course, as usual, this is really a link to another, another website because Apple doesn't really publish news themselves. But this is from ZDnet. This just happened on Wednesday this week, a contractor suffered a ransomware infection. Now we have here in New Hampshire, a lot of God contractors, well, actually mostly subcontractors, but we have primary contractors as well. And I know some of you guys are listening here on the show, because I hear from you, right, I know that who you're working for and what you're doing. And I think that's really cool. I love it. But the problem is how do you guys deal with your IT people if they are not competent? How do you as a business person, any business person deal with it? Yeah, how do you even know if they're competent? At least if you're listening to the show, which obviously is right now. But at least you know the terms and you have an understanding of what should be happening. Well, this is a very big sub-cut or a contractor to the Department of Defense. It's called electronic warfare associate ew way. And it's a 40-year-old electronics company, well known US government contractor, and it got nailed by one of these ransomware infections we were talking about in the last segment today. Not a good thing, frankly. And we have seen all kinds of activity right now. You know, I feel sorry for these guys. They obviously did not know what they were doing and that and I can say that unilaterally. If you get ransomware it's your fault. Because in this day and age, there are so many great tools. They're not the ones you get from staples, the not the tools you're going to get from your break-fix computer shop that They have no idea how to protect you. None at all. Frankly, they've been lying to you. And that really bothers me too. Because I hear from my customers saying, well, I spoke with so and so. And this is what they said, well, they may not think it's a lie, okay, maybe calling them a liar is a little too strong, but they don't know what they're talking about. And yet they speak with absolute authority, as though they really know when they this is really the right thing to do. And don't listen to some guy on the radio, you know, or don't listen to that new company that came in and did a cyber health analysis for us, or network security assessment. Now, ignore those people because you know, we've had a relationship for the last 510 2030 years. Well, apparently, I'm guessing something like that must have happened with this company.

Go right now. In fact, I've got a screenshot in front of me It looks like they fixed some of this. But the website for this company is ewe tech.com. And if you do a Google search for them, or if you didn't want a little earlier in the week, you found out that something was really weird because all of the Google search results looking for e. w. a tch.com. Come back with a jibberish. And it's jibberish because everything has been encrypted by ransomware. Now, there is a security researcher out there who goes unnamed in this article from ZDnet and it is saying that several of the NWA websites appear to have been impacted, such as sites for the wi government systems IE wi technologies, simplicity key homeland protection Institute and we don't really know at this point how much of the company's internal network was encrypted during the incident. But, man, this is a big deal. And by the way, even though it's obvious that at least these websites of theirs have been encrypted, they have not issued any public statement about the incident. According to this article, this article, as I said is from Wednesday, Thursday this week, apparently, an NWA spokesperson hung up the phone earlier when Zd net reached out for comment about the security breach. This is a well-known supplier of electronic equipment to the US government. Now we have clients who make small things. You know, they make things like parts, they make wiring harnesses, they make power supplies, they make just all kinds of very basic things. And you look at it even screws right fasteners, and you look at ina say, Well, what does that matter? Well, Not a company that's making all these big electronic things for the government. But really what some of these bad guys are trying to do with ransomware is to fold, they still have the old motive of holding your data ransom. And it can be done two ways now, because the ransoming of the data, in this day and age, is also been done by saying, Hey, we grabbed all of your data before we encrypted it, or maybe we just grabbed all of your data, and we are going to release it to the general public. And the less you pay us a ransom. So they're making a ton of money off of this. And it looks like according to this unnamed security researcher, that's the relax dealer update. Now that is exactly one of the things that I was talking about earlier in the show, and we put up an article about that as well on my website, that is two that are being used right now that are not regular ransomware strains. And they're using it to target attacks on bigger companies that have deeper pockets. Very, very interesting. So keep an eye on this, this is, this is a bad thing, obviously. And it's bad because it can hit any of us. And ultimately, it is going to come around and hit you. Because you look at the stats we're talking about that just came out, where more than half of the companies were hit last year. And this is self-reported, okay, half of the companies admitted to it. So they had to first acknowledge or even know that they had been hacked, and most companies don't even know that they've been hacked, the smaller ones, and frankly, even the bigger ones. Look at some of these hacks and major corporations that didn't find out for six months or more. And all the way through. They have to admit that they were hacked when they knew they were hacked. So we had all of this up. And it's a very scary world out there. And if I, you know, if I was somebody who had a fiduciary responsibility, if I was sitting on a board and advisory board or a full board member in some company, and I did not know what security really was, and I did not know exactly what was going on, and I was sitting there looking at Oh, well, we have a chief information security officer CISO or our Chief Technology officers, officers taking care of that or my budget for this is huge. I'm sure I'm fine or even worse, a plain ostrich and sticking the head in the sand and just hoping nothing happens. And I gotta tell you from surveys I've seen here's another thing that I think you want to know if you have any responsibility for your business owner. If if you're the regular old office manager who's been signed security for the company making sure the antivirus is updated. You already know that that's not good enough, right? The antivirus just doesn't work against any of the modern threat, none of them. Okay. And you're sitting there thinking that everything's taken care of and you have not brought in a temporary board member advisory board members, someone to have a serious look at your security. Man, you've got some serious problems, very serious problems, because this is absolutely huge. And, you know, when it comes to the FBI and some of the other training I do for the infragard and for businesses in general, you know, I'm seeing this everyday people who have the titles, who have the certificates who have completed these programs I'm seeing all the time, and I've seen hundreds and hundreds of these people who are heavily relied on the Yet don't really know what they're doing. That's a real problem. Now it's one thing if you tell the boss Hey, listen, I don't really know what I'm doing. But I'm learning this and I think we are making the right progress that that's one thing, but to say, yeah, we are all set. And then as he as a pistol-whipping the forums, right, just check, checking pencil whipping all the way down, checking off everything. Yeah, that's good. That's kind of the outcome. And a man. I've seen so many businesses doing that, too. So if you are a business owner, if you are sea level, if you are on board, even if you're on like me, Board of volunteer organizations, you have a responsibility, and you got to take care of that. No, well, anyways, out of time for now. We'll be right back and I'm going to talk about training employees to spot yet another emerging threat, something that's really going to nail us. You're listening to Craig Peterson on WGAN.

Hey, what a fast-moving day today I'll be having a great day, whatever it may be listening to me on Saturday or any day during the week, a lot of people tend to listen when they're driving around other people when they are at the gym. And, you know, I just totally appreciate everybody being with us. And that's why we try and keep you up to date. We've got some amazing pieces of training coming up. So I want to make sure that you are aware of them. I've been posting and doing a few Facebook Lives, like when I appear on the radio, some of my segments are showing up now over on Facebook and also on YouTube, both of those live channels, so you can listen in and comment. And when I run them live, what I'm doing is I'm actually, Of course, recording them when I'm on the air and then later on in the day. I will run them as live and I will be live there. So I'll usually post articles in there that I'm referring to, as I'm on the air. And I'm answering questions from people who might have questions as that air lives. So it airs, live airs, there we go. And the idea is that, frankly, it's even better in some ways and listening to me on the radio, because now you have the opportunity to interact and get some behind the scenes stuff that I just can't share when I'm on the radio. So the best way to find those Well, I have links on my newsletter, right at the bottom to my social media channels. And of course, you'll find those easily by just going to Craig peterson.com slash subscribe, and you'll see them all right there. So let's get into our next article of the week, and that is a new emerging threat. I've talked on the show before about some of the problems that we're starting to see with deep fakes. I don't know if you saw the newest star latest Star Wars movie I suspect a lot of you guys did. Because frankly, you know, we're all kind of sci-fi geeks. I think on this side of, if you're a tech geek here, you got to be some sort of a sci-fi geek. And as a sci-fi geek, I went, and I saw it and I liked it right. And, man, I remember standing in line when the first Star Wars movie came out. I remember the first Star Trek movie coming out to standing in line all by myself, because No, none of my friends wanted to see it. Or actually, I think one of my friends came with me. And we saw the original Star Wars movie. It was really, really cool. So this was the end of what a 30 year. Man hasn't been that long. When did that come out? So it would have been around 1980 I think so man, a 40 year long the story arc, which I really enjoyed. I enjoyed it a lot, but in That movie, Carrie Fisher played a fairly major role. You might remember her from the original movies. This was Princess Leia and Princess Leia, ie in this case, Carrie Fisher was still alive, an older woman and she died before they even started filming this thing. And so you look at a new think Well, okay, so maybe what they did is they took some stuff off the cutting room floor from the other movies. Well, wait a minute. Now this she's older, right? She's an older Carrie Fisher. And so these movies that they had on the cutting room floor, most of them she was pretty darn young, so those wouldn't work. And then I realized, wait a minute now because I saw a couple of little errors and it really, I said wait a minute. This is obviously a deep fake. And what they had done is completely computer-generated The character, and it looked like Carrie Fisher, and they computer generated the voice as well it so it sounded like Carrie Fisher Well, it was computer augmented and any rate, this is a huge breakthrough. We've talked about it what's going to happen when they have our president on. On TV, they're showing a video of him saying that the missiles are flying in five minutes, kind of like Ronald Reagan did right during that microphone test back in the day. What's going to happen? How are you going to know if it's legitimate or not? And with more and more money being spent, look at what's happening right now with Bloomberg who's looking to spend a billion dollars on TV ads, and where he's been running ads, he's actually been rather successful. So what's gonna happen if he starts I'm like, I'm not saying that Bloomberg is going to do this, but if some candidate who has plenty of money to spend starts just Generating fake videos. Now we already know about a lot of fake stuff, right? Do you remember Paul Ryan pushing old people off of the cliff in their wheelchairs? Right. And that was, obviously satire. Some people actually didn't think it was they thought he would really do that. But you know, frankly, it's satire. So it is what it is. But what's going to happen when this is now deep fake, and it's the norm and we don't know what's what? Well, let's move this to the next level because we've never talked about this before. And I thought that this was an interesting idea. And this is by Ian Croxton, and he's over at dark reading. But cybercriminals are now starting to use deep fakes. You know what a business email compromise I hope because we've certainly talked about it enough on the show before and usually what happens is a bad guy goes ahead and does research on a business. Find out who this CEO is where the CFO is, right? We, you know, the scoop. And then they find out maybe when they're out of town, who their suppliers are, who their customers are, and then they start sending these emails directed at employees to get them to do something they should never do.

Obviously a problem, right? You don't, you just don't want that to happen, but it does happen. Now what they're doing with some of the phishing scams, where they're using voice mail and even phone calls, is they're using computer-generated voices, but not just voices, but the voices of the boss. Take me for example, I have thousands of hours of video and audio recordings that are available publicly on the internet. So it's easy to get a fix on me in my face. It's easy to get a fix on my voice. And to computer-generated stuff, right? That does not make sense to you. It's very, very easy to do all of that stuff in this day and age. So the concern now is that deep fake fraud is going to be hitting us in a bigger way. And it's going to be devastating for businesses. We talked about this next, this next one here last year, but a top executive at an energy company was revealed to have been conned into paying 200,000 pounds by scammers using artificial intelligence to replicate his boss's voice. So this guy answered a telephone call. He believed it to be from the German parent company. The request was for him to transfer funds which he dutifully sent to what he presumed was this parent company. In the end, the funds were actually being stolen by sophisticated criminals at the forefront of what I said last year was going to be a frightening New Age of deep fake fraud. And that's what Ian is bringing up here again. And I'm glad he is he's only what about how far behind us as eight months behind us, but this is going to be a very, very big deal. There's an example of a journalist and you can find these things out on YouTube, who paid 550 bucks to develop his own deep fake and he took the face of Lieutenant Commander Data from Star Trek next generation and put it over Zuckerberg Facebook two weeks to develop the video. You can find it online very easily. Just search for Lieutenant Commander data Mark Zuckerberg deep think, and you'll find it. So deep fakes are going to thrive in the modern workplace. There's no request, employees want to do what they're supposed to do they want to please their bosses. So we need a new era of employee security training. Frankly, a deep fake detection challenge was announced by Facebook here recently. There's work going on which is a lot of work going on. But I want to make sure you guys all tell your co-workers to keep an eye out for deep fakes. Because you might think the calls coming from the boss and it isn't just going to be the boss's phone numbers showing up on the caller ID now, it's going to be the boss's phone number and it's going to sound like the boss. And that's where it gets to be a real problem. All right, stick around. When we come back, we're going to talk about how you as a business and a consumer are going to have to weather this storm. That hasn't happened because of GDPR CCPA, or PDPA and more stick around. We'll be right back.

Hello, everybody, welcome back. Craig Peters on here on WGAN online as well, of course, at Craig Peterson calm. You know, consumers are always looking for protection and we have various consumer protection agencies out there. And Congress is trying to do something to protect our privacy. The big questions to me are, where are the lines? Is Congress really going to help us or hurt us? Right? All of the normal things you would expect me to question Congress and these laws, rules, and regulations. GDPR came out a couple of years ago over in the European Union, and it was designed to help protect not just the data but the identity of citizens of the European Union. GDPR, By the way, stands for the general data protection regulation. It gave them a bunch of rights, including the right to know what data the company was keeping about them keeping on them. It also gave them the right to be forgotten that if you saw something you didn't like on Google results or some other website, you could request that data be taken down, and they had to take it down. Now I kind of like this, because of some of the warnings have given my kids I can see it happening. But I like it when you've got people in their teens and 20s posting stupid stuff online, right, the silly things that kids do in college and before, and it's online, and it lives forever. And now you are looking for a job. The first thing that employers going to do is do a Google search for you. And once they've done that Google search, guess what comes up those videos those photos of you doing things and, and also, you know, some of this stuff that you had posted some of the stuff you had written some of the tweets that you put out. So how does that all work? How are you going to get rid of it if you don't have the right to be forgotten? And there are obviously multiple sides to that one, but I kind of like that. Well, if you are a business person, your business has a responsibility now to comply with these laws. And what a lot of businesses in the US did is they said, oh, we're not gonna be able to comply with all the GDPR rules and regulations. So we are just going to block access to anyone coming from the European Union. And they did that and some of them It took months to get their systems rewritten and designed so that they could handle those new rules and regulations from the European Union.

Well, that's all well and good. But now you can't just do that kind of blocking anymore. Because those types of rules and regulations are nowhere in the United States. As of January 1, 2020, our friends in California have a new log in live should say in place. It's called the California Consumer Privacy Act. That's the CCP a. And that act is basically doing the same thing that is being done in the European Union. And if you think you're compliant, or you're not going to have to comply with this, I'm going to go through some stats I think might really surprise you. California also has something called the PD pa which is the personal data protection act is not California, I mean, Singapore, okay. So there is a growing set of rights Relations. There are regulations in most states to some degree. states like New York and Massachusetts, and obviously California has laws that are much more restrictive about personal information. And there are more and more than coming online. So it frankly, is a very big deal. But here's what people are starting to realize. There was a there's a company out there called Capgemini. And there was some research published last fall by Capgemini. And they found that only 28% of firms that must comply with the European regulations, were actually in compliance. So about a quarter of the firms as of last year in the United States that were required to be compliant with the European Union were actually compliant. So that means 75% percent of businesses here in the United States that have customers or even people visiting their websites from the European Union. 75% of those businesses are not compliant. And yet, at the same time, there was the research that was done of companies asking them, are you compliant with the European rule rules? And 78% said, Yes, we're confident that we are compliant, even though an actual audit showed the exact opposite that 75 almost 75% it was actually what 72% were actually compliant. So more than 18 months into the California regulation, how many of our companies that have people visiting our websites from California or the have customers who are based in California, how many of us are compliant? It's not as though this came out of nowhere this rule, this regulation has been in place now, for over a year. It's just that as of January 2020, this regulation has some serious teeth to it. Now, we got a call from another company, who is based in New York, and has some of their work workers out in California, and definitely has customers in California. So they absolutely have a legal Nexus to California. And they said, Hey, we want to make sure that we're compliant with this new California consumer data or Privacy Act.

So we put together a proposal for them. And just to examine everything now they have some of their own systems, some of their own software, that they're keeping customer data. And everything else. And it's basically it's going to cost them 30 to $50,000. Just to have us do a deep dive for them. Now, this is a bigger company, they have some of the money to do it. Well, frankly, they have all of the money to do it, and they should be doing it. At this point, I don't know if they're going to do it or not. But that 30 to $50,000 is just to look at their existing systems, and tell them what they need to do. So this growing set of regulations in California, and regulations that are growing nationwide because the federal government is looking to take those California regulations and put them in place. So this growing set of regulations. Well, I think crucial to consumers, and something that businesses should have been doing a couple of years ago because of GDPR. The European regulations Something businesses should have been doing anyway is not going to be cheap. It is just not cheap. And then if companies are found to be out of compliance, Wow, now it's really not cheap. Because if you are out of compliance penalties upwards of 4% of annual global revenue. So the 12 major fines that are been handed down since this European regulation went into effect in May 2018 are almost $400 million spent on fines alone. So the cost of compliance is very big, but the cost of non-compliance is even bigger. So the truth is that privacy is almost dead. So we've thrown our hands up. We know our private information is out there. And this is the government's response. Try and get control of it. And if you are a business, make sure you do at least two of these three steps and I can send them to you. Just email me at Craig Peterson calm. I'll be glad to do this for you. One, identify your sensitive data to know who has access to it and who has access to it, and implement controls over the access and make sure you keep them updated. So there you go. You'll find a little more about this online at Craig Peterson. Calm on all always more than glad to send you guys more information. You know, I don't charge for any of that stuff. Right? And you just email me at Craig Peterson calm. I'll be glad to get back to you. All right, Take care, everybody. We got oh man, only one more segment we're going to talk about the Jeff Bezos hack and online employment scams. talking fast next time, stick around

Hello, welcome back. Craig Peterson here listening to me on WGAN or online, your favorite streaming app, whatever that might be. I'm kind of everywhere. I've been doing this for a long time. Hey, we're going to talk right now about our friend Jeff Bezos says his stock has been kind of interesting this week. Well with the whole coronavirus and everything going on. Plus, it turns out I don't know if you heard Amazon was able to secure some warehouse space down there in New York. So is obvious that ao sees district is not going to benefit from those jobs because she made sure that they couldn't get in there, but they did manage to get in. Well, Jeff Bezos had a very public divorce happen. You might remember this. Of course, he is the richest man in history. And his ex-wife walked away with billions Now this story gets kind of interesting when you turn the time back because what we just found out here in the last week is that Jeff Bezos, his iPhone was apparently hacked. Now I can hear you saying I'm Craig iPhones hacked. I thought you said iPhones were impenetrable. Well, obviously, nothing's impenetrable. If it has a plug or any sort of a wire, it can probably be broken into right. That's kind of the bottom line. But in this case, this backstory is interesting as to what happened here. It wasn't iOS. It wasn't the iPhones operating system that appears to have been the problem. It appears to be an application that Jeff Bezos was running on his phone. And it might be an app that you use. And I am a little concerned that, you know, if you're using it, you could be in trouble. But at the same time, I think they probably have the vulnerability that was used. We remember Jeff Bezos bought the Washington Post. It, of course, is a fish wrapper down in Washington DC. It had had it had a just an amazing past some of the things that they've exposed on both sides of the aisle, but primarily, they've always been a little left-wing. And now, for the last two, what 20 years they will basically since Ronald Reagan, they've been extremely left-wing. And Jeff Bezos bought this paper. And one of the journalists that wrote for The Washington Post name was Jamal Khashoggi. Now, this guy, Jamal Khashoggi was, by all reports, not a good guy. And he was of you know, this whole dispute he was involved with between Israel and the Arabs and, and the attacks that were going on over there, that very well, let's just say he's an interesting character, right? That's just kind of trying to put it a nicely interesting character. Now, you might also remember that he got some sort of an invitation to a Saudi embassy. And apparently, while he was there, there are recordings that were leaked of him being murdered. And apparently he had been dismembered and his body disposed of it, just a horrific, horrific story. Now, the Washington Post had decided that since just Jamal Khashoggi was a journalist of theirs, that they had to do something and so they did. They really criticized heavily the Saudi royal family, and in particular, they ended up criticizing the Crown Prince of Saudi Arabia.

