Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Welcome!

Good morning, everybody. I was on with Mr. Jim Polito this morning and he'd been talking a lot about recycling and recycled bags and stuff because the Commonwealth of Massachusetts is right now considering legislation that would black ban all plastic bags throughout the state. And of course, they're not really considering implications. But we got into Google and they are now using a vacuum truck to grab all of our medical records and our personal information along with it. So, here we go with Mr. Polito.

For more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

Big Tech Has Your Private Medical Records -- Through Hospital Partnerships   

--- 

Automated Machine Generated Transcript:

Craig Peterson 0:00
Good morning, everybody. Craig Peterson here. I don't know if you've seen them yet. But I've got a couple of Facebook Lives up on my page. You can go there just from my website, Craig Peterson dot com slash Facebook. But you can find me if you poke around a little bit. And I have been kind of explaining some of the technology that business people small business people need to know and be aware of and understand. So check those out if you haven't already. And shout out to everybody. I had a few people comment. Basically, they listened to all of my podcasts from last week, which amounted to more than two hours uninterrupted. And that was a lot of Craig. Hey, I appreciate you guys listening and subscribing. It does get the word out which is really good. We are building momentum again on the podcast over 100,000 here recently sold that's all downloads. That's all really really good and I appreciate you guys, buddy. up with me and asking questions too. That's how I get a lot of the source materials as I kind of explain the latest in technology, and more particularly some of the latest in the security realm as well. This morning I was on with Mr. Polito. He'd been talking a lot about recycling and recycled bags and stuff because the Commonwealth of Massachusetts is right now considering legislation that would black ban all plastic bags throughout the state. And of course, they're not really considering implications. But we got into Google and they are now using a vacuum truck to grab all of our medical records and our personal information along with it. So that's what we chatted about this morning.

Jim Polito 1:52
Here we go. This man is incredible. Incredible. Hey, who was A guy who said the next frontier of cyber hacking and everything else you have to worry about is your record your healthcare record, Craig Peterson said in our tech talk crew, and he joins us now. Good morning, Craig.

Craig Peterson 2:16
Hey, good morning, Jim. You know, if people are worried about recycling plastic bags, when you walk into any Target, WalMart, almost any of these big-box retailers right inside, there is a recycle box that you can put your plastic bags into. Yeah, problem solved. 

Jim Polito 2:37
Yeah. It's everybody being responsible. And it's not our fault that the oceans are filled with that stuff. But anyway, let's get on to the Google monster and something that you are the first really to sound the alarm on quite a while ago. It was Hey, the new frontier is not going to be your financial record. It's going to be your healthcare record. We find out that the folks, the good folks at Google are swallowing up our, our information. Should I be worried, Craig Peterson?

Craig Peterson 3:16
Yeah, here's the thing that you know, we talked about it in January 2018. I remember it well, years ago for the Wayback Machine. It is it is. And it was because our medical records are so valuable. And I was saying back then actually kind of late 2017 that really our medical records are going to be the next frontier of the bad guy stealing them you remember, of course, these HIPAA regulations went in place 30 years ago now. And the main idea behind them was that hey, your records gonna be portable gym when you do your Snowbird emulation and end up in Florida for two weeks. middle of winter and you have to see a doctor, the doctor down there would be able to look at your electronic medical records from up here in Worcester, right. That's the whole idea. Listen,

Jim Polito 4:12
I think that's great portability of a medical record, controls, costs, improves quality of healthcare, all of that. I'm on board for that.

Craig Peterson 4:23
But, the other side of this was before HIPAA regulations went into place if someone was to share your medical records with someone else, did not have a direct interest, like another doctor. It was illegal, they could get into trouble you could sue them for privacy violations. But HIPAA made it possible for medical companies, doctors, everybody else, to share your records in an unfettered way. While it's all For instance, if I wanted to look at every record that UMass has every medical record or you know, you name a hospital, and I'm in collusion with that hospital, I could just easily say, Hey, listen, I'm thinking about buying you guys. I want to see the medical records of every patient you've had. And they could give them to me. Yeah. Now, here's what's happening. With our friends at Google. We've got something called Project Nightingale. You might remember that woman from a little while back, I think was her first name was Florence.