Now, this is a very interesting problem here because Khashoggi wrote articles for Jeff Bezos, this paper with titles like Saudi Arabia wasn't always this repressive. Now it's unbearable. Another one Saudi Arabia's Crown Prince already controls the nation's media. Now he's squeezing it even further. Apparently the Saudi leadership ended up bribing Twitter employees to find out who some of the tweets were coming from that were anti, the Saudi Arabian government. And, and we know that it has been very repressive over the years. I guess we can chalk that up to another country, I'll never be allowed to go to right after the criticisms. But against this whole backdrop of the murder of Khashoggi and the not obviously not slandering, I don't think because I think they were right. Saudi Arabia, billionaire Jeff Bezos accepted an invitation to this dinner party in Hollywood, which was attended by Saudi Crown Prince Mohammed bin Solomon, as well as some friends. So apparently, Bezos was at this party on April 4, 2018. And Bezos and the Saudi Prince made a key exchange at dinner. And that's where the problems apparently started. Because Bezos has an iPhone x. That wasn't the problem. The problem was apparently WhatsApp. Now I've got a well so add that there are denials all over the place here about the Saudis been involved in this. There are denials about WhatsApp being the source of this problem, but I'm reporting here, what's in the news right now and then The explanations I'm reading from a technical standpoint are reasonable. So I, I'm repeating them because they do make sense to me. So apparently on May 1, so about a month after exchanging these keys with WhatsApp, the Crown Prince is sent a message to Jeff Bezos, his phone through WhatsApp, and the message apparently is an encrypted video file. And it's later established according to secure World Expo com. It's later established with reasonable certainty that the videos downloader infects Mr. Bezos, his phone with malicious code. Now, there's a lot more evidence as referred to in this article. But basically what happened is that the record showed when they went back and looked at the phone and they looked at the data utilization Through the vendor of the data for his iPhone increased by almost immediately by more than about 30,000%. absolutely crazy. So all of a sudden, his iPhone started sending data out. Well, it wasn't the iPhone per se, it was the WhatsApp app. And it was sending it out and just crazy amounts of data being stolen from it within hours of that video message being received from the Crown Prince. Now, experts are saying that the most likely explanation for this data being taken out was the use of mobile spyware. Then there are some out there, there's NSL groups Pegasus, or the hacking teams Galileo, but we're talking about more than six gigabytes worth of data that was removed. One wasn't removed. It was sent from his phone So the allegations go on and on here. But basically, what apparently happened is they got a hold of Jeff Bezos, his videos and photos. And, man they're all of a sudden there's this online campaign against Jeff Bezos and October 2018. And Top trending hashtag it isn't Saudi Twitter is boycott Amazon. A single photograph is texted to Bezos from the Crown Prince's WhatsApp account with an image of a woman resembling the woman with whom Bezos is having an affair, months before the affair was publicly known. So the Daily Beast in February 2019 ran this article how the Saudis made Jeff Bezos public enemy number one. So basically what happened here is is what tap was having It was then used to embarrass him and start the rumors, or at least more rumors about him having an affair, which ultimately led to Jeff Bezos, his divorce. And that ended up costing him I'm trying to remember now, but it was, it was in the 10s of billions of dollars. don't remember the exact number. Now, if your WhatsApp users are going to happen to you, I can say, generally speaking, Whatsapp is considered to be safe. Personally, if I have and I had an iPhone, which I do, I would use messages from Apple. Much, much safer than almost any third-party app out there. There are a couple of companies that I trust silence one of them, but I would use I message the hands down before I would use WhatsApp no question about it. And you know, it doesn't mean that your iPhone is not 100% safe or the It's Android is 100% hackable. But in both cases, you got to be careful. One more thing to warn everybody about and this is unemployment scams, according to the FBI are on excuse me, employment scams, according to the FBI are on the rise. And they're saying that the average victims losing $3,000. Here's what's happening. People are hearing that it's a great job market. So they're going online. They're looking for new jobs, looking to see Am I being paid enough? What's going on? Well, these cybercriminals are getting people to apply for non-existent jobs, and getting their personal information like social security numbers, home addresses, and then on top of it all, having them send money to the criminals, which is absolutely amazing. Big, big fraud out there going on. Right now there. The FBI knows about 50 15,000 incidents that account for more than $45 million in losses so be very, very k very careful online. If you're interested in a job, I can send you a document here that we have called guidelines for a safe job search. Obviously you can look for that online too, but guidelines for safe job search, just email me me me at Craig Peterson calm. I'll be glad to forward that along. The FBI statement says applicants are contacted by email to conduct an interview using a telephone application. According to victims, cybercriminals impersonate personnel from different departments including recruiters, talent acquisition, human resources, and department managers. So there you go. By the way work at home jobs that pay high initial salaries for inexperienced workers is another sign to question the job posting is if that shouldn't be obvious to everybody. So today we have been busy, I've given you tips and solutions to solve a bunch of security and other problems we talked about today. Email compromises going on legacy software, save the privacy on facial recognition, systems, downtime and cost doubling on ransomware. So what you can do to protect yourself, we've covered all of that and of course more, and you can find it. You can just go online, you'll see it posted on my website at Craig Peterson, calm. You can follow me on Facebook. I have just tons of great stuff up there every week. But by all means, make sure you subscribe to my newsletter. To get all of this every week. Craig Peterson calm, slash subscribe. I don't sell it. I'm not going to harass you. I'm going to give you good great information and training. Have a great week and we'll see you online Craig Peterson dot com.

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

What a busy busy week in the world of technology.  We are going to hit several topics today.  Business Email Compromise attacks are running rampant through business. Failure to update older technology is putting businesses at risk. Facial recognition technology is being used but the issue is privacy and how to protect it.  Will hit Ransomware, Employee Training, Regulatory Compliance, Online job postings and what precipitated the most expensive divorce.  It is going to be a busy show -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

I've got some free online privacy training coming up.

I have been teaching courses on security for the FBI InfraGard's program. And now I'll share some of the step-by-step tips and tricks that we all can use to keep ourselves and our information safe online. And it won't cost you a dime.

---

Related Articles:

Most Businesses Attacked By Business Email Compromise Last Year

Keeping Legacy Software Safe

Concerns About Effectiveness and Privacy and Limiting Facial Recognition Adoption 

Downtime and Costs Double as Ransomware Attacks Hit Larger Businesses

Employee Training Key to Spotting Existing and Emerging Threats

Regulatory Compliance: The Perception and The Reality

WhatsApp, Hired Journalist With Saudi Enemies: The Reason Behind Jeff Bezos WhatsApp iPhone Hack

Searching For A Job Online -- FBI Warns About Rising Number Fake Employers
---

Automated Machine Generated Transcript:

Hey, hello, everybody, Craig Peterson here. Thanks for joining me, whether you are online listening to me on a streaming service, or listening on the radio on my website, kind of everywhere, we are going to be talking about most businesses now what's happening to them? How are they attacking to new statistics out, we'll be talking about how to keep some of your legacy software safe. If you're using Windows seven, or if you're using an older version of the software, because you haven't been keeping it up to date, which is like what all of us right? We're going to talk about what you can do some effectiveness, concerns about privacy, limited facial recognition, adoption, what's going on there. We talked a bit about that last weekend, downtime and costs. If they have gone up here. ransomware attacks are hitting businesses and individuals even harder than at any point in the past. So what's that all about? What are the simple things you can do to help protect yourself against it? We're going to talk about some employee training you need to do if you are a business person, regulatory compliance, what's the perception? What's the reality, we've seen a lot of businesses that are doing what we've been calling pencil whipping some of these forums that are trying to figure out whether or not they have complied with some of the laws, rules, and regulations. We're going to also talk about the Jeff Bezos phone hack today, and about a warning coming out from the FBI about job searches online. So a lot to talk about today. And we are going to start out with half of the organization's worldwide were successfully finished in 2019. But can't even talk right now. This is something that's very concerning. Now. It isn't as bad as it used to be phishing attacks used to be almost 100% effective. Of course, these are the types of attacks where someone sends an email. And the email is trying to get you to help this Prince in Nigeria, or whatever it might be. Those are phishing attacks, I've gotten a lot more sophisticated to the point where they are today, where we warn people to not even put information about who the employees are even physical access or addresses of the businesses, if they are not, obviously a walk-in type store because that is being used online by the bad guys. They go to your website, they figure out who the CEO is, who the CFO is, whatever information they might need. And then they use that now to go after you and go after you in a very bad way, frankly, because we are falling prey to it. And we're going to be talking more a little bit later on a couple more segments about what is the cost to businesses right now. Some of the phishing attacks, because you remember, they will use phishing for a number of different reasons, not the least of which is to get you to install malware on your computer. You know, unbeknownst to you, right? It's not as though you purposely are selling malware. But we're going to talk about that here in just a few minutes. There is a number of companies out there that do various types of simulated phishing attacks. And the idea behind these is that they will go ahead and send your employees emails that are based upon the latest phishing attacks, right, the type of phishing attacks that have been going on for the most part, and they will record whether or not each employee has clicked on a link that they shouldn't have clicked on. So obviously, when they click on it, it goes through the software that's tracking them and knows what they did. And you know, now they're in trouble, right? Because they did what they shouldn't have done and they will usually have some remedial training for these people to help to build awareness, help them understand what it is really what's going on what they should be doing what they maybe shouldn't be doing. All of that stuff pulled together. Well, one of the companies that does this fishing susceptibility testing along with the security awareness training is called proof point. And they take a look at all of their numbers and try and roll them together. So this report that I'm looking at right now is examining global data from nearly 50 million simulated phishing attacks that were sent by proof point customers over a one year period. And they also did third party survey responses for more than 600 information security professionals in all of the major countries out there, not some of the small ones. And they put this all together. So basically, it's 3500 working adults who are sitting paid for that part.

Now, here's what they found. Here are the tips for you. If you are a business person if you're responsible for it within an organization number one here in the Help Desk security article is effective security awareness training, must focus on the issues and behaviors that matter most in organizations' mission. Obviously, that's kind of corporate-speak, right? But he's saying that really what we have to do is look at what our assets are, what our mission is, as a company, and you know, value those what is the value of those, what should we be doing, when it comes to our data, the things that we if we lost, we would go out of business or we might get fined, that might come after us, etc, etc. So he goes on to say we recommend taking a people-centric approach to cybersecurity by blending organizational-wide awareness training initiatives, targeted threat driven education. The goal is to empower users to recognize and report attacks again, oh my gosh, you know, this is the sort of thing that you get from a PR agency, right? I doubt the guy actually said that. But it really is about people. We have various types of automation. If you have the basic stuff like you've got antivirus, and you've been listening to my show for a while, you know, anti-virus is zero percent effective against the latest types of attacks. And it is not effective at all. antivirus software in this day and age is pretty much useless.

Now, you should be using it as part of a bigger stack of security software and procedures and things. But bottom line, it's just not that useful. And they're also saying that end-user email reporting is critical. They're showing that the number of reported email messages jumped significantly last year. And that's a really big jump at about 67%. So make sure if anyone in your organization has any questions about an email, they're thinking it might be a fake, it might be, you know, a problem phishing, etc, that they forwarded to you. Now we'll go a step further because of my company mainstream, we go ahead and work with the FBI and state investigators. When there are serious problems. Obviously, we will work with the company to it's not as though we're going to squeal on them. But we haven't covered numerous foreign government and also organized crime hacks into businesses. So if you're not reporting it, nobody's going to know and nothing can be done about it. So here are the key takeaways from this last year. More than half it's 55%. I've surveyed organizations dealt with at least one successful phishing attack in 2019. That's a very big deal. That's a very scary thing, frankly. And info security professionals have reported a high frequency of social engineering attempts across all kinds of different methods. 88% reported spear-phishing attacks, 86 business email compromised attacks, those are the ones that are hurting our businesses most and those are the type of things where they're faking that they're a vendor or they're the owner and they're asking people to wire money around. So be very, very careful. smishing is fairly new, but 84% of the businesses are saying that they had SMS and text phishing attacks that's way up. 83% said fishing which is voice fishing, and 81% reported malicious USB drops isn't That's something 65% of the surveyed infosec professionals said that their organization experienced a ransomware infection in 2019. That is high, high high. Now, you know, the FBI advises to never pay a ransom. But a third of all organizations opted to pay the ransom. And we've seen that even in cities that have been attacked by ransom, or that they did pay ransoms. 32% did not have those who negotiated with attackers 9% were hit with follow up ransom demand, and 22% never got access to their data, even after paying the ransom. So keep that in mind. And the other statistic that I've seen before from the FBI says that even if you pay a ransom, the odds are only 50% that you'll get all of your data back. Remember, these guys aren't writing great software. In fact, most of them aren't even writing this software at all. And what that ultimately means is it buggy? What do they really care as long as they get some payments right? organizations are benefiting from the consequent model. 63% of organizations take corrective action with users who repeatedly make mistakes. So I think that's an important thing. Many working adults fail to follow cybersecurity best practices. 45% admit to password reuse, which is one of the biggest sins, frankly, that you can commit is reusing passwords on multiple sites, more than 50% do not password protect home networks. And 90% said they use employer-issued devices for personal activities. These are all things they shouldn't be doing. In addition, 32% of working adults were unfamiliar with VPN services. One of my pieces of training was about VPNs. You might find it I think it's still up on YouTube. But how VPN services are in some cases worse than not using a VPN at all, you've got to be careful because some of these VPN services that are out there, they're actually having new use their service so they can track you online, sell your information. So the VPN service is only charging a few bucks a month, or heaven forbid, free. You really have to wonder just how good is it. So follow those practices need to understand the common cybersecurity terms. I don't maybe I should do a little training on that one too so that people know what's up. And Millennials are continuing to underperform other age groups in fundamental fishing, and when ransomware awareness, so stick around when we come back, we're going to talk about keeping your legacy software safe. Are you still using Windows seven, eight or maybe something else? It's kind of old. Stick around. We'll be right back. You're listening to Craig Peterson on WGAN.

Hey, welcome back, everybody, Craig Peterson here. If you have a computer that's been around for a few years, have you stopped and had a close look to see if it's reached its end of life. Now I'm not talking about the hardware is about to fail or fall apart. You know, that's something I think you can deal with and everybody knows to deal with. And more importantly, if the hardware falls apart and stops working, you have to deal with it. But what about the software that's on your computer? What about the software that is, has been installed and it has been there for who knows how long? When was the last time you actually updated it I walk into customers' new customers all of the time, and they are running really old software? And man, I can't tell you how many times I've walked into a place and they've got a database. It's Microsoft SQL Server, server, and they have just got a development version there. They're in. In fact, they bought the software. And the software vendor gave them a free development version of SQL Server. Even though it's in production, even though they're supposed to be paying for a full license, I see it all the time. And then because they don't have a full license, in fact, they don't even have a legal license to use it in the business environment. The next problem happens, which is they've never updated SQL Server. We used to see this all the time with Windows where people were using a hacked version of Microsoft Windows, versions of Windows that were never licensed, never licensed properly. We don't see that as much anymore. But what we are seeing is software that's passed the end of life including windows As of mid-January January 14, 2020, Windows seven Microsoft is no longer supported for security updates, at least unless you pay Microsoft a small boatload full of money. They are providing it, but they are charging money for it. And now the last subscription I saw for security updates for Windows seven was about $80,000 a year. Now, I don't know about you, but I think that's a little bit pricey. So now you end up with the problem of Okay, so I am running old software, maybe even Windows XP, we see that all the time in the manufacturing business, where they're controlling systems and control systems running XP. So what do you do now? Because if you upgrade your base operating system, that means there is software that you're running that may not work with the new version of Windows. And frankly, that's probably the number one reason we see from people who don't upgrade and don't want to upgrade because it's could end up being a very bad thing for them a lot of pain, right? Well, Windows seven is already past its support window. And we're Windows Server 2008 will officially be ended just this past week. So if you're running Windows Server, which a lot of businesses are, right, you're using Active Directory server as much as I don't like it. Most of our customers use it because there's not really a whole lot of other options for them. But it's really significant here that these older operating systems are no longer going to get routine security updates and patches going forward. Windows seven, believe it or not, is 10 years old now. And it's still in style. It still works. And according to StatCounter, Windows seven is still deployed on one out of every four Windows machines. So That means you are probably like everybody else out there and is still running Windows seven or some of your machines. And part of the reason for that may be because you're concerned about doing the upgrade, right, and update. So we're going to talk a little bit about that some things that you can do. But first of all, I want to give you a couple of warnings, because I think I might have to get you out of that feeling of invulnerability that you might have Windows 720 19, there were more than 1000 vulnerabilities that were found over 1000 in just 2019. ingest windows seven alone. So businesses are facing a very real security risk by using any of these products after their security updates pass.

But you know, can you migrate? Yeah, obviously the answers. Yes. Can you do it quickly? Well, Not necessarily quickly, and certainly not immediately for most people. So most businesses are finding they're using the sound supported software for months, years or even decades later. And Kaspersky research, which is a Russian company that does all kinds of stuff when it comes to security, they got some pretty decent security software. But the problem you and I think you might find with their security software is it's from Russia, and the US, the federal government has come out and said, Don't use Kaspersky. So I can see that I can see why they're saying that but they're reporting that 40% of very small businesses, so 40% of businesses under about 10 employees, and about 48% of small and mid-sized businesses. So the bigger businesses that should have the ability to do upgrades are still using unsupported software and software that's approaching the end of support. So you got to be very, very careful, okay. And if you're a manufacturing company, or you have industrial control systems, you might have an H HVAC and an air conditioning system in your building that is hooked up to your network connection, so that the technicians can get in remotely to look for problems, maybe the systems call home, to let them know that, you know, your coolant pressures too low or whatever the problem might be. Those types of systems can be some of the worst to some of those, as I mentioned, before, we're finding we're still running Windows XP. And that is way, way out of date. So you know, have a look at all of those to man, we could go on for a long time about the problems that we've seen, and some of the problems that you need to take care of. But when we're talking about 24 seven operations, so we're moving on to the next level. Business kind of manufacturing or maybe you have a help desk where people call it 24/7. And those systems are up and online the whole time, it becomes even more important becomes even more critical. If a new vulnerability is discovered, I really have to emphasize here you have to take extra precautions. So what do you do in the meantime to protect yourself, here are some tips for those of us that are still running older software? And as I said, we're talking about what 50 60% of us frankly, our and a third of us are running unsupported versions of Windows. Number one you could do is buy extended support. Now, this is probably the least attractive option for companies that don't have a lot of cash lying around but it is the most secure. If you're an enterprise customer, you which means, by the way, you have to use any enterprise versions of Windows, not the stuff you got when you bought your laptop from staples or, or just from regular old Dell, okay? But enterprise customers can pay Microsoft for extended support through January 2023. Now, it's very expensive. Okay, so the price is going up every year. So be very careful with it. We're talking about million dollars worth of expensive, okay, so very, very big deal. If you're still running Windows XP, the cost for extended support for an organization with 10,000 plus machines leveled out at just under $2 million a year. real money. It's crazy money. So that's probably out of the question for most of us. So next up, here's what I've done for a lot of customers and I can help you with this if you need this as well. But there are ways to isolate both older machines from your regular network and I'm not just talking about going ahead and doing some network segmentation. I'm talking about having special internal firewalls to isolate these machines, okay, old decommissioned and non-supported operating systems and software that cannot be patched, have to be isolated. Obviously, you also would need to limit user access to the machines and limit what they are doing on those machines and try and keep them safe. And watch for what is called out of band fixes. Some vendors may still issue critical fixes, but you know, keep an eye on it. It could be dangerous. All right sticking around. We're going to talk about this new facial recognition technology that London is adopting. I talked about it this week, a little bit on my radio and TV appearances. But we're going to get into a little bit more because it is coming here to the US as well. Stick around you're listening to Craig Peterson WGAN Online.

Welcome, everybody. Craig Peterson here and online at Craig Peterson dot com. If you haven't already, make sure you sign up for my email comes out every week on Saturday mornings typically is when we get it all done on time so that it's out for the show. But I do go through some of the most important articles for the week, a lot of security stuff including what the number one patch that you need to make to your systems. So that comes out at least monthly, my newsletter and these patches are patches to software that is attacking right then and there in the wild. In other words, it isn't just patched for the sake of patching. It's this is a serious problem. And if you don't deal with this problem right away, you could become a victim. So you've got to really kind of keep an eye on that. That is part of my newsletter that comes out and you can get that by just going to Craig peterson.com slash subscribe. Well, we're going to talk right now about the effectiveness and privacy here live and limiting facial recognition adoption. This is something we talked about a little bit about last week as well. Of course, we talked about this company that's out there doing facial recognition stuff that's really kind of scares me, because they went and they crawled all of the public photos they could find from sites like Twitter and Facebook and some of these photo-sharing sites. They pulled them all together, 3 billion of them, and they put them into a database, the company's called clear view, and they recorded where they got those photos from, and then they've been offering it right now. To the police, obviously they had ideas about offering it to other people is, you know, ultimately, but the police have access to it. And that's been a problem. because nothing's 100% plus at where do we draw? At what point? Do we draw a line saying, hey, my privacy extends even to those things that I posted online? This is a fine line. It's a real problem. And as we've talked about before on my show, ultimately, the law, legs far behind the technology, technology comes up with something new. And then the rules or regulations, follow the laws, which are all coming out well after the fact. Now, sometimes, they try and pass laws beforehand. And that ends up being a problem because we don't know what all the problems are going to be. So it's a catch 20 too, right? You can't, you shouldn't really put the laws in place until we have the real problems. And then you're not going to see the real problems with the laws until they're in place. So we're talking about something like this. That's not a perfect technology. How far can they go? Now we know that if you are arrested, and they can take your picture, and your fingerprints, I've been doing that for a very long time. There have been a number of court cases about whether or not they can take your DNA. And of course, it doesn't have to be blood anymore. They can just do a mouth swab. They can get your DNA even from your hair, and know a few mixed results there. I know, basically, from everything I've read, the courts have come down on the side of if you are arrested and convicted, then they'll grab your DNA, and that's been used to solve some crimes. And in fact, facial recognition has been used to solve some crimes. as well. But should we have the privacy in our papers basically in our documents? And they argue many times police in court, hey, listen, if you're out on a public roadway, you have no expectation of privacy. And, you know, I frankly, I don't disagree with that. I don't think you do have an expectation of privacy. But should it be legal for the police to be tracking you your license plate, taking pictures of you as you go through intersections? Again, where's that line drawn? And when we're talking about the facial recognition databases, these things are often wrong. They've got a success rate of less than 70%. But what is going to happen when their success rate is 99% that they are showing accurately, who you are 99% of the time.

Now, the next problem with companies like ClearView AI as far as I'm concerned government agencies is how safe is our data in their hands. When you get to the databases that hold the images, they are going to ultimately have vulnerabilities. So our, you know, our biometric information, our pictures, all the way through our fingerprint, Iris scans, the way we walk our pace, the way we speak. All of that's biometrics. Now, if you lose your password, you can reset your password and have a new one. If you lose the pin for your ATM card, you can go ahead and get a new one, right? It's pretty simple to do. But what happens if the government the state government or federal government has your photo and it's stolen, you cannot change your face. You can not change your biometrics at all. So is there any way for us to be able to trust that our privacy is going to be protected? And the answer is frankly, no. And is there any way we can stop the distribution of our facial data? Some states sell all of the driver's license data. Most states, I think now to whoever will pay for it. So the answer to that question, is there any way we can prevent the distribution of official data? The answer to that is frankly, no. And when we consider the damage that the leak of these types of databases could cause, cause it is freak, it's just, it's overwhelming. It's overwhelming to me. It's overwhelming to you. And I think we've got to be a lot more careful. Now. I mentioned this database company called Clearview AI. That scrubbed the internet found all 3 billion pictures pulled them in, kept track of where it saw the pictures. This is a big problem. But they say hey, listen because they're getting sued right now. It's okay so somebody by the name of great Graham Cluley he went to clear view an eyes website and had a look around and what they found is that you can have your photo removed. Yes, yes indeed. Now, they never asked you for permission to use your photo for their app that they're selling to the FBI homeland security agencies all around the world. No, no, no. All you have to do to have your photo removed from Clearview AI is are you ready? Um, this is straight from like a screenshot from their website. You can send an email to privacy dash requests at clear view.ai. And then you just submit a name a headshot, a photo of a government-issued ID to facilitate the processing of your request. Well, what if you're concerned about this company's clear view to AI, losing your data in the first place? Do you really want to send them a picture of your passport or your driver's license, which now most driver's licenses are federally compliant? Is that really what you want to do? Well, I think it's a real problem. Twitter has sent a cease and desist letter to them. Saying that clear view AI violated the policies over at Twitter, demanding any collected data be deleted. I would expect that Facebook is probably going to do something similar, as will these other websites that are out there where they have been scraped and They obviously the website had to find out about it. And now we're seeing London's Metropolitan Police Service, starting to use live facial recognition technology to scan public areas for suspected criminals. They've been trialing this technology for two years. And they're going to have this up and running by February 2020 going to be linked to a database of suspects. So, again, this is a problem. Facial recognition technology is just not accurate. What can you do? Well, I think we should all be sending letters to our representatives in Congress in our statehouses, and letters complaining to Twitter and Facebook, about companies like ClearView AI, you'll find this articles or articles about it up on my website at Craig Peterson, calm and of course, listening to me on WGAN, stick around with me Get back we're going to talk about the costs of ransomware in q4 2019 and today.

Hey, welcome back, everybody, Craig Peters on here and WGAN online course at Craig Peterson dot com. That's Peterson. With n Oh, well, we know what downtime is right? businesses have it. And it can really cause havoc, especially a long amount of downtime. When businesses get hit with a major outage, and it can be caused by a fire flooding the major server crash when they're hit with that sort of thing. It can be devastating. And most frankly, businesses are out of business within six months, with small-medium businesses, basically the larger ones. Well, by law because of Sarbanes Oxley, they have to be able to get back online if they're publicly traded within four hours. Now, a lot of businesses don't do that. Although they shouldn't be doing it and You know, frankly my business we are set up to be able to get back online pretty darn quickly, because you just can't afford the bad PR the bad customer relationship and the lack of sales that come in because you're down, right? Nobody can get it anything. Well, there are new and more sophisticated ransomware attacks that are really hitting businesses today and everything from large companies to little guys from state governments to the federal government. And some of these are considered to be the deep pocket target. Now you and I, we can get hit with ransomware. And to us, a $500 ransom might be real money. What is it half of the American households could not come up with $500 for an emergency expense and two, right. So I'm not saying that it wouldn't be devastating to get ransomware if you are a small office, Home Office, Or if the if it's your basically just your home computers. But ransomware costs now have more than doubled in the fourth quarter of 2019. According to the latest statistics, so the average ransomware payment has doubled. It is now at almost $85,000. That's in one quarter. So in the third quarter of 2019, the average ransom payment was about 41,000. That's the third quarter. So let's see what the third quarter last year September. Let's see November or October, November, December is the fourth quarter. And so it would be September, August in July. So July, August, September, the average payment for ransomware was 41,000. And then, in October, November, December, there we go. It's $4,000 that is absolutely huge. So I did a little bit of digging to try and figure out why did it surge so much? Well, apparently it's because they are using some ransomware software. It's called RealLoc. And I always have a hard time with this one, so doing co key B and they are going after the enterprise space. Now enterprise space typically means a medium or large business, as opposed to a small business. But in this space, criminals can really exhort extort serious money, deep pockets for seven-figure ransom payouts. So here is a quote, researchers some cover were saying q4 ransomware actors also began exfiltrating data from victims and threatening its release if the rain Sim was not paid. So it's not just ransomware getting onto your computer and encrypting your files and saying, Hey, listen, if you want your data back, you're going to have to pay us, which as you already know, you usually don't get your data back, right. But they are saying, we have your data, and we're going to let it go. And there's a big case about this late last year, and the chairman of the company was but this company had had its data stolen, and it there was an extortion angle on it. They're trying to get money from the company, saying, hey, if you don't pay us all of this ransom, we're going to release the data. And the company said, Okay, well do it because we're not going to pay that ransom. And the bad guys did release it. Okay.

Now there's third-party claims over the data breaches now that start to come in. But let's break down some of these costs. So if and then I'll get into what you can Due to help prevent some of these problems, but the cost ransomware attacks can vary. Obviously, if you're going to pay a ransom, there's one cost, right? Then the remediation which can be very expensive, if you get hit by ransomware remediation companies can cost you in the hundreds of thousands of dollars, then that's frankly, where you bring us in and we have a couple of people with their fire jumpers certified over at Main stream.net it can easily cost you $100,000 to try and get all of that stuff all your data back, right, get back in business, but all the hardware devices you're gonna have to do upgrade so all of this stuff you've been dragging your feet on you probably gonna have to do so it couldn't be quarter of a million up to two or $3 million for bigger company. Now there are also some other costs, besides the lost revenue from downtime because now you might have a bad reputation out there. Brand damage can occur here if the business interruption severe enough. If your clients are noticing that you can't do business if you are a provider upstream-downstream, it can be very, very bad. Now in addition to the ransomware payments skyrocketing according to threat post calm, the average downtime that a ransomware attack causes for a company also increased from 12.1 days in the third quarter to 16.2 days in the fourth quarter. That is absolutely nuts. Now, we have been doing a lot of remediation really for businesses. And one of the things we do for the bigger businesses if they are a public company or their division of a publicly-traded company is we put in equipment on-site for them. So that if their main servers go down, the new, the other equipment, our equipment that's on-site can take over and it can take over in a matter of minutes. So there's like almost no downtime, the only thing that might be lost is 15 minutes or 30 minutes, whatever it was since the last snapshot was taken and pushed to us. And then we push that data. Sometimes we do it through leased lines sometimes to do it through the public Internet. We push that data to our data center. And then it's encrypted while it is over the customer site and before it gets sent to us. So it's encrypted as it goes over the by the public Internet or some form of a leased line. It's encrypted when we get here so that we can now sneakernet if we have to, right. So the building, let's say it burns down, we can immediately recover. And then we take that data and we say snapshot it. And we keep snapshots for a year or more sometimes depends. public companies need to keep seven years of some of these snapshots like the email of the working files, especially companies that are manufacturing something where you have to keep it in, in some cases indefinitely. Like we did some stuff for saffron, which makes blades for jet turbans. And they have to keep their data for a minimum of I think it's, is it 20 years, you know, whatever the service life is of the engine those blades are put into. So that's what we do for publicly traded companies. Now that's not cheap. But they don't, you know, it just blows my mind how many of these companies that can afford it just aren't doing it? So when you look at these statistics and say that we're talking about 16.2 days of downtime if you get hit with ransomware how much revenue is that to them? Especially those companies that are making hundreds of thousands of dollars a day, they're going to lose that revenue because their manufacturing lines going to be down or their sales are departments going to be offline or their shipping or warehouse or maybe everything which is, which has happened to another division of a public company that we did the work for 25 years. Okay. So very, very, very expensive. And the third Post article goes on to say that this increase from 12 days of downtime to over 16 days of downtime was linked to a higher prevalence of ransomware attacks against these bigger companies, the larger enterprises, which are often left scrambling to try and get their systems back up for weeks. Now, again, that's something we've been doing forever and that's something You need to be doing if you're just a small company, having an offsite backup is critical. Having multiple generations of backup is critical. Because what happens if your systems are corrupted because ransomware has come in, has taken them over. And now your backup and backup backs up the encrypted data. So now you don't even have the data before the ransomware hits. Now you're completely stuck, right? Because your computer is encrypted, your data is encrypted on your computer. And your data is encrypted in your backup because you just backed up or just as bad or maybe even worse is your backing your systems up to a locally attached disk, right. You plug in one of those nice little USB drives. Guess what the ransomware is doing? It is encrypting that backup drive and it's also spreading to your Active Directory server and Your business, and it's spreading to all of the other computers in your business. It does this normally anything it can see any shares any mounts, it's going to encrypt. And that's why it takes so long. And that's why for our clients that need higher availability, because you are required to have a full disaster recovery plan in place if you're a publicly-traded company or division of a publicly-traded company, and you have to be back on in four hours. That's why we have equipment sitting there on-site with multiple generations of backups, in case something like this happens in case it gets through. Okay, so nowadays, we've got some working descriptors that are pretty good for some of the ransoms that happen. So you have about a 2010 to 20% chance that the data that has been encrypted will be you'll be able to decrypt it Cisco Talos per usual is one of the lead investigators, researchers and all of this. Those are the guys that we use Cisco talus guys. They're just absolutely amazing. They're the ones that back us up. RDP Remote Desktop protocol compromises people misusing VPN. It just goes on and on my brain spins when I think about all of this, but the costs have doubled in q4. So make sure you are doing the right thing. You have good backups, you have multiple generations, that at least one generation is stored off-site, if not multiple generations. And if you aren't doing that, or if you're, you know, ISP MSP isn't doing it for you. It's time to change because the costs are going way up. You're listening to Craig Peterson, stick around. We'll be back here after the top of the hour with more about fishing. What's been going on?

Hello everybody, Craig Peterson here. Welcome back. I am on WGAN radio and many other stations actually throughout New England but I'm glad you're joining me right now. Also, of course online, your favorite streaming site and Craig Peterson dot com. Well, today we've already talked about most businesses are attacked by business email compromised last year and what that means what are the new types of spear-phishing scams going on? You guys are learning a lot from some of these, just that the terms if you understand the terms you are ahead of almost everybody else out there. We talked about keeping legacy software safe that things like Windows seven, heaven forbid Windows XP or now windows eight is also legacy no longer supported with software patches. We also talk before the top of the hour concerns about effectiveness of some privacy when it comes to facial recognition software. Should we be doing more about that there's a lot of concerns about the adoption and then downtime and costs have doubled in the last quarter? So q3 versus q4 2019. They doubled when it comes to ransomware attacks a very big deal. And it's interesting how they're doing it. I just got a text from my son and my son is as well as a couple of other family members. Somebody who works with me in the business. It's, you know, mainstream is kind of a family business. We've had many people over the years working for us. Now we've got about 60 different people who are working in different parts of the company. But when it comes right down to it, it really is kind of a family business. So he just sent me a message that he saw an app News. And of course, as usual, this is really a link to another, another website because Apple doesn't really publish news themselves. But this is from ZDnet. This just happened on Wednesday this week, a contractor suffered a ransomware infection. Now we have here in New Hampshire, a lot of God contractors, well, actually mostly subcontractors, but we have primary contractors as well. And I know some of you guys are listening here on the show, because I hear from you, right, I know that who you're working for and what you're doing. And I think that's really cool. I love it. But the problem is how do you guys deal with your IT people if they are not competent? How do you as a business person, any business person deal with it? Yeah, how do you even know if they're competent? At least if you're listening to the show, which obviously is right now. But at least you know the terms and you have an understanding of what should be happening. Well, this is a very big sub-cut or a contractor to the Department of Defense. It's called electronic warfare associate ew way. And it's a 40-year-old electronics company, well known US government contractor, and it got nailed by one of these ransomware infections we were talking about in the last segment today. Not a good thing, frankly. And we have seen all kinds of activity right now. You know, I feel sorry for these guys. They obviously did not know what they were doing and that and I can say that unilaterally. If you get ransomware it's your fault. Because in this day and age, there are so many great tools. They're not the ones you get from staples, the not the tools you're going to get from your break-fix computer shop that They have no idea how to protect you. None at all. Frankly, they've been lying to you. And that really bothers me too. Because I hear from my customers saying, well, I spoke with so and so. And this is what they said, well, they may not think it's a lie, okay, maybe calling them a liar is a little too strong, but they don't know what they're talking about. And yet they speak with absolute authority, as though they really know when they this is really the right thing to do. And don't listen to some guy on the radio, you know, or don't listen to that new company that came in and did a cyber health analysis for us, or network security assessment. Now, ignore those people because you know, we've had a relationship for the last 510 2030 years. Well, apparently, I'm guessing something like that must have happened with this company.

Go right now. In fact, I've got a screenshot in front of me It looks like they fixed some of this. But the website for this company is ewe tech.com. And if you do a Google search for them, or if you didn't want a little earlier in the week, you found out that something was really weird because all of the Google search results looking for e. w. a tch.com. Come back with a jibberish. And it's jibberish because everything has been encrypted by ransomware. Now, there is a security researcher out there who goes unnamed in this article from ZDnet and it is saying that several of the NWA websites appear to have been impacted, such as sites for the wi government systems IE wi technologies, simplicity key homeland protection Institute and we don't really know at this point how much of the company's internal network was encrypted during the incident. But, man, this is a big deal. And by the way, even though it's obvious that at least these websites of theirs have been encrypted, they have not issued any public statement about the incident. According to this article, this article, as I said is from Wednesday, Thursday this week, apparently, an NWA spokesperson hung up the phone earlier when Zd net reached out for comment about the security breach. This is a well-known supplier of electronic equipment to the US government. Now we have clients who make small things. You know, they make things like parts, they make wiring harnesses, they make power supplies, they make just all kinds of very basic things. And you look at it even screws right fasteners, and you look at ina say, Well, what does that matter? Well, Not a company that's making all these big electronic things for the government. But really what some of these bad guys are trying to do with ransomware is to fold, they still have the old motive of holding your data ransom. And it can be done two ways now, because the ransoming of the data, in this day and age, is also been done by saying, Hey, we grabbed all of your data before we encrypted it, or maybe we just grabbed all of your data, and we are going to release it to the general public. And the less you pay us a ransom. So they're making a ton of money off of this. And it looks like according to this unnamed security researcher, that's the relax dealer update. Now that is exactly one of the things that I was talking about earlier in the show, and we put up an article about that as well on my website, that is two that are being used right now that are not regular ransomware strains. And they're using it to target attacks on bigger companies that have deeper pockets. Very, very interesting. So keep an eye on this, this is, this is a bad thing, obviously. And it's bad because it can hit any of us. And ultimately, it is going to come around and hit you. Because you look at the stats we're talking about that just came out, where more than half of the companies were hit last year. And this is self-reported, okay, half of the companies admitted to it. So they had to first acknowledge or even know that they had been hacked, and most companies don't even know that they've been hacked, the smaller ones, and frankly, even the bigger ones. Look at some of these hacks and major corporations that didn't find out for six months or more. And all the way through. They have to admit that they were hacked when they knew they were hacked. So we had all of this up. And it's a very scary world out there. And if I, you know, if I was somebody who had a fiduciary responsibility, if I was sitting on a board and advisory board or a full board member in some company, and I did not know what security really was, and I did not know exactly what was going on, and I was sitting there looking at Oh, well, we have a chief information security officer CISO or our Chief Technology officers, officers taking care of that or my budget for this is huge. I'm sure I'm fine or even worse, a plain ostrich and sticking the head in the sand and just hoping nothing happens. And I gotta tell you from surveys I've seen here's another thing that I think you want to know if you have any responsibility for your business owner. If if you're the regular old office manager who's been signed security for the company making sure the antivirus is updated. You already know that that's not good enough, right? The antivirus just doesn't work against any of the modern threat, none of them. Okay. And you're sitting there thinking that everything's taken care of and you have not brought in a temporary board member advisory board members, someone to have a serious look at your security. Man, you've got some serious problems, very serious problems, because this is absolutely huge. And, you know, when it comes to the FBI and some of the other training I do for the infragard and for businesses in general, you know, I'm seeing this everyday people who have the titles, who have the certificates who have completed these programs I'm seeing all the time, and I've seen hundreds and hundreds of these people who are heavily relied on the Yet don't really know what they're doing. That's a real problem. Now it's one thing if you tell the boss Hey, listen, I don't really know what I'm doing. But I'm learning this and I think we are making the right progress that that's one thing, but to say, yeah, we are all set. And then as he as a pistol-whipping the forums, right, just check, checking pencil whipping all the way down, checking off everything. Yeah, that's good. That's kind of the outcome. And a man. I've seen so many businesses doing that, too. So if you are a business owner, if you are sea level, if you are on board, even if you're on like me, Board of volunteer organizations, you have a responsibility, and you got to take care of that. No, well, anyways, out of time for now. We'll be right back and I'm going to talk about training employees to spot yet another emerging threat, something that's really going to nail us. You're listening to Craig Peterson on WGAN.

Hey, what a fast-moving day today I'll be having a great day, whatever it may be listening to me on Saturday or any day during the week, a lot of people tend to listen when they're driving around other people when they are at the gym. And, you know, I just totally appreciate everybody being with us. And that's why we try and keep you up to date. We've got some amazing pieces of training coming up. So I want to make sure that you are aware of them. I've been posting and doing a few Facebook Lives, like when I appear on the radio, some of my segments are showing up now over on Facebook and also on YouTube, both of those live channels, so you can listen in and comment. And when I run them live, what I'm doing is I'm actually, Of course, recording them when I'm on the air and then later on in the day. I will run them as live and I will be live there. So I'll usually post articles in there that I'm referring to, as I'm on the air. And I'm answering questions from people who might have questions as that air lives. So it airs, live airs, there we go. And the idea is that, frankly, it's even better in some ways and listening to me on the radio, because now you have the opportunity to interact and get some behind the scenes stuff that I just can't share when I'm on the radio. So the best way to find those Well, I have links on my newsletter, right at the bottom to my social media channels. And of course, you'll find those easily by just going to Craig peterson.com slash subscribe, and you'll see them all right there. So let's get into our next article of the week, and that is a new emerging threat. I've talked on the show before about some of the problems that we're starting to see with deep fakes. I don't know if you saw the newest star latest Star Wars movie I suspect a lot of you guys did. Because frankly, you know, we're all kind of sci-fi geeks. I think on this side of, if you're a tech geek here, you got to be some sort of a sci-fi geek. And as a sci-fi geek, I went, and I saw it and I liked it right. And, man, I remember standing in line when the first Star Wars movie came out. I remember the first Star Trek movie coming out to standing in line all by myself, because No, none of my friends wanted to see it. Or actually, I think one of my friends came with me. And we saw the original Star Wars movie. It was really, really cool. So this was the end of what a 30 year. Man hasn't been that long. When did that come out? So it would have been around 1980 I think so man, a 40 year long the story arc, which I really enjoyed. I enjoyed it a lot, but in That movie, Carrie Fisher played a fairly major role. You might remember her from the original movies. This was Princess Leia and Princess Leia, ie in this case, Carrie Fisher was still alive, an older woman and she died before they even started filming this thing. And so you look at a new think Well, okay, so maybe what they did is they took some stuff off the cutting room floor from the other movies. Well, wait a minute. Now this she's older, right? She's an older Carrie Fisher. And so these movies that they had on the cutting room floor, most of them she was pretty darn young, so those wouldn't work. And then I realized, wait a minute now because I saw a couple of little errors and it really, I said wait a minute. This is obviously a deep fake. And what they had done is completely computer-generated The character, and it looked like Carrie Fisher, and they computer generated the voice as well it so it sounded like Carrie Fisher Well, it was computer augmented and any rate, this is a huge breakthrough. We've talked about it what's going to happen when they have our president on. On TV, they're showing a video of him saying that the missiles are flying in five minutes, kind of like Ronald Reagan did right during that microphone test back in the day. What's going to happen? How are you going to know if it's legitimate or not? And with more and more money being spent, look at what's happening right now with Bloomberg who's looking to spend a billion dollars on TV ads, and where he's been running ads, he's actually been rather successful. So what's gonna happen if he starts I'm like, I'm not saying that Bloomberg is going to do this, but if some candidate who has plenty of money to spend starts just Generating fake videos. Now we already know about a lot of fake stuff, right? Do you remember Paul Ryan pushing old people off of the cliff in their wheelchairs? Right. And that was, obviously satire. Some people actually didn't think it was they thought he would really do that. But you know, frankly, it's satire. So it is what it is. But what's going to happen when this is now deep fake, and it's the norm and we don't know what's what? Well, let's move this to the next level because we've never talked about this before. And I thought that this was an interesting idea. And this is by Ian Croxton, and he's over at dark reading. But cybercriminals are now starting to use deep fakes. You know what a business email compromise I hope because we've certainly talked about it enough on the show before and usually what happens is a bad guy goes ahead and does research on a business. Find out who this CEO is where the CFO is, right? We, you know, the scoop. And then they find out maybe when they're out of town, who their suppliers are, who their customers are, and then they start sending these emails directed at employees to get them to do something they should never do.