Jim Polito5:34
A wonderful lady.

Unknown Speaker 5:37
Exactly. She helped so many men and women and just saved lives. So, Google has Project Nightingale underway now. And Google has partnered with and this is the part I'm having a little bit of a hard time swallowing. They're partnering with a group called Ascension which is a big health care conglomerate really but company here in the United States. And this is the part that I just don't understand here, Ascension is a Catholic nonprofit health system includes  34,000 providers 2600 hospitals, doctors' offices, other facilities. 21 states plus the District of Columbia. Google and Ascension have partnered and Ascension has apparently without even notification to the patient, has apparently shared these medical records that they have with our friends at Google. The Wall Street Journal has a report out there saying that this information contains patient names birth dates, a complete medical records, as well and according to the Wall Street Journal, what's been happening here is that Ascension has not only fed them data that they already had about all of these patients. But when you go in and you're checking in all of that information, when you are sitting there upfront is being fed directly into Google. When the doctors are evaluating their case, it's being sent directly to Google, as well. It's all under the HIPAA regulations, which many people think somehow provides them with more privacy. But certainly, in this case, and in many others, has taken away not only your privacy, but you're rights, and the need to even notify you. So, this is very concerning. And Google is saying, Hey, listen, it's only 150 of our employees that get to see this. Show me your diagnosis, laboratory test results and hospitalization records. You know, don't worry about it. What could go wrong here?

Jim Polito 8:02
I'd love that. That's always the line. I think they said that on the Hindenburg. What could go wrong here? It's just hydrogen.

Craig Peterson 8:09
What could go wrong? It's just a small, small coal fire in the hold of our Titanic ship.

Jim Polito 8:18
Big deal, knock it off. Don't be such a worrier.

Craig Peterson 8:22
Right? Exactly. So this is 10s of millions of Americans that are affected by this. And what they're trying to do. What this project is trying to do is to make it so that they get better diagnoses, better outcomes, ultimately, because all those information is being sucked up by Google's been analyzed and apparently. The doctors are unaware of this happening in these Catholic and other hospitals. But Google is providing them these doctors with some recommendations about treatments and diagnoses as well.

Jim Polito 9:00
Okay, well wait a minute. We're talking with our good friend Craig Peterson. And you probably heard in the news about Google and this foray into medical records. All right. Look, I know someone whose son is working on a research project, and it's in relation to breast cancer. And it involves a giant cloud calculation of putting in data of all of these different people who had breast cancer diagnosed with breast cancer. And, and the mission is to find out something that was common at the time of diagnosis and what was different prior to diagnosis. Basically, what they're looking for is what was the switch that was thrown that started this cancer, okay, so then massive amounts of data, and I get that. But that data is all protected from matching it up with an individual. I mean, many of these individuals could be dead. This is a massive amount of data. I get that, Craig, but I'm worried about. And I don't have a problem with Google and other big, big firms working on this. What I do have a problem with is, how do I know this is protected? How do I know this isn't going to be used against me?

Craig Peterson 10:35
Well, one only needs to look at the NIH to get an answer to that question. Of course, you know what that is?

Jim Polito 10:43
Yeah, is that in Canada.