Obviously a problem, right? You don't, you just don't want that to happen, but it does happen. Now what they're doing with some of the phishing scams, where they're using voice mail and even phone calls, is they're using computer-generated voices, but not just voices, but the voices of the boss. Take me for example, I have thousands of hours of video and audio recordings that are available publicly on the internet. So it's easy to get a fix on me in my face. It's easy to get a fix on my voice. And to computer-generated stuff, right? That does not make sense to you. It's very, very easy to do all of that stuff in this day and age. So the concern now is that deep fake fraud is going to be hitting us in a bigger way. And it's going to be devastating for businesses. We talked about this next, this next one here last year, but a top executive at an energy company was revealed to have been conned into paying 200,000 pounds by scammers using artificial intelligence to replicate his boss's voice. So this guy answered a telephone call. He believed it to be from the German parent company. The request was for him to transfer funds which he dutifully sent to what he presumed was this parent company. In the end, the funds were actually being stolen by sophisticated criminals at the forefront of what I said last year was going to be a frightening New Age of deep fake fraud. And that's what Ian is bringing up here again. And I'm glad he is he's only what about how far behind us as eight months behind us, but this is going to be a very, very big deal. There's an example of a journalist and you can find these things out on YouTube, who paid 550 bucks to develop his own deep fake and he took the face of Lieutenant Commander Data from Star Trek next generation and put it over Zuckerberg Facebook two weeks to develop the video. You can find it online very easily. Just search for Lieutenant Commander data Mark Zuckerberg deep think, and you'll find it. So deep fakes are going to thrive in the modern workplace. There's no request, employees want to do what they're supposed to do they want to please their bosses. So we need a new era of employee security training. Frankly, a deep fake detection challenge was announced by Facebook here recently. There's work going on which is a lot of work going on. But I want to make sure you guys all tell your co-workers to keep an eye out for deep fakes. Because you might think the calls coming from the boss and it isn't just going to be the boss's phone numbers showing up on the caller ID now, it's going to be the boss's phone number and it's going to sound like the boss. And that's where it gets to be a real problem. All right, stick around. When we come back, we're going to talk about how you as a business and a consumer are going to have to weather this storm. That hasn't happened because of GDPR CCPA, or PDPA and more stick around. We'll be right back.

Hello, everybody, welcome back. Craig Peters on here on WGAN online as well, of course, at Craig Peterson calm. You know, consumers are always looking for protection and we have various consumer protection agencies out there. And Congress is trying to do something to protect our privacy. The big questions to me are, where are the lines? Is Congress really going to help us or hurt us? Right? All of the normal things you would expect me to question Congress and these laws, rules, and regulations. GDPR came out a couple of years ago over in the European Union, and it was designed to help protect not just the data but the identity of citizens of the European Union. GDPR, By the way, stands for the general data protection regulation. It gave them a bunch of rights, including the right to know what data the company was keeping about them keeping on them. It also gave them the right to be forgotten that if you saw something you didn't like on Google results or some other website, you could request that data be taken down, and they had to take it down. Now I kind of like this, because of some of the warnings have given my kids I can see it happening. But I like it when you've got people in their teens and 20s posting stupid stuff online, right, the silly things that kids do in college and before, and it's online, and it lives forever. And now you are looking for a job. The first thing that employers going to do is do a Google search for you. And once they've done that Google search, guess what comes up those videos those photos of you doing things and, and also, you know, some of this stuff that you had posted some of the stuff you had written some of the tweets that you put out. So how does that all work? How are you going to get rid of it if you don't have the right to be forgotten? And there are obviously multiple sides to that one, but I kind of like that. Well, if you are a business person, your business has a responsibility now to comply with these laws. And what a lot of businesses in the US did is they said, oh, we're not gonna be able to comply with all the GDPR rules and regulations. So we are just going to block access to anyone coming from the European Union. And they did that and some of them It took months to get their systems rewritten and designed so that they could handle those new rules and regulations from the European Union.

Well, that's all well and good. But now you can't just do that kind of blocking anymore. Because those types of rules and regulations are nowhere in the United States. As of January 1, 2020, our friends in California have a new log in live should say in place. It's called the California Consumer Privacy Act. That's the CCP a. And that act is basically doing the same thing that is being done in the European Union. And if you think you're compliant, or you're not going to have to comply with this, I'm going to go through some stats I think might really surprise you. California also has something called the PD pa which is the personal data protection act is not California, I mean, Singapore, okay. So there is a growing set of rights Relations. There are regulations in most states to some degree. states like New York and Massachusetts, and obviously California has laws that are much more restrictive about personal information. And there are more and more than coming online. So it frankly, is a very big deal. But here's what people are starting to realize. There was a there's a company out there called Capgemini. And there was some research published last fall by Capgemini. And they found that only 28% of firms that must comply with the European regulations, were actually in compliance. So about a quarter of the firms as of last year in the United States that were required to be compliant with the European Union were actually compliant. So that means 75% percent of businesses here in the United States that have customers or even people visiting their websites from the European Union. 75% of those businesses are not compliant. And yet, at the same time, there was the research that was done of companies asking them, are you compliant with the European rule rules? And 78% said, Yes, we're confident that we are compliant, even though an actual audit showed the exact opposite that 75 almost 75% it was actually what 72% were actually compliant. So more than 18 months into the California regulation, how many of our companies that have people visiting our websites from California or the have customers who are based in California, how many of us are compliant? It's not as though this came out of nowhere this rule, this regulation has been in place now, for over a year. It's just that as of January 2020, this regulation has some serious teeth to it. Now, we got a call from another company, who is based in New York, and has some of their work workers out in California, and definitely has customers in California. So they absolutely have a legal Nexus to California. And they said, Hey, we want to make sure that we're compliant with this new California consumer data or Privacy Act.

So we put together a proposal for them. And just to examine everything now they have some of their own systems, some of their own software, that they're keeping customer data. And everything else. And it's basically it's going to cost them 30 to $50,000. Just to have us do a deep dive for them. Now, this is a bigger company, they have some of the money to do it. Well, frankly, they have all of the money to do it, and they should be doing it. At this point, I don't know if they're going to do it or not. But that 30 to $50,000 is just to look at their existing systems, and tell them what they need to do. So this growing set of regulations in California, and regulations that are growing nationwide because the federal government is looking to take those California regulations and put them in place. So this growing set of regulations. Well, I think crucial to consumers, and something that businesses should have been doing a couple of years ago because of GDPR. The European regulations Something businesses should have been doing anyway is not going to be cheap. It is just not cheap. And then if companies are found to be out of compliance, Wow, now it's really not cheap. Because if you are out of compliance penalties upwards of 4% of annual global revenue. So the 12 major fines that are been handed down since this European regulation went into effect in May 2018 are almost $400 million spent on fines alone. So the cost of compliance is very big, but the cost of non-compliance is even bigger. So the truth is that privacy is almost dead. So we've thrown our hands up. We know our private information is out there. And this is the government's response. Try and get control of it. And if you are a business, make sure you do at least two of these three steps and I can send them to you. Just email me at Craig Peterson calm. I'll be glad to do this for you. One, identify your sensitive data to know who has access to it and who has access to it, and implement controls over the access and make sure you keep them updated. So there you go. You'll find a little more about this online at Craig Peterson. Calm on all always more than glad to send you guys more information. You know, I don't charge for any of that stuff. Right? And you just email me at Craig Peterson calm. I'll be glad to get back to you. All right, Take care, everybody. We got oh man, only one more segment we're going to talk about the Jeff Bezos hack and online employment scams. talking fast next time, stick around

Hello, welcome back. Craig Peterson here listening to me on WGAN or online, your favorite streaming app, whatever that might be. I'm kind of everywhere. I've been doing this for a long time. Hey, we're going to talk right now about our friend Jeff Bezos says his stock has been kind of interesting this week. Well with the whole coronavirus and everything going on. Plus, it turns out I don't know if you heard Amazon was able to secure some warehouse space down there in New York. So is obvious that ao sees district is not going to benefit from those jobs because she made sure that they couldn't get in there, but they did manage to get in. Well, Jeff Bezos had a very public divorce happen. You might remember this. Of course, he is the richest man in history. And his ex-wife walked away with billions Now this story gets kind of interesting when you turn the time back because what we just found out here in the last week is that Jeff Bezos, his iPhone was apparently hacked. Now I can hear you saying I'm Craig iPhones hacked. I thought you said iPhones were impenetrable. Well, obviously, nothing's impenetrable. If it has a plug or any sort of a wire, it can probably be broken into right. That's kind of the bottom line. But in this case, this backstory is interesting as to what happened here. It wasn't iOS. It wasn't the iPhones operating system that appears to have been the problem. It appears to be an application that Jeff Bezos was running on his phone. And it might be an app that you use. And I am a little concerned that, you know, if you're using it, you could be in trouble. But at the same time, I think they probably have the vulnerability that was used. We remember Jeff Bezos bought the Washington Post. It, of course, is a fish wrapper down in Washington DC. It had had it had a just an amazing past some of the things that they've exposed on both sides of the aisle, but primarily, they've always been a little left-wing. And now, for the last two, what 20 years they will basically since Ronald Reagan, they've been extremely left-wing. And Jeff Bezos bought this paper. And one of the journalists that wrote for The Washington Post name was Jamal Khashoggi. Now, this guy, Jamal Khashoggi was, by all reports, not a good guy. And he was of you know, this whole dispute he was involved with between Israel and the Arabs and, and the attacks that were going on over there, that very well, let's just say he's an interesting character, right? That's just kind of trying to put it a nicely interesting character. Now, you might also remember that he got some sort of an invitation to a Saudi embassy. And apparently, while he was there, there are recordings that were leaked of him being murdered. And apparently he had been dismembered and his body disposed of it, just a horrific, horrific story. Now, the Washington Post had decided that since just Jamal Khashoggi was a journalist of theirs, that they had to do something and so they did. They really criticized heavily the Saudi royal family, and in particular, they ended up criticizing the Crown Prince of Saudi Arabia.

Now, this is a very interesting problem here because Khashoggi wrote articles for Jeff Bezos, this paper with titles like Saudi Arabia wasn't always this repressive. Now it's unbearable. Another one Saudi Arabia's Crown Prince already controls the nation's media. Now he's squeezing it even further. Apparently the Saudi leadership ended up bribing Twitter employees to find out who some of the tweets were coming from that were anti, the Saudi Arabian government. And, and we know that it has been very repressive over the years. I guess we can chalk that up to another country, I'll never be allowed to go to right after the criticisms. But against this whole backdrop of the murder of Khashoggi and the not obviously not slandering, I don't think because I think they were right. Saudi Arabia, billionaire Jeff Bezos accepted an invitation to this dinner party in Hollywood, which was attended by Saudi Crown Prince Mohammed bin Solomon, as well as some friends. So apparently, Bezos was at this party on April 4, 2018. And Bezos and the Saudi Prince made a key exchange at dinner. And that's where the problems apparently started. Because Bezos has an iPhone x. That wasn't the problem. The problem was apparently WhatsApp. Now I've got a well so add that there are denials all over the place here about the Saudis been involved in this. There are denials about WhatsApp being the source of this problem, but I'm reporting here, what's in the news right now and then The explanations I'm reading from a technical standpoint are reasonable. So I, I'm repeating them because they do make sense to me. So apparently on May 1, so about a month after exchanging these keys with WhatsApp, the Crown Prince is sent a message to Jeff Bezos, his phone through WhatsApp, and the message apparently is an encrypted video file. And it's later established according to secure World Expo com. It's later established with reasonable certainty that the videos downloader infects Mr. Bezos, his phone with malicious code. Now, there's a lot more evidence as referred to in this article. But basically what happened is that the record showed when they went back and looked at the phone and they looked at the data utilization Through the vendor of the data for his iPhone increased by almost immediately by more than about 30,000%. absolutely crazy. So all of a sudden, his iPhone started sending data out. Well, it wasn't the iPhone per se, it was the WhatsApp app. And it was sending it out and just crazy amounts of data being stolen from it within hours of that video message being received from the Crown Prince. Now, experts are saying that the most likely explanation for this data being taken out was the use of mobile spyware. Then there are some out there, there's NSL groups Pegasus, or the hacking teams Galileo, but we're talking about more than six gigabytes worth of data that was removed. One wasn't removed. It was sent from his phone So the allegations go on and on here. But basically, what apparently happened is they got a hold of Jeff Bezos, his videos and photos. And, man they're all of a sudden there's this online campaign against Jeff Bezos and October 2018. And Top trending hashtag it isn't Saudi Twitter is boycott Amazon. A single photograph is texted to Bezos from the Crown Prince's WhatsApp account with an image of a woman resembling the woman with whom Bezos is having an affair, months before the affair was publicly known. So the Daily Beast in February 2019 ran this article how the Saudis made Jeff Bezos public enemy number one. So basically what happened here is is what tap was having It was then used to embarrass him and start the rumors, or at least more rumors about him having an affair, which ultimately led to Jeff Bezos, his divorce. And that ended up costing him I'm trying to remember now, but it was, it was in the 10s of billions of dollars. don't remember the exact number. Now, if your WhatsApp users are going to happen to you, I can say, generally speaking, Whatsapp is considered to be safe. Personally, if I have and I had an iPhone, which I do, I would use messages from Apple. Much, much safer than almost any third-party app out there. There are a couple of companies that I trust silence one of them, but I would use I message the hands down before I would use WhatsApp no question about it. And you know, it doesn't mean that your iPhone is not 100% safe or the It's Android is 100% hackable. But in both cases, you got to be careful. One more thing to warn everybody about and this is unemployment scams, according to the FBI are on excuse me, employment scams, according to the FBI are on the rise. And they're saying that the average victims losing $3,000. Here's what's happening. People are hearing that it's a great job market. So they're going online. They're looking for new jobs, looking to see Am I being paid enough? What's going on? Well, these cybercriminals are getting people to apply for non-existent jobs, and getting their personal information like social security numbers, home addresses, and then on top of it all, having them send money to the criminals, which is absolutely amazing. Big, big fraud out there going on. Right now there. The FBI knows about 50 15,000 incidents that account for more than $45 million in losses so be very, very k very careful online. If you're interested in a job, I can send you a document here that we have called guidelines for a safe job search. Obviously you can look for that online too, but guidelines for safe job search, just email me me me at Craig Peterson calm. I'll be glad to forward that along. The FBI statement says applicants are contacted by email to conduct an interview using a telephone application. According to victims, cybercriminals impersonate personnel from different departments including recruiters, talent acquisition, human resources, and department managers. So there you go. By the way work at home jobs that pay high initial salaries for inexperienced workers is another sign to question the job posting is if that shouldn't be obvious to everybody. So today we have been busy, I've given you tips and solutions to solve a bunch of security and other problems we talked about today. Email compromises going on legacy software, save the privacy on facial recognition, systems, downtime and cost doubling on ransomware. So what you can do to protect yourself, we've covered all of that and of course more, and you can find it. You can just go online, you'll see it posted on my website at Craig Peterson, calm. You can follow me on Facebook. I have just tons of great stuff up there every week. But by all means, make sure you subscribe to my newsletter. To get all of this every week. Craig Peterson calm, slash subscribe. I don't sell it. I'm not going to harass you. I'm going to give you good great information and training. Have a great week and we'll see you online Craig Peterson dot com.

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

What a busy busy week in the world of technology.  We are going to hit several topics today.  Business Email Compromise attacks are running rampant through business. Failure to update older technology is putting businesses at risk. Facial recognition technology is being used but the issue is privacy and how to protect it.  Will hit Ransomware, Employee Training, Regulatory Compliance, Online job postings and what precipitated the most expensive divorce.  It is going to be a busy show -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

I've got some free online privacy training coming up.

I have been teaching courses on security for the FBI InfraGard's program. And now I'll share some of the step-by-step tips and tricks that we all can use to keep ourselves and our information safe online. And it won't cost you a dime.

---

Related Articles:

Most Businesses Attacked By Business Email Compromise Last Year

Keeping Legacy Software Safe

Concerns About Effectiveness and Privacy and Limiting Facial Recognition Adoption 

Downtime and Costs Double as Ransomware Attacks Hit Larger Businesses

Employee Training Key to Spotting Existing and Emerging Threats

Regulatory Compliance: The Perception and The Reality

WhatsApp, Hired Journalist With Saudi Enemies: The Reason Behind Jeff Bezos WhatsApp iPhone Hack

Searching For A Job Online -- FBI Warns About Rising Number Fake Employers
---

Automated Machine Generated Transcript:

Hey, hello, everybody, Craig Peterson here. Thanks for joining me, whether you are online listening to me on a streaming service, or listening on the radio on my website, kind of everywhere, we are going to be talking about most businesses now what's happening to them? How are they attacking to new statistics out, we'll be talking about how to keep some of your legacy software safe. If you're using Windows seven, or if you're using an older version of the software, because you haven't been keeping it up to date, which is like what all of us right? We're going to talk about what you can do some effectiveness, concerns about privacy, limited facial recognition, adoption, what's going on there. We talked a bit about that last weekend, downtime and costs. If they have gone up here. ransomware attacks are hitting businesses and individuals even harder than at any point in the past. So what's that all about? What are the simple things you can do to help protect yourself against it? We're going to talk about some employee training you need to do if you are a business person, regulatory compliance, what's the perception? What's the reality, we've seen a lot of businesses that are doing what we've been calling pencil whipping some of these forums that are trying to figure out whether or not they have complied with some of the laws, rules, and regulations. We're going to also talk about the Jeff Bezos phone hack today, and about a warning coming out from the FBI about job searches online. So a lot to talk about today. And we are going to start out with half of the organization's worldwide were successfully finished in 2019. But can't even talk right now. This is something that's very concerning. Now. It isn't as bad as it used to be phishing attacks used to be almost 100% effective. Of course, these are the types of attacks where someone sends an email. And the email is trying to get you to help this Prince in Nigeria, or whatever it might be. Those are phishing attacks, I've gotten a lot more sophisticated to the point where they are today, where we warn people to not even put information about who the employees are even physical access or addresses of the businesses, if they are not, obviously a walk-in type store because that is being used online by the bad guys. They go to your website, they figure out who the CEO is, who the CFO is, whatever information they might need. And then they use that now to go after you and go after you in a very bad way, frankly, because we are falling prey to it. And we're going to be talking more a little bit later on a couple more segments about what is the cost to businesses right now. Some of the phishing attacks, because you remember, they will use phishing for a number of different reasons, not the least of which is to get you to install malware on your computer. You know, unbeknownst to you, right? It's not as though you purposely are selling malware. But we're going to talk about that here in just a few minutes. There is a number of companies out there that do various types of simulated phishing attacks. And the idea behind these is that they will go ahead and send your employees emails that are based upon the latest phishing attacks, right, the type of phishing attacks that have been going on for the most part, and they will record whether or not each employee has clicked on a link that they shouldn't have clicked on. So obviously, when they click on it, it goes through the software that's tracking them and knows what they did. And you know, now they're in trouble, right? Because they did what they shouldn't have done and they will usually have some remedial training for these people to help to build awareness, help them understand what it is really what's going on what they should be doing what they maybe shouldn't be doing. All of that stuff pulled together. Well, one of the companies that does this fishing susceptibility testing along with the security awareness training is called proof point. And they take a look at all of their numbers and try and roll them together. So this report that I'm looking at right now is examining global data from nearly 50 million simulated phishing attacks that were sent by proof point customers over a one year period. And they also did third party survey responses for more than 600 information security professionals in all of the major countries out there, not some of the small ones. And they put this all together. So basically, it's 3500 working adults who are sitting paid for that part.

Now, here's what they found. Here are the tips for you. If you are a business person if you're responsible for it within an organization number one here in the Help Desk security article is effective security awareness training, must focus on the issues and behaviors that matter most in organizations' mission. Obviously, that's kind of corporate-speak, right? But he's saying that really what we have to do is look at what our assets are, what our mission is, as a company, and you know, value those what is the value of those, what should we be doing, when it comes to our data, the things that we if we lost, we would go out of business or we might get fined, that might come after us, etc, etc. So he goes on to say we recommend taking a people-centric approach to cybersecurity by blending organizational-wide awareness training initiatives, targeted threat driven education. The goal is to empower users to recognize and report attacks again, oh my gosh, you know, this is the sort of thing that you get from a PR agency, right? I doubt the guy actually said that. But it really is about people. We have various types of automation. If you have the basic stuff like you've got antivirus, and you've been listening to my show for a while, you know, anti-virus is zero percent effective against the latest types of attacks. And it is not effective at all. antivirus software in this day and age is pretty much useless.

Now, you should be using it as part of a bigger stack of security software and procedures and things. But bottom line, it's just not that useful. And they're also saying that end-user email reporting is critical. They're showing that the number of reported email messages jumped significantly last year. And that's a really big jump at about 67%. So make sure if anyone in your organization has any questions about an email, they're thinking it might be a fake, it might be, you know, a problem phishing, etc, that they forwarded to you. Now we'll go a step further because of my company mainstream, we go ahead and work with the FBI and state investigators. When there are serious problems. Obviously, we will work with the company to it's not as though we're going to squeal on them. But we haven't covered numerous foreign government and also organized crime hacks into businesses. So if you're not reporting it, nobody's going to know and nothing can be done about it. So here are the key takeaways from this last year. More than half it's 55%. I've surveyed organizations dealt with at least one successful phishing attack in 2019. That's a very big deal. That's a very scary thing, frankly. And info security professionals have reported a high frequency of social engineering attempts across all kinds of different methods. 88% reported spear-phishing attacks, 86 business email compromised attacks, those are the ones that are hurting our businesses most and those are the type of things where they're faking that they're a vendor or they're the owner and they're asking people to wire money around. So be very, very careful. smishing is fairly new, but 84% of the businesses are saying that they had SMS and text phishing attacks that's way up. 83% said fishing which is voice fishing, and 81% reported malicious USB drops isn't That's something 65% of the surveyed infosec professionals said that their organization experienced a ransomware infection in 2019. That is high, high high. Now, you know, the FBI advises to never pay a ransom. But a third of all organizations opted to pay the ransom. And we've seen that even in cities that have been attacked by ransom, or that they did pay ransoms. 32% did not have those who negotiated with attackers 9% were hit with follow up ransom demand, and 22% never got access to their data, even after paying the ransom. So keep that in mind. And the other statistic that I've seen before from the FBI says that even if you pay a ransom, the odds are only 50% that you'll get all of your data back. Remember, these guys aren't writing great software. In fact, most of them aren't even writing this software at all. And what that ultimately means is it buggy? What do they really care as long as they get some payments right? organizations are benefiting from the consequent model. 63% of organizations take corrective action with users who repeatedly make mistakes. So I think that's an important thing. Many working adults fail to follow cybersecurity best practices. 45% admit to password reuse, which is one of the biggest sins, frankly, that you can commit is reusing passwords on multiple sites, more than 50% do not password protect home networks. And 90% said they use employer-issued devices for personal activities. These are all things they shouldn't be doing. In addition, 32% of working adults were unfamiliar with VPN services. One of my pieces of training was about VPNs. You might find it I think it's still up on YouTube. But how VPN services are in some cases worse than not using a VPN at all, you've got to be careful because some of these VPN services that are out there, they're actually having new use their service so they can track you online, sell your information. So the VPN service is only charging a few bucks a month, or heaven forbid, free. You really have to wonder just how good is it. So follow those practices need to understand the common cybersecurity terms. I don't maybe I should do a little training on that one too so that people know what's up. And Millennials are continuing to underperform other age groups in fundamental fishing, and when ransomware awareness, so stick around when we come back, we're going to talk about keeping your legacy software safe. Are you still using Windows seven, eight or maybe something else? It's kind of old. Stick around. We'll be right back. You're listening to Craig Peterson on WGAN.

Hey, welcome back, everybody, Craig Peterson here. If you have a computer that's been around for a few years, have you stopped and had a close look to see if it's reached its end of life. Now I'm not talking about the hardware is about to fail or fall apart. You know, that's something I think you can deal with and everybody knows to deal with. And more importantly, if the hardware falls apart and stops working, you have to deal with it. But what about the software that's on your computer? What about the software that is, has been installed and it has been there for who knows how long? When was the last time you actually updated it I walk into customers' new customers all of the time, and they are running really old software? And man, I can't tell you how many times I've walked into a place and they've got a database. It's Microsoft SQL Server, server, and they have just got a development version there. They're in. In fact, they bought the software. And the software vendor gave them a free development version of SQL Server. Even though it's in production, even though they're supposed to be paying for a full license, I see it all the time. And then because they don't have a full license, in fact, they don't even have a legal license to use it in the business environment. The next problem happens, which is they've never updated SQL Server. We used to see this all the time with Windows where people were using a hacked version of Microsoft Windows, versions of Windows that were never licensed, never licensed properly. We don't see that as much anymore. But what we are seeing is software that's passed the end of life including windows As of mid-January January 14, 2020, Windows seven Microsoft is no longer supported for security updates, at least unless you pay Microsoft a small boatload full of money. They are providing it, but they are charging money for it. And now the last subscription I saw for security updates for Windows seven was about $80,000 a year. Now, I don't know about you, but I think that's a little bit pricey. So now you end up with the problem of Okay, so I am running old software, maybe even Windows XP, we see that all the time in the manufacturing business, where they're controlling systems and control systems running XP. So what do you do now? Because if you upgrade your base operating system, that means there is software that you're running that may not work with the new version of Windows. And frankly, that's probably the number one reason we see from people who don't upgrade and don't want to upgrade because it's could end up being a very bad thing for them a lot of pain, right? Well, Windows seven is already past its support window. And we're Windows Server 2008 will officially be ended just this past week. So if you're running Windows Server, which a lot of businesses are, right, you're using Active Directory server as much as I don't like it. Most of our customers use it because there's not really a whole lot of other options for them. But it's really significant here that these older operating systems are no longer going to get routine security updates and patches going forward. Windows seven, believe it or not, is 10 years old now. And it's still in style. It still works. And according to StatCounter, Windows seven is still deployed on one out of every four Windows machines. So That means you are probably like everybody else out there and is still running Windows seven or some of your machines. And part of the reason for that may be because you're concerned about doing the upgrade, right, and update. So we're going to talk a little bit about that some things that you can do. But first of all, I want to give you a couple of warnings, because I think I might have to get you out of that feeling of invulnerability that you might have Windows 720 19, there were more than 1000 vulnerabilities that were found over 1000 in just 2019. ingest windows seven alone. So businesses are facing a very real security risk by using any of these products after their security updates pass.

But you know, can you migrate? Yeah, obviously the answers. Yes. Can you do it quickly? Well, Not necessarily quickly, and certainly not immediately for most people. So most businesses are finding they're using the sound supported software for months, years or even decades later. And Kaspersky research, which is a Russian company that does all kinds of stuff when it comes to security, they got some pretty decent security software. But the problem you and I think you might find with their security software is it's from Russia, and the US, the federal government has come out and said, Don't use Kaspersky. So I can see that I can see why they're saying that but they're reporting that 40% of very small businesses, so 40% of businesses under about 10 employees, and about 48% of small and mid-sized businesses. So the bigger businesses that should have the ability to do upgrades are still using unsupported software and software that's approaching the end of support. So you got to be very, very careful, okay. And if you're a manufacturing company, or you have industrial control systems, you might have an H HVAC and an air conditioning system in your building that is hooked up to your network connection, so that the technicians can get in remotely to look for problems, maybe the systems call home, to let them know that, you know, your coolant pressures too low or whatever the problem might be. Those types of systems can be some of the worst to some of those, as I mentioned, before, we're finding we're still running Windows XP. And that is way, way out of date. So you know, have a look at all of those to man, we could go on for a long time about the problems that we've seen, and some of the problems that you need to take care of. But when we're talking about 24 seven operations, so we're moving on to the next level. Business kind of manufacturing or maybe you have a help desk where people call it 24/7. And those systems are up and online the whole time, it becomes even more important becomes even more critical. If a new vulnerability is discovered, I really have to emphasize here you have to take extra precautions. So what do you do in the meantime to protect yourself, here are some tips for those of us that are still running older software? And as I said, we're talking about what 50 60% of us frankly, our and a third of us are running unsupported versions of Windows. Number one you could do is buy extended support. Now, this is probably the least attractive option for companies that don't have a lot of cash lying around but it is the most secure. If you're an enterprise customer, you which means, by the way, you have to use any enterprise versions of Windows, not the stuff you got when you bought your laptop from staples or, or just from regular old Dell, okay? But enterprise customers can pay Microsoft for extended support through January 2023. Now, it's very expensive. Okay, so the price is going up every year. So be very careful with it. We're talking about million dollars worth of expensive, okay, so very, very big deal. If you're still running Windows XP, the cost for extended support for an organization with 10,000 plus machines leveled out at just under $2 million a year. real money. It's crazy money. So that's probably out of the question for most of us. So next up, here's what I've done for a lot of customers and I can help you with this if you need this as well. But there are ways to isolate both older machines from your regular network and I'm not just talking about going ahead and doing some network segmentation. I'm talking about having special internal firewalls to isolate these machines, okay, old decommissioned and non-supported operating systems and software that cannot be patched, have to be isolated. Obviously, you also would need to limit user access to the machines and limit what they are doing on those machines and try and keep them safe. And watch for what is called out of band fixes. Some vendors may still issue critical fixes, but you know, keep an eye on it. It could be dangerous. All right sticking around. We're going to talk about this new facial recognition technology that London is adopting. I talked about it this week, a little bit on my radio and TV appearances. But we're going to get into a little bit more because it is coming here to the US as well. Stick around you're listening to Craig Peterson WGAN Online.

Welcome, everybody. Craig Peterson here and online at Craig Peterson dot com. If you haven't already, make sure you sign up for my email comes out every week on Saturday mornings typically is when we get it all done on time so that it's out for the show. But I do go through some of the most important articles for the week, a lot of security stuff including what the number one patch that you need to make to your systems. So that comes out at least monthly, my newsletter and these patches are patches to software that is attacking right then and there in the wild. In other words, it isn't just patched for the sake of patching. It's this is a serious problem. And if you don't deal with this problem right away, you could become a victim. So you've got to really kind of keep an eye on that. That is part of my newsletter that comes out and you can get that by just going to Craig peterson.com slash subscribe. Well, we're going to talk right now about the effectiveness and privacy here live and limiting facial recognition adoption. This is something we talked about a little bit about last week as well. Of course, we talked about this company that's out there doing facial recognition stuff that's really kind of scares me, because they went and they crawled all of the public photos they could find from sites like Twitter and Facebook and some of these photo-sharing sites. They pulled them all together, 3 billion of them, and they put them into a database, the company's called clear view, and they recorded where they got those photos from, and then they've been offering it right now. To the police, obviously they had ideas about offering it to other people is, you know, ultimately, but the police have access to it. And that's been a problem. because nothing's 100% plus at where do we draw? At what point? Do we draw a line saying, hey, my privacy extends even to those things that I posted online? This is a fine line. It's a real problem. And as we've talked about before on my show, ultimately, the law, legs far behind the technology, technology comes up with something new. And then the rules or regulations, follow the laws, which are all coming out well after the fact. Now, sometimes, they try and pass laws beforehand. And that ends up being a problem because we don't know what all the problems are going to be. So it's a catch 20 too, right? You can't, you shouldn't really put the laws in place until we have the real problems. And then you're not going to see the real problems with the laws until they're in place. So we're talking about something like this. That's not a perfect technology. How far can they go? Now we know that if you are arrested, and they can take your picture, and your fingerprints, I've been doing that for a very long time. There have been a number of court cases about whether or not they can take your DNA. And of course, it doesn't have to be blood anymore. They can just do a mouth swab. They can get your DNA even from your hair, and know a few mixed results there. I know, basically, from everything I've read, the courts have come down on the side of if you are arrested and convicted, then they'll grab your DNA, and that's been used to solve some crimes. And in fact, facial recognition has been used to solve some crimes. as well. But should we have the privacy in our papers basically in our documents? And they argue many times police in court, hey, listen, if you're out on a public roadway, you have no expectation of privacy. And, you know, I frankly, I don't disagree with that. I don't think you do have an expectation of privacy. But should it be legal for the police to be tracking you your license plate, taking pictures of you as you go through intersections? Again, where's that line drawn? And when we're talking about the facial recognition databases, these things are often wrong. They've got a success rate of less than 70%. But what is going to happen when their success rate is 99% that they are showing accurately, who you are 99% of the time.

Now, the next problem with companies like ClearView AI as far as I'm concerned government agencies is how safe is our data in their hands. When you get to the databases that hold the images, they are going to ultimately have vulnerabilities. So our, you know, our biometric information, our pictures, all the way through our fingerprint, Iris scans, the way we walk our pace, the way we speak. All of that's biometrics. Now, if you lose your password, you can reset your password and have a new one. If you lose the pin for your ATM card, you can go ahead and get a new one, right? It's pretty simple to do. But what happens if the government the state government or federal government has your photo and it's stolen, you cannot change your face. You can not change your biometrics at all. So is there any way for us to be able to trust that our privacy is going to be protected? And the answer is frankly, no. And is there any way we can stop the distribution of our facial data? Some states sell all of the driver's license data. Most states, I think now to whoever will pay for it. So the answer to that question, is there any way we can prevent the distribution of official data? The answer to that is frankly, no. And when we consider the damage that the leak of these types of databases could cause, cause it is freak, it's just, it's overwhelming. It's overwhelming to me. It's overwhelming to you. And I think we've got to be a lot more careful. Now. I mentioned this database company called Clearview AI. That scrubbed the internet found all 3 billion pictures pulled them in, kept track of where it saw the pictures. This is a big problem. But they say hey, listen because they're getting sued right now. It's okay so somebody by the name of great Graham Cluley he went to clear view an eyes website and had a look around and what they found is that you can have your photo removed. Yes, yes indeed. Now, they never asked you for permission to use your photo for their app that they're selling to the FBI homeland security agencies all around the world. No, no, no. All you have to do to have your photo removed from Clearview AI is are you ready? Um, this is straight from like a screenshot from their website. You can send an email to privacy dash requests at clear view.ai. And then you just submit a name a headshot, a photo of a government-issued ID to facilitate the processing of your request. Well, what if you're concerned about this company's clear view to AI, losing your data in the first place? Do you really want to send them a picture of your passport or your driver's license, which now most driver's licenses are federally compliant? Is that really what you want to do? Well, I think it's a real problem. Twitter has sent a cease and desist letter to them. Saying that clear view AI violated the policies over at Twitter, demanding any collected data be deleted. I would expect that Facebook is probably going to do something similar, as will these other websites that are out there where they have been scraped and They obviously the website had to find out about it. And now we're seeing London's Metropolitan Police Service, starting to use live facial recognition technology to scan public areas for suspected criminals. They've been trialing this technology for two years. And they're going to have this up and running by February 2020 going to be linked to a database of suspects. So, again, this is a problem. Facial recognition technology is just not accurate. What can you do? Well, I think we should all be sending letters to our representatives in Congress in our statehouses, and letters complaining to Twitter and Facebook, about companies like ClearView AI, you'll find this articles or articles about it up on my website at Craig Peterson, calm and of course, listening to me on WGAN, stick around with me Get back we're going to talk about the costs of ransomware in q4 2019 and today.

Hey, welcome back, everybody, Craig Peters on here and WGAN online course at Craig Peterson dot com. That's Peterson. With n Oh, well, we know what downtime is right? businesses have it. And it can really cause havoc, especially a long amount of downtime. When businesses get hit with a major outage, and it can be caused by a fire flooding the major server crash when they're hit with that sort of thing. It can be devastating. And most frankly, businesses are out of business within six months, with small-medium businesses, basically the larger ones. Well, by law because of Sarbanes Oxley, they have to be able to get back online if they're publicly traded within four hours. Now, a lot of businesses don't do that. Although they shouldn't be doing it and You know, frankly my business we are set up to be able to get back online pretty darn quickly, because you just can't afford the bad PR the bad customer relationship and the lack of sales that come in because you're down, right? Nobody can get it anything. Well, there are new and more sophisticated ransomware attacks that are really hitting businesses today and everything from large companies to little guys from state governments to the federal government. And some of these are considered to be the deep pocket target. Now you and I, we can get hit with ransomware. And to us, a $500 ransom might be real money. What is it half of the American households could not come up with $500 for an emergency expense and two, right. So I'm not saying that it wouldn't be devastating to get ransomware if you are a small office, Home Office, Or if the if it's your basically just your home computers. But ransomware costs now have more than doubled in the fourth quarter of 2019. According to the latest statistics, so the average ransomware payment has doubled. It is now at almost $85,000. That's in one quarter. So in the third quarter of 2019, the average ransom payment was about 41,000. That's the third quarter. So let's see what the third quarter last year September. Let's see November or October, November, December is the fourth quarter. And so it would be September, August in July. So July, August, September, the average payment for ransomware was 41,000. And then, in October, November, December, there we go. It's $4,000 that is absolutely huge. So I did a little bit of digging to try and figure out why did it surge so much? Well, apparently it's because they are using some ransomware software. It's called RealLoc. And I always have a hard time with this one, so doing co key B and they are going after the enterprise space. Now enterprise space typically means a medium or large business, as opposed to a small business. But in this space, criminals can really exhort extort serious money, deep pockets for seven-figure ransom payouts. So here is a quote, researchers some cover were saying q4 ransomware actors also began exfiltrating data from victims and threatening its release if the rain Sim was not paid. So it's not just ransomware getting onto your computer and encrypting your files and saying, Hey, listen, if you want your data back, you're going to have to pay us, which as you already know, you usually don't get your data back, right. But they are saying, we have your data, and we're going to let it go. And there's a big case about this late last year, and the chairman of the company was but this company had had its data stolen, and it there was an extortion angle on it. They're trying to get money from the company, saying, hey, if you don't pay us all of this ransom, we're going to release the data. And the company said, Okay, well do it because we're not going to pay that ransom. And the bad guys did release it. Okay.

Now there's third-party claims over the data breaches now that start to come in. But let's break down some of these costs. So if and then I'll get into what you can Due to help prevent some of these problems, but the cost ransomware attacks can vary. Obviously, if you're going to pay a ransom, there's one cost, right? Then the remediation which can be very expensive, if you get hit by ransomware remediation companies can cost you in the hundreds of thousands of dollars, then that's frankly, where you bring us in and we have a couple of people with their fire jumpers certified over at Main stream.net it can easily cost you $100,000 to try and get all of that stuff all your data back, right, get back in business, but all the hardware devices you're gonna have to do upgrade so all of this stuff you've been dragging your feet on you probably gonna have to do so it couldn't be quarter of a million up to two or $3 million for bigger company. Now there are also some other costs, besides the lost revenue from downtime because now you might have a bad reputation out there. Brand damage can occur here if the business interruption severe enough. If your clients are noticing that you can't do business if you are a provider upstream-downstream, it can be very, very bad. Now in addition to the ransomware payments skyrocketing according to threat post calm, the average downtime that a ransomware attack causes for a company also increased from 12.1 days in the third quarter to 16.2 days in the fourth quarter. That is absolutely nuts. Now, we have been doing a lot of remediation really for businesses. And one of the things we do for the bigger businesses if they are a public company or their division of a publicly-traded company is we put in equipment on-site for them. So that if their main servers go down, the new, the other equipment, our equipment that's on-site can take over and it can take over in a matter of minutes. So there's like almost no downtime, the only thing that might be lost is 15 minutes or 30 minutes, whatever it was since the last snapshot was taken and pushed to us. And then we push that data. Sometimes we do it through leased lines sometimes to do it through the public Internet. We push that data to our data center. And then it's encrypted while it is over the customer site and before it gets sent to us. So it's encrypted as it goes over the by the public Internet or some form of a leased line. It's encrypted when we get here so that we can now sneakernet if we have to, right. So the building, let's say it burns down, we can immediately recover. And then we take that data and we say snapshot it. And we keep snapshots for a year or more sometimes depends. public companies need to keep seven years of some of these snapshots like the email of the working files, especially companies that are manufacturing something where you have to keep it in, in some cases indefinitely. Like we did some stuff for saffron, which makes blades for jet turbans. And they have to keep their data for a minimum of I think it's, is it 20 years, you know, whatever the service life is of the engine those blades are put into. So that's what we do for publicly traded companies. Now that's not cheap. But they don't, you know, it just blows my mind how many of these companies that can afford it just aren't doing it? So when you look at these statistics and say that we're talking about 16.2 days of downtime if you get hit with ransomware how much revenue is that to them? Especially those companies that are making hundreds of thousands of dollars a day, they're going to lose that revenue because their manufacturing lines going to be down or their sales are departments going to be offline or their shipping or warehouse or maybe everything which is, which has happened to another division of a public company that we did the work for 25 years. Okay. So very, very, very expensive. And the third Post article goes on to say that this increase from 12 days of downtime to over 16 days of downtime was linked to a higher prevalence of ransomware attacks against these bigger companies, the larger enterprises, which are often left scrambling to try and get their systems back up for weeks. Now, again, that's something we've been doing forever and that's something You need to be doing if you're just a small company, having an offsite backup is critical. Having multiple generations of backup is critical. Because what happens if your systems are corrupted because ransomware has come in, has taken them over. And now your backup and backup backs up the encrypted data. So now you don't even have the data before the ransomware hits. Now you're completely stuck, right? Because your computer is encrypted, your data is encrypted on your computer. And your data is encrypted in your backup because you just backed up or just as bad or maybe even worse is your backing your systems up to a locally attached disk, right. You plug in one of those nice little USB drives. Guess what the ransomware is doing? It is encrypting that backup drive and it's also spreading to your Active Directory server and Your business, and it's spreading to all of the other computers in your business. It does this normally anything it can see any shares any mounts, it's going to encrypt. And that's why it takes so long. And that's why for our clients that need higher availability, because you are required to have a full disaster recovery plan in place if you're a publicly-traded company or division of a publicly-traded company, and you have to be back on in four hours. That's why we have equipment sitting there on-site with multiple generations of backups, in case something like this happens in case it gets through. Okay, so nowadays, we've got some working descriptors that are pretty good for some of the ransoms that happen. So you have about a 2010 to 20% chance that the data that has been encrypted will be you'll be able to decrypt it Cisco Talos per usual is one of the lead investigators, researchers and all of this. Those are the guys that we use Cisco talus guys. They're just absolutely amazing. They're the ones that back us up. RDP Remote Desktop protocol compromises people misusing VPN. It just goes on and on my brain spins when I think about all of this, but the costs have doubled in q4. So make sure you are doing the right thing. You have good backups, you have multiple generations, that at least one generation is stored off-site, if not multiple generations. And if you aren't doing that, or if you're, you know, ISP MSP isn't doing it for you. It's time to change because the costs are going way up. You're listening to Craig Peterson, stick around. We'll be back here after the top of the hour with more about fishing. What's been going on?