Craig Peterson 10:44 
No. That's The National Health Service over in the United Kingdom, okay. Yeah, and this is socialized medicine. And in all of these countries, they have death panels, and they're trying to Figure out, is it worth spending any money on this patient? Basically, if you're under 10 years old or over 50 years old, the answer to that question is no. But here's what they've done over in the UK. They have taken this type of data now. And they're using computers to determine whether or not they should just let you die. Literally, let you die. Yeah, if they should treat you at all. That's where this ultimately leads. I love the idea of, you know, having this robust data set, improving outcomes, reducing costs, saving lives, that's what they really want to do. That's why the Catholic Church and ascension got into this. Ultimately, this is for the good. But Jim, this is another example of the government telling us that HIPAA is going to make our information more private, safer, and is done the exact opposite. None of these things People had to opt-in. None of these people were even notified that it was happening, let alone a chance to opt-out of it. Okay. And that's where some of the problems come in. And when you're talking about this massive amount of data, you talked about the anonymizing that happened, yeah. So you can identify an individual in this case, obviously they could, because thinking the names and addresses, but even with anonymized data, where all they have is a number associated with the record and no other information like your name or address, it's been proven again and again, that it can be D anonymize very, very easily in most cases. So we'll see what happens. But the President of Google Cloud came out with a statement and, and you know, bless these guys, they're trying to do the right thing. But Google just you know, this whole deal to buy bit fit. We're now giving our instant cardiac readings on Exercise readings are sleep readings, everything else to Google Now. And it is starting to show up in our employment records and in and in the socialized medicine component countries. It's helping to decide whether or not they're going to treat you. Not just how to treat you.

Jim Polito 13:19
All right, Craig, this is great information. I know you have a lot of other stuff, but I wanted to focus on this. I know that if folks text My name to this number, they can get that information.

Craig Peterson 13:34
855-385-5553 I'll send a link out to this article today. But txt to 855-385-5553

Jim Polito 13:19
Standard data and text rates apply. And Craig Peterson will not annoy you. He'll get you this information. And other great stuff. Craig, thank you so much. It was very helpful and we will talk to you next week.

Craig Peterson 13:58
Thanks again, Jim.

Jim Polito 13:19
Right. When we return something incredible.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

Welcome!

Good morning, everybody. I was on with Mr. Jim Polito this morning and he'd been talking a lot about recycling and recycled bags and stuff because the Commonwealth of Massachusetts is right now considering legislation that would black ban all plastic bags throughout the state. And of course, they're not really considering implications. But we got into Google and they are now using a vacuum truck to grab all of our medical records and our personal information along with it. So, here we go with Mr. Polito.

For more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

Big Tech Has Your Private Medical Records -- Through Hospital Partnerships   

--- 

Automated Machine Generated Transcript:

Craig Peterson 0:00
Good morning, everybody. Craig Peterson here. I don't know if you've seen them yet. But I've got a couple of Facebook Lives up on my page. You can go there just from my website, Craig Peterson dot com slash Facebook. But you can find me if you poke around a little bit. And I have been kind of explaining some of the technology that business people small business people need to know and be aware of and understand. So check those out if you haven't already. And shout out to everybody. I had a few people comment. Basically, they listened to all of my podcasts from last week, which amounted to more than two hours uninterrupted. And that was a lot of Craig. Hey, I appreciate you guys listening and subscribing. It does get the word out which is really good. We are building momentum again on the podcast over 100,000 here recently sold that's all downloads. That's all really really good and I appreciate you guys, buddy. up with me and asking questions too. That's how I get a lot of the source materials as I kind of explain the latest in technology, and more particularly some of the latest in the security realm as well. This morning I was on with Mr. Polito. He'd been talking a lot about recycling and recycled bags and stuff because the Commonwealth of Massachusetts is right now considering legislation that would black ban all plastic bags throughout the state. And of course, they're not really considering implications. But we got into Google and they are now using a vacuum truck to grab all of our medical records and our personal information along with it. So that's what we chatted about this morning.

Jim Polito 1:52
Here we go. This man is incredible. Incredible. Hey, who was A guy who said the next frontier of cyber hacking and everything else you have to worry about is your record your healthcare record, Craig Peterson said in our tech talk crew, and he joins us now. Good morning, Craig.

Craig Peterson 2:16
Hey, good morning, Jim. You know, if people are worried about recycling plastic bags, when you walk into any Target, WalMart, almost any of these big-box retailers right inside, there is a recycle box that you can put your plastic bags into. Yeah, problem solved. 