Hello everybody, Craig Peterson here. Welcome back. I am on WGAN radio and many other stations actually throughout New England but I'm glad you're joining me right now. Also, of course online, your favorite streaming site and Craig Peterson dot com. Well, today we've already talked about most businesses are attacked by business email compromised last year and what that means what are the new types of spear-phishing scams going on? You guys are learning a lot from some of these, just that the terms if you understand the terms you are ahead of almost everybody else out there. We talked about keeping legacy software safe that things like Windows seven, heaven forbid Windows XP or now windows eight is also legacy no longer supported with software patches. We also talk before the top of the hour concerns about effectiveness of some privacy when it comes to facial recognition software. Should we be doing more about that there's a lot of concerns about the adoption and then downtime and costs have doubled in the last quarter? So q3 versus q4 2019. They doubled when it comes to ransomware attacks a very big deal. And it's interesting how they're doing it. I just got a text from my son and my son is as well as a couple of other family members. Somebody who works with me in the business. It's, you know, mainstream is kind of a family business. We've had many people over the years working for us. Now we've got about 60 different people who are working in different parts of the company. But when it comes right down to it, it really is kind of a family business. So he just sent me a message that he saw an app News. And of course, as usual, this is really a link to another, another website because Apple doesn't really publish news themselves. But this is from ZDnet. This just happened on Wednesday this week, a contractor suffered a ransomware infection. Now we have here in New Hampshire, a lot of God contractors, well, actually mostly subcontractors, but we have primary contractors as well. And I know some of you guys are listening here on the show, because I hear from you, right, I know that who you're working for and what you're doing. And I think that's really cool. I love it. But the problem is how do you guys deal with your IT people if they are not competent? How do you as a business person, any business person deal with it? Yeah, how do you even know if they're competent? At least if you're listening to the show, which obviously is right now. But at least you know the terms and you have an understanding of what should be happening. Well, this is a very big sub-cut or a contractor to the Department of Defense. It's called electronic warfare associate ew way. And it's a 40-year-old electronics company, well known US government contractor, and it got nailed by one of these ransomware infections we were talking about in the last segment today. Not a good thing, frankly. And we have seen all kinds of activity right now. You know, I feel sorry for these guys. They obviously did not know what they were doing and that and I can say that unilaterally. If you get ransomware it's your fault. Because in this day and age, there are so many great tools. They're not the ones you get from staples, the not the tools you're going to get from your break-fix computer shop that They have no idea how to protect you. None at all. Frankly, they've been lying to you. And that really bothers me too. Because I hear from my customers saying, well, I spoke with so and so. And this is what they said, well, they may not think it's a lie, okay, maybe calling them a liar is a little too strong, but they don't know what they're talking about. And yet they speak with absolute authority, as though they really know when they this is really the right thing to do. And don't listen to some guy on the radio, you know, or don't listen to that new company that came in and did a cyber health analysis for us, or network security assessment. Now, ignore those people because you know, we've had a relationship for the last 510 2030 years. Well, apparently, I'm guessing something like that must have happened with this company.

Go right now. In fact, I've got a screenshot in front of me It looks like they fixed some of this. But the website for this company is ewe tech.com. And if you do a Google search for them, or if you didn't want a little earlier in the week, you found out that something was really weird because all of the Google search results looking for e. w. a tch.com. Come back with a jibberish. And it's jibberish because everything has been encrypted by ransomware. Now, there is a security researcher out there who goes unnamed in this article from ZDnet and it is saying that several of the NWA websites appear to have been impacted, such as sites for the wi government systems IE wi technologies, simplicity key homeland protection Institute and we don't really know at this point how much of the company's internal network was encrypted during the incident. But, man, this is a big deal. And by the way, even though it's obvious that at least these websites of theirs have been encrypted, they have not issued any public statement about the incident. According to this article, this article, as I said is from Wednesday, Thursday this week, apparently, an NWA spokesperson hung up the phone earlier when Zd net reached out for comment about the security breach. This is a well-known supplier of electronic equipment to the US government. Now we have clients who make small things. You know, they make things like parts, they make wiring harnesses, they make power supplies, they make just all kinds of very basic things. And you look at it even screws right fasteners, and you look at ina say, Well, what does that matter? Well, Not a company that's making all these big electronic things for the government. But really what some of these bad guys are trying to do with ransomware is to fold, they still have the old motive of holding your data ransom. And it can be done two ways now, because the ransoming of the data, in this day and age, is also been done by saying, Hey, we grabbed all of your data before we encrypted it, or maybe we just grabbed all of your data, and we are going to release it to the general public. And the less you pay us a ransom. So they're making a ton of money off of this. And it looks like according to this unnamed security researcher, that's the relax dealer update. Now that is exactly one of the things that I was talking about earlier in the show, and we put up an article about that as well on my website, that is two that are being used right now that are not regular ransomware strains. And they're using it to target attacks on bigger companies that have deeper pockets. Very, very interesting. So keep an eye on this, this is, this is a bad thing, obviously. And it's bad because it can hit any of us. And ultimately, it is going to come around and hit you. Because you look at the stats we're talking about that just came out, where more than half of the companies were hit last year. And this is self-reported, okay, half of the companies admitted to it. So they had to first acknowledge or even know that they had been hacked, and most companies don't even know that they've been hacked, the smaller ones, and frankly, even the bigger ones. Look at some of these hacks and major corporations that didn't find out for six months or more. And all the way through. They have to admit that they were hacked when they knew they were hacked. So we had all of this up. And it's a very scary world out there. And if I, you know, if I was somebody who had a fiduciary responsibility, if I was sitting on a board and advisory board or a full board member in some company, and I did not know what security really was, and I did not know exactly what was going on, and I was sitting there looking at Oh, well, we have a chief information security officer CISO or our Chief Technology officers, officers taking care of that or my budget for this is huge. I'm sure I'm fine or even worse, a plain ostrich and sticking the head in the sand and just hoping nothing happens. And I gotta tell you from surveys I've seen here's another thing that I think you want to know if you have any responsibility for your business owner. If if you're the regular old office manager who's been signed security for the company making sure the antivirus is updated. You already know that that's not good enough, right? The antivirus just doesn't work against any of the modern threat, none of them. Okay. And you're sitting there thinking that everything's taken care of and you have not brought in a temporary board member advisory board members, someone to have a serious look at your security. Man, you've got some serious problems, very serious problems, because this is absolutely huge. And, you know, when it comes to the FBI and some of the other training I do for the infragard and for businesses in general, you know, I'm seeing this everyday people who have the titles, who have the certificates who have completed these programs I'm seeing all the time, and I've seen hundreds and hundreds of these people who are heavily relied on the Yet don't really know what they're doing. That's a real problem. Now it's one thing if you tell the boss Hey, listen, I don't really know what I'm doing. But I'm learning this and I think we are making the right progress that that's one thing, but to say, yeah, we are all set. And then as he as a pistol-whipping the forums, right, just check, checking pencil whipping all the way down, checking off everything. Yeah, that's good. That's kind of the outcome. And a man. I've seen so many businesses doing that, too. So if you are a business owner, if you are sea level, if you are on board, even if you're on like me, Board of volunteer organizations, you have a responsibility, and you got to take care of that. No, well, anyways, out of time for now. We'll be right back and I'm going to talk about training employees to spot yet another emerging threat, something that's really going to nail us. You're listening to Craig Peterson on WGAN.

Hey, what a fast-moving day today I'll be having a great day, whatever it may be listening to me on Saturday or any day during the week, a lot of people tend to listen when they're driving around other people when they are at the gym. And, you know, I just totally appreciate everybody being with us. And that's why we try and keep you up to date. We've got some amazing pieces of training coming up. So I want to make sure that you are aware of them. I've been posting and doing a few Facebook Lives, like when I appear on the radio, some of my segments are showing up now over on Facebook and also on YouTube, both of those live channels, so you can listen in and comment. And when I run them live, what I'm doing is I'm actually, Of course, recording them when I'm on the air and then later on in the day. I will run them as live and I will be live there. So I'll usually post articles in there that I'm referring to, as I'm on the air. And I'm answering questions from people who might have questions as that air lives. So it airs, live airs, there we go. And the idea is that, frankly, it's even better in some ways and listening to me on the radio, because now you have the opportunity to interact and get some behind the scenes stuff that I just can't share when I'm on the radio. So the best way to find those Well, I have links on my newsletter, right at the bottom to my social media channels. And of course, you'll find those easily by just going to Craig peterson.com slash subscribe, and you'll see them all right there. So let's get into our next article of the week, and that is a new emerging threat. I've talked on the show before about some of the problems that we're starting to see with deep fakes. I don't know if you saw the newest star latest Star Wars movie I suspect a lot of you guys did. Because frankly, you know, we're all kind of sci-fi geeks. I think on this side of, if you're a tech geek here, you got to be some sort of a sci-fi geek. And as a sci-fi geek, I went, and I saw it and I liked it right. And, man, I remember standing in line when the first Star Wars movie came out. I remember the first Star Trek movie coming out to standing in line all by myself, because No, none of my friends wanted to see it. Or actually, I think one of my friends came with me. And we saw the original Star Wars movie. It was really, really cool. So this was the end of what a 30 year. Man hasn't been that long. When did that come out? So it would have been around 1980 I think so man, a 40 year long the story arc, which I really enjoyed. I enjoyed it a lot, but in That movie, Carrie Fisher played a fairly major role. You might remember her from the original movies. This was Princess Leia and Princess Leia, ie in this case, Carrie Fisher was still alive, an older woman and she died before they even started filming this thing. And so you look at a new think Well, okay, so maybe what they did is they took some stuff off the cutting room floor from the other movies. Well, wait a minute. Now this she's older, right? She's an older Carrie Fisher. And so these movies that they had on the cutting room floor, most of them she was pretty darn young, so those wouldn't work. And then I realized, wait a minute now because I saw a couple of little errors and it really, I said wait a minute. This is obviously a deep fake. And what they had done is completely computer-generated The character, and it looked like Carrie Fisher, and they computer generated the voice as well it so it sounded like Carrie Fisher Well, it was computer augmented and any rate, this is a huge breakthrough. We've talked about it what's going to happen when they have our president on. On TV, they're showing a video of him saying that the missiles are flying in five minutes, kind of like Ronald Reagan did right during that microphone test back in the day. What's going to happen? How are you going to know if it's legitimate or not? And with more and more money being spent, look at what's happening right now with Bloomberg who's looking to spend a billion dollars on TV ads, and where he's been running ads, he's actually been rather successful. So what's gonna happen if he starts I'm like, I'm not saying that Bloomberg is going to do this, but if some candidate who has plenty of money to spend starts just Generating fake videos. Now we already know about a lot of fake stuff, right? Do you remember Paul Ryan pushing old people off of the cliff in their wheelchairs? Right. And that was, obviously satire. Some people actually didn't think it was they thought he would really do that. But you know, frankly, it's satire. So it is what it is. But what's going to happen when this is now deep fake, and it's the norm and we don't know what's what? Well, let's move this to the next level because we've never talked about this before. And I thought that this was an interesting idea. And this is by Ian Croxton, and he's over at dark reading. But cybercriminals are now starting to use deep fakes. You know what a business email compromise I hope because we've certainly talked about it enough on the show before and usually what happens is a bad guy goes ahead and does research on a business. Find out who this CEO is where the CFO is, right? We, you know, the scoop. And then they find out maybe when they're out of town, who their suppliers are, who their customers are, and then they start sending these emails directed at employees to get them to do something they should never do.

Obviously a problem, right? You don't, you just don't want that to happen, but it does happen. Now what they're doing with some of the phishing scams, where they're using voice mail and even phone calls, is they're using computer-generated voices, but not just voices, but the voices of the boss. Take me for example, I have thousands of hours of video and audio recordings that are available publicly on the internet. So it's easy to get a fix on me in my face. It's easy to get a fix on my voice. And to computer-generated stuff, right? That does not make sense to you. It's very, very easy to do all of that stuff in this day and age. So the concern now is that deep fake fraud is going to be hitting us in a bigger way. And it's going to be devastating for businesses. We talked about this next, this next one here last year, but a top executive at an energy company was revealed to have been conned into paying 200,000 pounds by scammers using artificial intelligence to replicate his boss's voice. So this guy answered a telephone call. He believed it to be from the German parent company. The request was for him to transfer funds which he dutifully sent to what he presumed was this parent company. In the end, the funds were actually being stolen by sophisticated criminals at the forefront of what I said last year was going to be a frightening New Age of deep fake fraud. And that's what Ian is bringing up here again. And I'm glad he is he's only what about how far behind us as eight months behind us, but this is going to be a very, very big deal. There's an example of a journalist and you can find these things out on YouTube, who paid 550 bucks to develop his own deep fake and he took the face of Lieutenant Commander Data from Star Trek next generation and put it over Zuckerberg Facebook two weeks to develop the video. You can find it online very easily. Just search for Lieutenant Commander data Mark Zuckerberg deep think, and you'll find it. So deep fakes are going to thrive in the modern workplace. There's no request, employees want to do what they're supposed to do they want to please their bosses. So we need a new era of employee security training. Frankly, a deep fake detection challenge was announced by Facebook here recently. There's work going on which is a lot of work going on. But I want to make sure you guys all tell your co-workers to keep an eye out for deep fakes. Because you might think the calls coming from the boss and it isn't just going to be the boss's phone numbers showing up on the caller ID now, it's going to be the boss's phone number and it's going to sound like the boss. And that's where it gets to be a real problem. All right, stick around. When we come back, we're going to talk about how you as a business and a consumer are going to have to weather this storm. That hasn't happened because of GDPR CCPA, or PDPA and more stick around. We'll be right back.

Hello, everybody, welcome back. Craig Peters on here on WGAN online as well, of course, at Craig Peterson calm. You know, consumers are always looking for protection and we have various consumer protection agencies out there. And Congress is trying to do something to protect our privacy. The big questions to me are, where are the lines? Is Congress really going to help us or hurt us? Right? All of the normal things you would expect me to question Congress and these laws, rules, and regulations. GDPR came out a couple of years ago over in the European Union, and it was designed to help protect not just the data but the identity of citizens of the European Union. GDPR, By the way, stands for the general data protection regulation. It gave them a bunch of rights, including the right to know what data the company was keeping about them keeping on them. It also gave them the right to be forgotten that if you saw something you didn't like on Google results or some other website, you could request that data be taken down, and they had to take it down. Now I kind of like this, because of some of the warnings have given my kids I can see it happening. But I like it when you've got people in their teens and 20s posting stupid stuff online, right, the silly things that kids do in college and before, and it's online, and it lives forever. And now you are looking for a job. The first thing that employers going to do is do a Google search for you. And once they've done that Google search, guess what comes up those videos those photos of you doing things and, and also, you know, some of this stuff that you had posted some of the stuff you had written some of the tweets that you put out. So how does that all work? How are you going to get rid of it if you don't have the right to be forgotten? And there are obviously multiple sides to that one, but I kind of like that. Well, if you are a business person, your business has a responsibility now to comply with these laws. And what a lot of businesses in the US did is they said, oh, we're not gonna be able to comply with all the GDPR rules and regulations. So we are just going to block access to anyone coming from the European Union. And they did that and some of them It took months to get their systems rewritten and designed so that they could handle those new rules and regulations from the European Union.

Well, that's all well and good. But now you can't just do that kind of blocking anymore. Because those types of rules and regulations are nowhere in the United States. As of January 1, 2020, our friends in California have a new log in live should say in place. It's called the California Consumer Privacy Act. That's the CCP a. And that act is basically doing the same thing that is being done in the European Union. And if you think you're compliant, or you're not going to have to comply with this, I'm going to go through some stats I think might really surprise you. California also has something called the PD pa which is the personal data protection act is not California, I mean, Singapore, okay. So there is a growing set of rights Relations. There are regulations in most states to some degree. states like New York and Massachusetts, and obviously California has laws that are much more restrictive about personal information. And there are more and more than coming online. So it frankly, is a very big deal. But here's what people are starting to realize. There was a there's a company out there called Capgemini. And there was some research published last fall by Capgemini. And they found that only 28% of firms that must comply with the European regulations, were actually in compliance. So about a quarter of the firms as of last year in the United States that were required to be compliant with the European Union were actually compliant. So that means 75% percent of businesses here in the United States that have customers or even people visiting their websites from the European Union. 75% of those businesses are not compliant. And yet, at the same time, there was the research that was done of companies asking them, are you compliant with the European rule rules? And 78% said, Yes, we're confident that we are compliant, even though an actual audit showed the exact opposite that 75 almost 75% it was actually what 72% were actually compliant. So more than 18 months into the California regulation, how many of our companies that have people visiting our websites from California or the have customers who are based in California, how many of us are compliant? It's not as though this came out of nowhere this rule, this regulation has been in place now, for over a year. It's just that as of January 2020, this regulation has some serious teeth to it. Now, we got a call from another company, who is based in New York, and has some of their work workers out in California, and definitely has customers in California. So they absolutely have a legal Nexus to California. And they said, Hey, we want to make sure that we're compliant with this new California consumer data or Privacy Act.

So we put together a proposal for them. And just to examine everything now they have some of their own systems, some of their own software, that they're keeping customer data. And everything else. And it's basically it's going to cost them 30 to $50,000. Just to have us do a deep dive for them. Now, this is a bigger company, they have some of the money to do it. Well, frankly, they have all of the money to do it, and they should be doing it. At this point, I don't know if they're going to do it or not. But that 30 to $50,000 is just to look at their existing systems, and tell them what they need to do. So this growing set of regulations in California, and regulations that are growing nationwide because the federal government is looking to take those California regulations and put them in place. So this growing set of regulations. Well, I think crucial to consumers, and something that businesses should have been doing a couple of years ago because of GDPR. The European regulations Something businesses should have been doing anyway is not going to be cheap. It is just not cheap. And then if companies are found to be out of compliance, Wow, now it's really not cheap. Because if you are out of compliance penalties upwards of 4% of annual global revenue. So the 12 major fines that are been handed down since this European regulation went into effect in May 2018 are almost $400 million spent on fines alone. So the cost of compliance is very big, but the cost of non-compliance is even bigger. So the truth is that privacy is almost dead. So we've thrown our hands up. We know our private information is out there. And this is the government's response. Try and get control of it. And if you are a business, make sure you do at least two of these three steps and I can send them to you. Just email me at Craig Peterson calm. I'll be glad to do this for you. One, identify your sensitive data to know who has access to it and who has access to it, and implement controls over the access and make sure you keep them updated. So there you go. You'll find a little more about this online at Craig Peterson. Calm on all always more than glad to send you guys more information. You know, I don't charge for any of that stuff. Right? And you just email me at Craig Peterson calm. I'll be glad to get back to you. All right, Take care, everybody. We got oh man, only one more segment we're going to talk about the Jeff Bezos hack and online employment scams. talking fast next time, stick around

Hello, welcome back. Craig Peterson here listening to me on WGAN or online, your favorite streaming app, whatever that might be. I'm kind of everywhere. I've been doing this for a long time. Hey, we're going to talk right now about our friend Jeff Bezos says his stock has been kind of interesting this week. Well with the whole coronavirus and everything going on. Plus, it turns out I don't know if you heard Amazon was able to secure some warehouse space down there in New York. So is obvious that ao sees district is not going to benefit from those jobs because she made sure that they couldn't get in there, but they did manage to get in. Well, Jeff Bezos had a very public divorce happen. You might remember this. Of course, he is the richest man in history. And his ex-wife walked away with billions Now this story gets kind of interesting when you turn the time back because what we just found out here in the last week is that Jeff Bezos, his iPhone was apparently hacked. Now I can hear you saying I'm Craig iPhones hacked. I thought you said iPhones were impenetrable. Well, obviously, nothing's impenetrable. If it has a plug or any sort of a wire, it can probably be broken into right. That's kind of the bottom line. But in this case, this backstory is interesting as to what happened here. It wasn't iOS. It wasn't the iPhones operating system that appears to have been the problem. It appears to be an application that Jeff Bezos was running on his phone. And it might be an app that you use. And I am a little concerned that, you know, if you're using it, you could be in trouble. But at the same time, I think they probably have the vulnerability that was used. We remember Jeff Bezos bought the Washington Post. It, of course, is a fish wrapper down in Washington DC. It had had it had a just an amazing past some of the things that they've exposed on both sides of the aisle, but primarily, they've always been a little left-wing. And now, for the last two, what 20 years they will basically since Ronald Reagan, they've been extremely left-wing. And Jeff Bezos bought this paper. And one of the journalists that wrote for The Washington Post name was Jamal Khashoggi. Now, this guy, Jamal Khashoggi was, by all reports, not a good guy. And he was of you know, this whole dispute he was involved with between Israel and the Arabs and, and the attacks that were going on over there, that very well, let's just say he's an interesting character, right? That's just kind of trying to put it a nicely interesting character. Now, you might also remember that he got some sort of an invitation to a Saudi embassy. And apparently, while he was there, there are recordings that were leaked of him being murdered. And apparently he had been dismembered and his body disposed of it, just a horrific, horrific story. Now, the Washington Post had decided that since just Jamal Khashoggi was a journalist of theirs, that they had to do something and so they did. They really criticized heavily the Saudi royal family, and in particular, they ended up criticizing the Crown Prince of Saudi Arabia.

Now, this is a very interesting problem here because Khashoggi wrote articles for Jeff Bezos, this paper with titles like Saudi Arabia wasn't always this repressive. Now it's unbearable. Another one Saudi Arabia's Crown Prince already controls the nation's media. Now he's squeezing it even further. Apparently the Saudi leadership ended up bribing Twitter employees to find out who some of the tweets were coming from that were anti, the Saudi Arabian government. And, and we know that it has been very repressive over the years. I guess we can chalk that up to another country, I'll never be allowed to go to right after the criticisms. But against this whole backdrop of the murder of Khashoggi and the not obviously not slandering, I don't think because I think they were right. Saudi Arabia, billionaire Jeff Bezos accepted an invitation to this dinner party in Hollywood, which was attended by Saudi Crown Prince Mohammed bin Solomon, as well as some friends. So apparently, Bezos was at this party on April 4, 2018. And Bezos and the Saudi Prince made a key exchange at dinner. And that's where the problems apparently started. Because Bezos has an iPhone x. That wasn't the problem. The problem was apparently WhatsApp. Now I've got a well so add that there are denials all over the place here about the Saudis been involved in this. There are denials about WhatsApp being the source of this problem, but I'm reporting here, what's in the news right now and then The explanations I'm reading from a technical standpoint are reasonable. So I, I'm repeating them because they do make sense to me. So apparently on May 1, so about a month after exchanging these keys with WhatsApp, the Crown Prince is sent a message to Jeff Bezos, his phone through WhatsApp, and the message apparently is an encrypted video file. And it's later established according to secure World Expo com. It's later established with reasonable certainty that the videos downloader infects Mr. Bezos, his phone with malicious code. Now, there's a lot more evidence as referred to in this article. But basically what happened is that the record showed when they went back and looked at the phone and they looked at the data utilization Through the vendor of the data for his iPhone increased by almost immediately by more than about 30,000%. absolutely crazy. So all of a sudden, his iPhone started sending data out. Well, it wasn't the iPhone per se, it was the WhatsApp app. And it was sending it out and just crazy amounts of data being stolen from it within hours of that video message being received from the Crown Prince. Now, experts are saying that the most likely explanation for this data being taken out was the use of mobile spyware. Then there are some out there, there's NSL groups Pegasus, or the hacking teams Galileo, but we're talking about more than six gigabytes worth of data that was removed. One wasn't removed. It was sent from his phone So the allegations go on and on here. But basically, what apparently happened is they got a hold of Jeff Bezos, his videos and photos. And, man they're all of a sudden there's this online campaign against Jeff Bezos and October 2018. And Top trending hashtag it isn't Saudi Twitter is boycott Amazon. A single photograph is texted to Bezos from the Crown Prince's WhatsApp account with an image of a woman resembling the woman with whom Bezos is having an affair, months before the affair was publicly known. So the Daily Beast in February 2019 ran this article how the Saudis made Jeff Bezos public enemy number one. So basically what happened here is is what tap was having It was then used to embarrass him and start the rumors, or at least more rumors about him having an affair, which ultimately led to Jeff Bezos, his divorce. And that ended up costing him I'm trying to remember now, but it was, it was in the 10s of billions of dollars. don't remember the exact number. Now, if your WhatsApp users are going to happen to you, I can say, generally speaking, Whatsapp is considered to be safe. Personally, if I have and I had an iPhone, which I do, I would use messages from Apple. Much, much safer than almost any third-party app out there. There are a couple of companies that I trust silence one of them, but I would use I message the hands down before I would use WhatsApp no question about it. And you know, it doesn't mean that your iPhone is not 100% safe or the It's Android is 100% hackable. But in both cases, you got to be careful. One more thing to warn everybody about and this is unemployment scams, according to the FBI are on excuse me, employment scams, according to the FBI are on the rise. And they're saying that the average victims losing $3,000. Here's what's happening. People are hearing that it's a great job market. So they're going online. They're looking for new jobs, looking to see Am I being paid enough? What's going on? Well, these cybercriminals are getting people to apply for non-existent jobs, and getting their personal information like social security numbers, home addresses, and then on top of it all, having them send money to the criminals, which is absolutely amazing. Big, big fraud out there going on. Right now there. The FBI knows about 50 15,000 incidents that account for more than $45 million in losses so be very, very k very careful online. If you're interested in a job, I can send you a document here that we have called guidelines for a safe job search. Obviously you can look for that online too, but guidelines for safe job search, just email me me me at Craig Peterson calm. I'll be glad to forward that along. The FBI statement says applicants are contacted by email to conduct an interview using a telephone application. According to victims, cybercriminals impersonate personnel from different departments including recruiters, talent acquisition, human resources, and department managers. So there you go. By the way work at home jobs that pay high initial salaries for inexperienced workers is another sign to question the job posting is if that shouldn't be obvious to everybody. So today we have been busy, I've given you tips and solutions to solve a bunch of security and other problems we talked about today. Email compromises going on legacy software, save the privacy on facial recognition, systems, downtime and cost doubling on ransomware. So what you can do to protect yourself, we've covered all of that and of course more, and you can find it. You can just go online, you'll see it posted on my website at Craig Peterson, calm. You can follow me on Facebook. I have just tons of great stuff up there every week. But by all means, make sure you subscribe to my newsletter. To get all of this every week. Craig Peterson calm, slash subscribe. I don't sell it. I'm not going to harass you. I'm going to give you good great information and training. Have a great week and we'll see you online Craig Peterson dot com.

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Good morning everybody!

I was on with Ken and Matt. We had a good discussion about Business Email Compromise, what it is, who is at risk and what we can do about it. Then it was onto the Jeff Bezos Phone Hack. So here we go with Ken and Matt.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Automated Machine Generated Transcript:

Craig
They scraped every picture on the internet that they could get their hands on. That is against the usage of rules and agreements of all these websites. If you had a picture posted on Facebook that was publicly accessible or on Twitter

Craig
Good morning, everybody. Of course, this is Craig Peterson on WGAN, up in Maine, on their morning drive show. There is some very concerning stuff going on to news statistics out that we talked about this week about fishing and BEC type email attacks. We are going to get into it right now.

Ken
We are back ladies and gentlemen it is 738 on the WGAN morning news with Ken and Matt on Wednesday, which means it's time to talk to Craig Peterson, our tech guru, to go over all the things about technology that affect our daily lives here today. Craig, How are you this morning?

Craig
Good morning, doing well

Ken
Well, let's start talking about some techniques, shall we? How many organizations last year, got phished, successfully?

Craig
Yeah, this is a huge trend that's been going on. You know, we keep hearing these warnings FBI has issued an alert out, and we will talk about it here on the show. It is really getting down to the brass tacks because we're, we're all somehow making some money, right? Whether or not you are getting paid because you know nothing about an oil company, or perhaps you are getting paid because you're working hard and getting up at 3 am every day. Those organizations, every one of them, right now got phished. Of course, you know what phishing is those of those types of emails that encourage you to click on something, maybe download something, etc. There are some new statistics out right now. They are kind of a little scary. You know, I'm not even sure these are that accurate because they say that nearly 90% of organizations around the world are targets of this whole business email compromise, type of scam, fear, spear-phishing attacks, which is a very, very big deal. And I think it's probably closer to 100% of organizations. I don't know you guys probably both have gotten those emails, right, supposedly, from your bank, etc. Absolutely. Yeah. I don't see why it's only 90%. But it's, it's very, very bad. It's very high. They're looking at global data from 50 million simulated phishing attacks. They got sent out to the customers of one company by their security firm, Proofpoint. They sent them over the one year but the part that's most alarming to me because you know, 100% that's not news. But unfortunately, more than half of the people that got these simulated phishing attacks opened the email and clicked on a link, and they were convinced to do it. That's the scary part. Another big story this week is telling us a little bit about what the results of that are the cost of it, and it's happening more, we are getting better. Okay. It used to be that it was 90% of people would open these emails. So we are getting better, but the costs are even increasing.

Matt
We are talking to Craig Peterson, he is our tech guru, and he joins us at this time every Wednesday to go over what's happening in the world of technology. I am always fascinated by this evolving facial recognition technology. I'm thinking of a man walking into the Gap or whatever, like in Minority Report, and they scan your eyes, or they just know they know who you are. They say Welcome back to the store. How did you enjoy those jeans that you just bought? Would you like to look at something new, etc.? The real utility of it, at least right now, is in terms of security and things like that. So obviously London is now adopting its facial recognition technology for police to us. Europe is considering a ban on it. Talk to us about where we stand with the use of this technology for law enforcement, and I guess beyond.

Craig
Last weekend, on my show, of course, Saturdays at 1 pm here on the same station, but and my show last weekend, I went into quite a bit of detail about this one company that had been operating kind of underground. They did something that this is frankly illegal. They scraped every picture available on the internet they could grab. That's against the usage of rules and agreements of all these websites. If you had an image posted on Facebook that was publicly accessible or on Twitter or on these online photo album sites that you can share photos. They have it. They have over 3 billion social media pictures. What they're doing is selling subscriptions to police departments. These police departments pay as little as $10,000 a year, can take a picture from some security cameras somewhere, and run it through this software. It's an app that runs on your phone. And it will tell the police where it has seen you before online. The police have been hindered over the years by only having pictures in their database of people who had interactions with police. You know you get arrested, they take photos and fingerprints. Now they have been able to identify hundreds or thousands of people that were involved in crimes were unsolved crimes, which is kind of interesting. So what London's doing now is they're taking that same type of technique. By the way, there are lawsuits against this company. Right now, it's in use in New York City. A lot of police departments are using it. But London's taking that type of technology because it's one thing to have faces. London has been, it's the most surveilled city in the world outside of China. And that means there's a lot of cameras out there. For years the city of London has been taking all of that information and use it to track people as they moved around London. Now with this newer technology that we're starting to see where it's tying it into social media posts to pictures that can find almost anywhere. They're worried about what they're calling a breakthrough assault on our rights. And we're starting to see this here in the UK is where the US is well, and it's very, very scary in the facial recognition is 80 ish percent accurate in some cases, is in the worst cases it's about 80% inaccurate, which is terrible. I think this is dangerous technology in the wrong hands, and it can easily be misused. The wrong hands don't mean like the guys in the White House. The wrong hands imply someone who has access to this type of database, who wants to find the name and phone number of that person they saw in this coffee shop. So they can call them up and try and get a date. It could be that simple. So I'm getting very concerned about it. Our law enforcement here in the US has relaxed the established rules of evidence that have been around for a long time and retaining things like our photos. When should they be keeping it that many police departments have cameras, video cameras on the cars as they drive around? In some jurisdictions, it means taking pictures of your license plate or photos of all of the occupants. When it finds an active ticket against the owner of the vehicle or the vehicle itself, you will be pulled over all automatically. Frankly, this type of activity concerns me because it's there will be mismatches. There will be people accused that shouldn't be. And honestly, I think we should be secure in it and have that type of privacy.

Matt
We were talking to Craig Peterson. He is our tech guru. You hear him every Wednesday at 738. You can listen to him on Saturday at one o'clock as well. You can go to Craig Peterson dot com anytime you want, and hear what he has to say. You know, we said it earlier, Craig about Jeff Bezos and the hacking of his phone. What's the latest on that? Should we be concerned?

Craig
It presents an interesting problem because Jeff Bezos was using a piece of software on his smartphone that many people use has called WhatsApp. It was bought by Facebook some time ago. What happened is that the Saudi Crown Prince was upset with the stories in the Washington Post that were written by Jamal Khashoggi. Khashoggi had written articles, news stories for The Washington Post. The Saudi crown prince had met Jeff Bezos at a party, and they exchanged WhatsApp phone numbers. That's how you communicate, and WhatsApp, you have a phone number associated with your account. So now, they can talk to each other using WhatsApp, and WhatsApp is an app designed for secure communications that encrypted from end to end. Let's get into a little bit more meat of your question, which is what happened here behind the scenes? Well, it turned out the watch app had a bug in the way it has handled or maybe even still handles access to your photos and videos and other information contacts on your phone. And apparently, someone used the Saudi Crown Princes account WhatsApp account, sent a video to Jeff Bezos. That video had in it some malware that gave them full access to Jeff Bezos, and his phone and everything on it. Well, the phone numbers of probably the contacts, but videos and photographs. And Jeff Bezos notices his phone was slow, which by the way, is the number one reason I get phone calls for security. But the email slows the slow phone computers not working right. Jeff took his phone to one of these places that did some cyber forensic analysis on the phone. They discovered why yes, indeed, the amount of data that's being sent by your phone is 100 6,000,000% higher than usual. It is posting videos, etc. out to the Saudi Crown Prince. Guess what ended up happening? We ended up with the most expensive divorce in history with Jeff Bezos and his wife because those videos and photos leaked. So that's the basics of what happened here.

Ken
Craig Peterson joins us at this time every Wednesday to go over what's happening in the world of technology today being no exception to that, Craig, as always, we appreciate you joining us here, and we will talk to you again next week.

Craig
Hey, gentlemen, take care. I'm going to talk more about this weekend on my show at one o'clock on Saturday. I want to get into what can you do to prevent this sort of thing? What should you do? So we'll cover that in more detail on Saturday.

Ken
We'll be looking forward to that.

Craig
Okay, take care, guys.

Craig 
Hey, everybody, make sure you are on my email list. So you get all of this and more. Just Go to Craig Peterson dot com slash subscribe. I keep pretty much everything up there on the site. Again, Craig Peterson dot com slash subscribe. We'll talk to you again on Saturday. Bye-bye

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Good morning everybody!

I was on with Ken and Matt. We had a good discussion about Business Email Compromise, what it is, who is at risk and what we can do about it. Then it was onto the Jeff Bezos Phone Hack. So here we go with Ken and Matt.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Automated Machine Generated Transcript:

Craig
They scraped every picture on the internet that they could get their hands on. That is against the usage of rules and agreements of all these websites. If you had a picture posted on Facebook that was publicly accessible or on Twitter

Craig
Good morning, everybody. Of course, this is Craig Peterson on WGAN, up in Maine, on their morning drive show. There is some very concerning stuff going on to news statistics out that we talked about this week about fishing and BEC type email attacks. We are going to get into it right now.

Ken
We are back ladies and gentlemen it is 738 on the WGAN morning news with Ken and Matt on Wednesday, which means it's time to talk to Craig Peterson, our tech guru, to go over all the things about technology that affect our daily lives here today. Craig, How are you this morning?

Craig
Good morning, doing well

Ken
Well, let's start talking about some techniques, shall we? How many organizations last year, got phished, successfully?

Craig
Yeah, this is a huge trend that's been going on. You know, we keep hearing these warnings FBI has issued an alert out, and we will talk about it here on the show. It is really getting down to the brass tacks because we're, we're all somehow making some money, right? Whether or not you are getting paid because you know nothing about an oil company, or perhaps you are getting paid because you're working hard and getting up at 3 am every day. Those organizations, every one of them, right now got phished. Of course, you know what phishing is those of those types of emails that encourage you to click on something, maybe download something, etc. There are some new statistics out right now. They are kind of a little scary. You know, I'm not even sure these are that accurate because they say that nearly 90% of organizations around the world are targets of this whole business email compromise, type of scam, fear, spear-phishing attacks, which is a very, very big deal. And I think it's probably closer to 100% of organizations. I don't know you guys probably both have gotten those emails, right, supposedly, from your bank, etc. Absolutely. Yeah. I don't see why it's only 90%. But it's, it's very, very bad. It's very high. They're looking at global data from 50 million simulated phishing attacks. They got sent out to the customers of one company by their security firm, Proofpoint. They sent them over the one year but the part that's most alarming to me because you know, 100% that's not news. But unfortunately, more than half of the people that got these simulated phishing attacks opened the email and clicked on a link, and they were convinced to do it. That's the scary part. Another big story this week is telling us a little bit about what the results of that are the cost of it, and it's happening more, we are getting better. Okay. It used to be that it was 90% of people would open these emails. So we are getting better, but the costs are even increasing.

Matt
We are talking to Craig Peterson, he is our tech guru, and he joins us at this time every Wednesday to go over what's happening in the world of technology. I am always fascinated by this evolving facial recognition technology. I'm thinking of a man walking into the Gap or whatever, like in Minority Report, and they scan your eyes, or they just know they know who you are. They say Welcome back to the store. How did you enjoy those jeans that you just bought? Would you like to look at something new, etc.? The real utility of it, at least right now, is in terms of security and things like that. So obviously London is now adopting its facial recognition technology for police to us. Europe is considering a ban on it. Talk to us about where we stand with the use of this technology for law enforcement, and I guess beyond.

Craig
Last weekend, on my show, of course, Saturdays at 1 pm here on the same station, but and my show last weekend, I went into quite a bit of detail about this one company that had been operating kind of underground. They did something that this is frankly illegal. They scraped every picture available on the internet they could grab. That's against the usage of rules and agreements of all these websites. If you had an image posted on Facebook that was publicly accessible or on Twitter or on these online photo album sites that you can share photos. They have it. They have over 3 billion social media pictures. What they're doing is selling subscriptions to police departments. These police departments pay as little as $10,000 a year, can take a picture from some security cameras somewhere, and run it through this software. It's an app that runs on your phone. And it will tell the police where it has seen you before online. The police have been hindered over the years by only having pictures in their database of people who had interactions with police. You know you get arrested, they take photos and fingerprints. Now they have been able to identify hundreds or thousands of people that were involved in crimes were unsolved crimes, which is kind of interesting. So what London's doing now is they're taking that same type of technique. By the way, there are lawsuits against this company. Right now, it's in use in New York City. A lot of police departments are using it. But London's taking that type of technology because it's one thing to have faces. London has been, it's the most surveilled city in the world outside of China. And that means there's a lot of cameras out there. For years the city of London has been taking all of that information and use it to track people as they moved around London. Now with this newer technology that we're starting to see where it's tying it into social media posts to pictures that can find almost anywhere. They're worried about what they're calling a breakthrough assault on our rights. And we're starting to see this here in the UK is where the US is well, and it's very, very scary in the facial recognition is 80 ish percent accurate in some cases, is in the worst cases it's about 80% inaccurate, which is terrible. I think this is dangerous technology in the wrong hands, and it can easily be misused. The wrong hands don't mean like the guys in the White House. The wrong hands imply someone who has access to this type of database, who wants to find the name and phone number of that person they saw in this coffee shop. So they can call them up and try and get a date. It could be that simple. So I'm getting very concerned about it. Our law enforcement here in the US has relaxed the established rules of evidence that have been around for a long time and retaining things like our photos. When should they be keeping it that many police departments have cameras, video cameras on the cars as they drive around? In some jurisdictions, it means taking pictures of your license plate or photos of all of the occupants. When it finds an active ticket against the owner of the vehicle or the vehicle itself, you will be pulled over all automatically. Frankly, this type of activity concerns me because it's there will be mismatches. There will be people accused that shouldn't be. And honestly, I think we should be secure in it and have that type of privacy.

Matt
We were talking to Craig Peterson. He is our tech guru. You hear him every Wednesday at 738. You can listen to him on Saturday at one o'clock as well. You can go to Craig Peterson dot com anytime you want, and hear what he has to say. You know, we said it earlier, Craig about Jeff Bezos and the hacking of his phone. What's the latest on that? Should we be concerned?