Jim Polito 2:37
Yeah. It's everybody being responsible. And it's not our fault that the oceans are filled with that stuff. But anyway, let's get on to the Google monster and something that you are the first really to sound the alarm on quite a while ago. It was Hey, the new frontier is not going to be your financial record. It's going to be your healthcare record. We find out that the folks, the good folks at Google are swallowing up our, our information. Should I be worried, Craig Peterson?

Craig Peterson 3:16
Yeah, here's the thing that you know, we talked about it in January 2018. I remember it well, years ago for the Wayback Machine. It is it is. And it was because our medical records are so valuable. And I was saying back then actually kind of late 2017 that really our medical records are going to be the next frontier of the bad guy stealing them you remember, of course, these HIPAA regulations went in place 30 years ago now. And the main idea behind them was that hey, your records gonna be portable gym when you do your Snowbird emulation and end up in Florida for two weeks. middle of winter and you have to see a doctor, the doctor down there would be able to look at your electronic medical records from up here in Worcester, right. That's the whole idea. Listen,

Jim Polito 4:12
I think that's great portability of a medical record, controls, costs, improves quality of healthcare, all of that. I'm on board for that.

Craig Peterson 4:23
But, the other side of this was before HIPAA regulations went into place if someone was to share your medical records with someone else, did not have a direct interest, like another doctor. It was illegal, they could get into trouble you could sue them for privacy violations. But HIPAA made it possible for medical companies, doctors, everybody else, to share your records in an unfettered way. While it's all For instance, if I wanted to look at every record that UMass has every medical record or you know, you name a hospital, and I'm in collusion with that hospital, I could just easily say, Hey, listen, I'm thinking about buying you guys. I want to see the medical records of every patient you've had. And they could give them to me. Yeah. Now, here's what's happening. With our friends at Google. We've got something called Project Nightingale. You might remember that woman from a little while back, I think was her first name was Florence.

Jim Polito5:34
A wonderful lady.

Unknown Speaker 5:37
Exactly. She helped so many men and women and just saved lives. So, Google has Project Nightingale underway now. And Google has partnered with and this is the part I'm having a little bit of a hard time swallowing. They're partnering with a group called Ascension which is a big health care conglomerate really but company here in the United States. And this is the part that I just don't understand here, Ascension is a Catholic nonprofit health system includes  34,000 providers 2600 hospitals, doctors' offices, other facilities. 21 states plus the District of Columbia. Google and Ascension have partnered and Ascension has apparently without even notification to the patient, has apparently shared these medical records that they have with our friends at Google. The Wall Street Journal has a report out there saying that this information contains patient names birth dates, a complete medical records, as well and according to the Wall Street Journal, what's been happening here is that Ascension has not only fed them data that they already had about all of these patients. But when you go in and you're checking in all of that information, when you are sitting there upfront is being fed directly into Google. When the doctors are evaluating their case, it's being sent directly to Google, as well. It's all under the HIPAA regulations, which many people think somehow provides them with more privacy. But certainly, in this case, and in many others, has taken away not only your privacy, but you're rights, and the need to even notify you. So, this is very concerning. And Google is saying, Hey, listen, it's only 150 of our employees that get to see this. Show me your diagnosis, laboratory test results and hospitalization records. You know, don't worry about it. What could go wrong here?

Jim Polito 8:02
I'd love that. That's always the line. I think they said that on the Hindenburg. What could go wrong here? It's just hydrogen.

Craig Peterson 8:09
What could go wrong? It's just a small, small coal fire in the hold of our Titanic ship.

Jim Polito 8:18
Big deal, knock it off. Don't be such a worrier.

Craig Peterson 8:22
Right? Exactly. So this is 10s of millions of Americans that are affected by this. And what they're trying to do. What this project is trying to do is to make it so that they get better diagnoses, better outcomes, ultimately, because all those information is being sucked up by Google's been analyzed and apparently. The doctors are unaware of this happening in these Catholic and other hospitals. But Google is providing them these doctors with some recommendations about treatments and diagnoses as well.