Craig
It presents an interesting problem because Jeff Bezos was using a piece of software on his smartphone that many people use has called WhatsApp. It was bought by Facebook some time ago. What happened is that the Saudi Crown Prince was upset with the stories in the Washington Post that were written by Jamal Khashoggi. Khashoggi had written articles, news stories for The Washington Post. The Saudi crown prince had met Jeff Bezos at a party, and they exchanged WhatsApp phone numbers. That's how you communicate, and WhatsApp, you have a phone number associated with your account. So now, they can talk to each other using WhatsApp, and WhatsApp is an app designed for secure communications that encrypted from end to end. Let's get into a little bit more meat of your question, which is what happened here behind the scenes? Well, it turned out the watch app had a bug in the way it has handled or maybe even still handles access to your photos and videos and other information contacts on your phone. And apparently, someone used the Saudi Crown Princes account WhatsApp account, sent a video to Jeff Bezos. That video had in it some malware that gave them full access to Jeff Bezos, and his phone and everything on it. Well, the phone numbers of probably the contacts, but videos and photographs. And Jeff Bezos notices his phone was slow, which by the way, is the number one reason I get phone calls for security. But the email slows the slow phone computers not working right. Jeff took his phone to one of these places that did some cyber forensic analysis on the phone. They discovered why yes, indeed, the amount of data that's being sent by your phone is 100 6,000,000% higher than usual. It is posting videos, etc. out to the Saudi Crown Prince. Guess what ended up happening? We ended up with the most expensive divorce in history with Jeff Bezos and his wife because those videos and photos leaked. So that's the basics of what happened here.

Ken
Craig Peterson joins us at this time every Wednesday to go over what's happening in the world of technology today being no exception to that, Craig, as always, we appreciate you joining us here, and we will talk to you again next week.

Craig
Hey, gentlemen, take care. I'm going to talk more about this weekend on my show at one o'clock on Saturday. I want to get into what can you do to prevent this sort of thing? What should you do? So we'll cover that in more detail on Saturday.

Ken
We'll be looking forward to that.

Craig
Okay, take care, guys.

Craig 
Hey, everybody, make sure you are on my email list. So you get all of this and more. Just Go to Craig Peterson dot com slash subscribe. I keep pretty much everything up there on the site. Again, Craig Peterson dot com slash subscribe. We'll talk to you again on Saturday. Bye-bye

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Good morning everybody!

I was on with Ken and Matt. We had a good discussion about Business Email Compromise, what it is, who is at risk and what we can do about it. Then it was onto the Jeff Bezos Phone Hack. So here we go with Ken and Matt.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Automated Machine Generated Transcript:

Craig
They scraped every picture on the internet that they could get their hands on. That is against the usage of rules and agreements of all these websites. If you had a picture posted on Facebook that was publicly accessible or on Twitter

Craig
Good morning, everybody. Of course, this is Craig Peterson on WGAN, up in Maine, on their morning drive show. There is some very concerning stuff going on to news statistics out that we talked about this week about fishing and BEC type email attacks. We are going to get into it right now.

Ken
We are back ladies and gentlemen it is 738 on the WGAN morning news with Ken and Matt on Wednesday, which means it's time to talk to Craig Peterson, our tech guru, to go over all the things about technology that affect our daily lives here today. Craig, How are you this morning?

Craig
Good morning, doing well

Ken
Well, let's start talking about some techniques, shall we? How many organizations last year, got phished, successfully?

Craig
Yeah, this is a huge trend that's been going on. You know, we keep hearing these warnings FBI has issued an alert out, and we will talk about it here on the show. It is really getting down to the brass tacks because we're, we're all somehow making some money, right? Whether or not you are getting paid because you know nothing about an oil company, or perhaps you are getting paid because you're working hard and getting up at 3 am every day. Those organizations, every one of them, right now got phished. Of course, you know what phishing is those of those types of emails that encourage you to click on something, maybe download something, etc. There are some new statistics out right now. They are kind of a little scary. You know, I'm not even sure these are that accurate because they say that nearly 90% of organizations around the world are targets of this whole business email compromise, type of scam, fear, spear-phishing attacks, which is a very, very big deal. And I think it's probably closer to 100% of organizations. I don't know you guys probably both have gotten those emails, right, supposedly, from your bank, etc. Absolutely. Yeah. I don't see why it's only 90%. But it's, it's very, very bad. It's very high. They're looking at global data from 50 million simulated phishing attacks. They got sent out to the customers of one company by their security firm, Proofpoint. They sent them over the one year but the part that's most alarming to me because you know, 100% that's not news. But unfortunately, more than half of the people that got these simulated phishing attacks opened the email and clicked on a link, and they were convinced to do it. That's the scary part. Another big story this week is telling us a little bit about what the results of that are the cost of it, and it's happening more, we are getting better. Okay. It used to be that it was 90% of people would open these emails. So we are getting better, but the costs are even increasing.

Matt
We are talking to Craig Peterson, he is our tech guru, and he joins us at this time every Wednesday to go over what's happening in the world of technology. I am always fascinated by this evolving facial recognition technology. I'm thinking of a man walking into the Gap or whatever, like in Minority Report, and they scan your eyes, or they just know they know who you are. They say Welcome back to the store. How did you enjoy those jeans that you just bought? Would you like to look at something new, etc.? The real utility of it, at least right now, is in terms of security and things like that. So obviously London is now adopting its facial recognition technology for police to us. Europe is considering a ban on it. Talk to us about where we stand with the use of this technology for law enforcement, and I guess beyond.

Craig
Last weekend, on my show, of course, Saturdays at 1 pm here on the same station, but and my show last weekend, I went into quite a bit of detail about this one company that had been operating kind of underground. They did something that this is frankly illegal. They scraped every picture available on the internet they could grab. That's against the usage of rules and agreements of all these websites. If you had an image posted on Facebook that was publicly accessible or on Twitter or on these online photo album sites that you can share photos. They have it. They have over 3 billion social media pictures. What they're doing is selling subscriptions to police departments. These police departments pay as little as $10,000 a year, can take a picture from some security cameras somewhere, and run it through this software. It's an app that runs on your phone. And it will tell the police where it has seen you before online. The police have been hindered over the years by only having pictures in their database of people who had interactions with police. You know you get arrested, they take photos and fingerprints. Now they have been able to identify hundreds or thousands of people that were involved in crimes were unsolved crimes, which is kind of interesting. So what London's doing now is they're taking that same type of technique. By the way, there are lawsuits against this company. Right now, it's in use in New York City. A lot of police departments are using it. But London's taking that type of technology because it's one thing to have faces. London has been, it's the most surveilled city in the world outside of China. And that means there's a lot of cameras out there. For years the city of London has been taking all of that information and use it to track people as they moved around London. Now with this newer technology that we're starting to see where it's tying it into social media posts to pictures that can find almost anywhere. They're worried about what they're calling a breakthrough assault on our rights. And we're starting to see this here in the UK is where the US is well, and it's very, very scary in the facial recognition is 80 ish percent accurate in some cases, is in the worst cases it's about 80% inaccurate, which is terrible. I think this is dangerous technology in the wrong hands, and it can easily be misused. The wrong hands don't mean like the guys in the White House. The wrong hands imply someone who has access to this type of database, who wants to find the name and phone number of that person they saw in this coffee shop. So they can call them up and try and get a date. It could be that simple. So I'm getting very concerned about it. Our law enforcement here in the US has relaxed the established rules of evidence that have been around for a long time and retaining things like our photos. When should they be keeping it that many police departments have cameras, video cameras on the cars as they drive around? In some jurisdictions, it means taking pictures of your license plate or photos of all of the occupants. When it finds an active ticket against the owner of the vehicle or the vehicle itself, you will be pulled over all automatically. Frankly, this type of activity concerns me because it's there will be mismatches. There will be people accused that shouldn't be. And honestly, I think we should be secure in it and have that type of privacy.

Matt
We were talking to Craig Peterson. He is our tech guru. You hear him every Wednesday at 738. You can listen to him on Saturday at one o'clock as well. You can go to Craig Peterson dot com anytime you want, and hear what he has to say. You know, we said it earlier, Craig about Jeff Bezos and the hacking of his phone. What's the latest on that? Should we be concerned?

Craig
It presents an interesting problem because Jeff Bezos was using a piece of software on his smartphone that many people use has called WhatsApp. It was bought by Facebook some time ago. What happened is that the Saudi Crown Prince was upset with the stories in the Washington Post that were written by Jamal Khashoggi. Khashoggi had written articles, news stories for The Washington Post. The Saudi crown prince had met Jeff Bezos at a party, and they exchanged WhatsApp phone numbers. That's how you communicate, and WhatsApp, you have a phone number associated with your account. So now, they can talk to each other using WhatsApp, and WhatsApp is an app designed for secure communications that encrypted from end to end. Let's get into a little bit more meat of your question, which is what happened here behind the scenes? Well, it turned out the watch app had a bug in the way it has handled or maybe even still handles access to your photos and videos and other information contacts on your phone. And apparently, someone used the Saudi Crown Princes account WhatsApp account, sent a video to Jeff Bezos. That video had in it some malware that gave them full access to Jeff Bezos, and his phone and everything on it. Well, the phone numbers of probably the contacts, but videos and photographs. And Jeff Bezos notices his phone was slow, which by the way, is the number one reason I get phone calls for security. But the email slows the slow phone computers not working right. Jeff took his phone to one of these places that did some cyber forensic analysis on the phone. They discovered why yes, indeed, the amount of data that's being sent by your phone is 100 6,000,000% higher than usual. It is posting videos, etc. out to the Saudi Crown Prince. Guess what ended up happening? We ended up with the most expensive divorce in history with Jeff Bezos and his wife because those videos and photos leaked. So that's the basics of what happened here.

Ken
Craig Peterson joins us at this time every Wednesday to go over what's happening in the world of technology today being no exception to that, Craig, as always, we appreciate you joining us here, and we will talk to you again next week.

Craig
Hey, gentlemen, take care. I'm going to talk more about this weekend on my show at one o'clock on Saturday. I want to get into what can you do to prevent this sort of thing? What should you do? So we'll cover that in more detail on Saturday.

Ken
We'll be looking forward to that.

Craig
Okay, take care, guys.

Craig 
Hey, everybody, make sure you are on my email list. So you get all of this and more. Just Go to Craig Peterson dot com slash subscribe. I keep pretty much everything up there on the site. Again, Craig Peterson dot com slash subscribe. We'll talk to you again on Saturday. Bye-bye

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Good morning, everybody. I was on with Mr. Jim Polito this morning and we discussed these Fake Jobs that are being offered on-line, spoofed websites and ID theft. Then we got into who was responsible for hacking Jeff Bezos's phone and why we have to be careful who we hire.  So, here we go with Mr. Polito.

For more tech tips, news, and updates visit - CraigPeterson.com

--- 

Automated Machine Generated Transcript:

Craig
You know, Make America Great Again, that would not be a great password. Yeah, but some random words strung together are much harder to crack on a computer than anything else because of the way the cracking technologies work nowadays. The cracking technology is much different than it used to be.

Craig
Morning, everybody that was me with Mr. Jim Polito, and we broke down a couple of things today. First of all, a couple of security things, the truth about your passwords. We went into the whole hack here that led to the most expensive divorce in history, and also employment scams on the rise. Why is it happening? What should you be cautious of if you're looking for a new job? The FBI has a special warning out. So here we go with Jim.

Jim
Always ahead of the curve. Always bringing us the latest from the world of tech talk, our good friend, Craig Peterson. Good morning, sir.

Craig
A good morning. You know things are always changing out there in the industry. I'm going to bring something up. You mentioned earlier today. What they're trying to with this Data Privacy Day is to bring some visibility into the whole password problem, right? And you talked about some of the advice that they were giving and, and, what iHeart makes you guys do. What is it? Change your passwords every three months,

Jim
Yes, every three months. We have to change our password, and it can't be even close to the previous password.

Craig
That's a widespread thing out there in the industry, just in general. But I got to tell you that the National Institute of Standards and Technology, which is the organization within the federal government that comes out with all of these security standards, change that about a year ago. So You now have something to use against them. Here's why. Here's what's going on. If they make you come up with a new password every three months, what are the odds that it's going to be an excellent password? Next, what are the chances that you're not going to write it down somewhere like where the cleaning lady can find it? Maybe in your drawer, taped to the bottom of your keyboard, or even worse, and I know people are listening that are going to go into the office today and immediately and take down their post-it notes. If you can believe it, people place post-it notes right on their computer. The current recommendations are, you come up with a great phrase. Yeah, you don't have to use special characters and numbers and all this other stuff. But come up with a few random words. Pick four or five words that you can remember that you can associate together. Oh, and you don't have to change it every three months. Once a year is probably enough and phrase with three or four words that are there aren't things like, you know, make America great again, that would not be a de password. Yeah, but some random words that are harder to crack on a computer than anything else because the way the crackers are working nowadays, the cracking technologies is much different than it used to be. So just a quick word of advice to people if you're worried oh my gosh, I don't change my password every three months, and I don't have special characters and digits in it. Best password according to nest is just four maybe five words. random ones strung together and that's your passwords more accessible cookie-cutter type two,

Jim
But I have a new one it is Could I please MooMoo face banana? No. Can I please use MooMoocen face banana face to the dog patch

Craig
That would work. I think

Jim
I think Steve Martin said that one. I'm stealing it from Steve Martin. But yeah, you don't want to use one like that. Then someone if they know that expression will say, Oh, yeah, I remember Steve Martin said that. If they just get a few words they'll say, they'll say, I'd like to guess at solving the puzzle. Especially if you say it on the radio.

Craig
All right. Well, it's data privacy day. And that's why I brought it up. So great day to have you with us. And a great day to warn people about a new scam. The FBI is talking about, so you think you're applying for a job online? And then maybe we even got the job. And the fact is, you're talking with a scammer online.

Unknown Speaker 4:57
Yeah, that's something.

Craig
The trick behind that right now, the scammers, the bad guys. What are they doing? They always go after the latest stuff, maybe something that's in the news, etc., etc. And you know what, it turns out I don't know, I listened to some of the house hearings. It would seem as though the job markets terrific the economy is falling apart, and we've got the worst president in history. But I think readability is more along the lines of, Hey, you know, I've had this job for 234 years now. If you're a millennial, hey, I've had this job for six months now. I wonder if there's a better job of it. I keep hearing that people are getting paid more. So they're looking for jobs. So you have even though the job market is tight for employers, you have all these people looking for jobs. So the scammers have figured out. You know what, we can get a lot of information from somebody that applies for a job. Because people, people will fill out forms, right, Jim, and they'll give me their social security number, their employment history, their home address their phone number. So people are now going online, they're looking for new jobs to see if they can do a little bit of an upgrade, which makes a whole lot of sense to me. And they are getting the victims to not only give all of this information to them, but they're also even getting people to pay them. And we're talking about these criminals who are, you know, have these fake jobs averaging about $3,000 per person, according to the FBI advisory?

Jim
Hey $3,000, which also means, by the way, some people were out $100,000

Craig
Yeah, exactly. So they're now using the spoof web page to harvest this personally identifiable information. And a spoof website, of course, isn't like instead of going to I heart, you go to I dash hearts calm. Yep. Right. And you don't notice that you went to the wrong website. And the criminals are also they're all putting advertising in legitimate ads from legitimate employers. So you go to the site, it looks real, right? These bad guys are stealing ads from legitimate employers. They're doing everything. But that's because now employees are busy looking for other jobs. Because what the heck, they might just find them.

Jim
We're talking with Craig Peterson, our good friend Tech Talk guru. I have to be careful. When applying online, make sure you know to whom you're talking. If it sounds too good, it probably is not real. Craig in the time we have left, I want to ask about this week john had the story. Last week, we learned that Jeff Bezos's phone hack that led to the exposure of his affair. It turns out the Saudi prince accused of masterminding the murder of a journalist is the same one charged with the hack on Jeff Bezos's phone, of course, the founder of Amazon. I'll be talking about this a lot more in my on my podcast this weekend, which you can also find on the iHeart as well.

Jim
There we go. Yeah, and the easiest way to find it is you just go to Craig Peterson dot com.

Craig
But here's what happened. Guys, man has a media been getting this report wrong. But let's start at a high level. First of all, remember Jeff Bezos bought this fish wrapper out of Washington DC, remember when that happened, right? It was the Washington Post. So he bought this newspaper down in Washington DC, and is, you know, it's been around for a very long time. Okay. It broke some national stories over the years, but it's just gone left. Well, Jeff hired a journalist, Jamal Khashoggi, and he began writing for the Washington Post had been criticizing the Saudi Crown Prince because of the murdering of this Jamal Khashoggi. And then they were saying a lot of nasty things about it. So what ended up happening now apparently, this is all allegations at this point. But apparently, the Saudi Crown Prince got pretty upset that the Washington Post was saying all these bad things about him and that they murdered this. I'll use the term journalist kind of loosely because I think that does apply here in the case of Khashoggi. Yeah, at any rate, he wanted the Crown Prince, apparently to have a little vengeance. So the owner of The Washington Post, ultimately, is Jeff Bezos. Yep, the richest man in the world. Yep. He, here's what he did. And this is kind of interesting because we use these apps all the time. And apps are, you know, they can be significant. They sometimes can be monitored. And there's something called an end to end encryption. And when people are looking at apps to communicate, you want an end to end encryption. In other words, you don't want it set up and in a way that somebody can intercept it. So apparently, Jeff Bezos exists. An App called WhatsApp, which is owned by Facebook and does have an end to end encryption. But here's what happened. It looks like they used some of the hacker hacking software that's known as a zero-day attack against whats app. And apparently, there was a bug inside of the WhatsApp app. Now let's think about this for a minute from people that use WhatsApp or use any kind of a chatting or messenger program. If you're using your iPhone, it comes up and says, this half WhatsApp wants access to your photos and videos. And so you're sitting there thinking, Okay, what am I, you know, let's find I'm going to want to share videos and photos. So yeah, go ahead. Let's what WhatsApp has access to, and that's true, obviously on Android as well. A little more confused than Android, but it's right in both cases. So apparently what happened was, there was a bug that some people There's still allegations here, I'm not positive on the reality there is I'm not going to make any names or, or other allegations here. Researchers found a bug in WhatsApp that allowed them to send you a WhatsApp user a video. And that video broke into and took over WhatsApp. And almost immediately after Jeff Bezos received this video from the Saudi prince, you know whether or not it was him as a different story, but received it from the Saudi prince. His phone started exfiltrating data. In other words, all of a sudden, his phone started sending pretty much everything that was in his pictures and videos to Saudi Arabia. And then what do you have, you have the most expensive divorce in history.

Jim
It was the most expensive divorce in history, how many? Meaning she didn't even get half. It was still, what did she get, like 38,000,000,048 billion bunch of property.

Craig
Wow, it's tough. It's tough to live on that. So it's he noticed something has just started slowing down. It was sending video data out at a rate of 106,000,000%. Higher than previously. So he noticed something was wrong. And he took it to a forensics group who started having to look at the phone, but it was a bug in WhatsApp. And that kind of concerns me I'm sure it's going to be fixed if it hasn't been already. But you know, this has to do with again, having 100 200 apps on your phone. Think about it, all of those apps on your phone, what bugs do they have in them? How many apps to use. And as part of security awareness today, and I've said this for a long time, delete apps that you do not use frequently. If If you want real secure communications, if you're using iPhone messages is probably all you need messages and FaceTime, they both do a great job. And because Apple's paying close attention to it, bugs like this are likely to get fixed very, very quickly. And this is what happened to this is the new world that we're living in today. All of these application developers and these cool little apps that we have, you know the ones make it look like you're 20 years older or younger are stealing our data in some cases like this morphine app, the data is sent directly to Russia. You lose all rights to any pictures you uploaded. Worse yet, who knows what they're doing with those photos once they get there. So get rid of these apps that you're not using and don't trust them. 100% of you think something weird is happening that might be. And one real quick thing I have to say, and that is that when we get involved with an investigation for business on behalf of a company that thinks they might have been hacking, something might be going on 99% of the time, Jim, we get a call. Something's going on with our email. We're not sure what it is. And then when we dig into it more refined Chinese backdoors Russian hack,

Jim
yeah.

Craig
Right now, everyone's attacking our customers. It's just amazing what's happening out there.

Jim
All right. Now you know what's happening out there. He's told you about the latest security stuff you need to know during this segment. If you want more of this information, get on board with Craig Peterson. All you have to do is text my name, Jim, to this number 855-385-5553. That's just texting Jim to 855-385-5553. Standard data and text rates apply. And Craig Peterson will not annoy you bother you sell you something or hack you. Don't worry about it. Craig, thank you so much. Great segment. We'll talk with you next week.

Craig
Thanks, Jim. Bye-bye.

Craig 16:31
All right. Hey, everybody, I want to let you know we have been working hard creating a new course for you. I will have exclusive giveaways for you as part of the course. It is going to be the best webinar ever, of course, all centered on transforming your security, your security posture, and more. So keep an eye out on your email, Greg peterson.com slash subscribes, but see the only one Didn't find out about it. Take care, everybody. Be back tomorrow. Bye-bye

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553