Jim Polito 9:00
Okay, well wait a minute. We're talking with our good friend Craig Peterson. And you probably heard in the news about Google and this foray into medical records. All right. Look, I know someone whose son is working on a research project, and it's in relation to breast cancer. And it involves a giant cloud calculation of putting in data of all of these different people who had breast cancer diagnosed with breast cancer. And, and the mission is to find out something that was common at the time of diagnosis and what was different prior to diagnosis. Basically, what they're looking for is what was the switch that was thrown that started this cancer, okay, so then massive amounts of data, and I get that. But that data is all protected from matching it up with an individual. I mean, many of these individuals could be dead. This is a massive amount of data. I get that, Craig, but I'm worried about. And I don't have a problem with Google and other big, big firms working on this. What I do have a problem with is, how do I know this is protected? How do I know this isn't going to be used against me?

Craig Peterson 10:35
Well, one only needs to look at the NIH to get an answer to that question. Of course, you know what that is?

Jim Polito 10:43
Yeah, is that in Canada.

Craig Peterson 10:44 
No. That's The National Health Service over in the United Kingdom, okay. Yeah, and this is socialized medicine. And in all of these countries, they have death panels, and they're trying to Figure out, is it worth spending any money on this patient? Basically, if you're under 10 years old or over 50 years old, the answer to that question is no. But here's what they've done over in the UK. They have taken this type of data now. And they're using computers to determine whether or not they should just let you die. Literally, let you die. Yeah, if they should treat you at all. That's where this ultimately leads. I love the idea of, you know, having this robust data set, improving outcomes, reducing costs, saving lives, that's what they really want to do. That's why the Catholic Church and ascension got into this. Ultimately, this is for the good. But Jim, this is another example of the government telling us that HIPAA is going to make our information more private, safer, and is done the exact opposite. None of these things People had to opt-in. None of these people were even notified that it was happening, let alone a chance to opt-out of it. Okay. And that's where some of the problems come in. And when you're talking about this massive amount of data, you talked about the anonymizing that happened, yeah. So you can identify an individual in this case, obviously they could, because thinking the names and addresses, but even with anonymized data, where all they have is a number associated with the record and no other information like your name or address, it's been proven again and again, that it can be D anonymize very, very easily in most cases. So we'll see what happens. But the President of Google Cloud came out with a statement and, and you know, bless these guys, they're trying to do the right thing. But Google just you know, this whole deal to buy bit fit. We're now giving our instant cardiac readings on Exercise readings are sleep readings, everything else to Google Now. And it is starting to show up in our employment records and in and in the socialized medicine component countries. It's helping to decide whether or not they're going to treat you. Not just how to treat you.

Jim Polito 13:19
All right, Craig, this is great information. I know you have a lot of other stuff, but I wanted to focus on this. I know that if folks text My name to this number, they can get that information.

Craig Peterson 13:34
855-385-5553 I'll send a link out to this article today. But txt to 855-385-5553

Jim Polito 13:19
Standard data and text rates apply. And Craig Peterson will not annoy you. He'll get you this information. And other great stuff. Craig, thank you so much. It was very helpful and we will talk to you next week.

Craig Peterson 13:58
Thanks again, Jim.

Jim Polito 13:19
Right. When we return something incredible.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

Welcome!

I was on with Jack Heath on NH Today this AM and I talked with him about Shipbuilding and how ships have been built since the 15th century.  That may sound like old tech but there are lessons that we can take in the high tech sector that will help us be safer. So here we go with Mr. Heath.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

Not If, But When -- Don’t Think You Are Not A Target 

--- 

Automated Machine-Generated Transcript:

Jack Heath 0:00
Here is Craig Peterson with a high tech or Tech Talk check-in Good morning, sir Craig, how are you?

Craig Peterson 0:06
Hey, good morning.  That was good news about Kate there. Glad to hear that. That's really kind of cool. Yeah. Yeah. How are you doing? So let's break. Well, I'm looking right now and I talked a lot about this on my show on Saturday, but embracing the chaos. You know, we need to learn something as business people in the government about principles of shipbuilding that we've been using since the 15th century. Shipbuilders expect failure. They expect to have leaks, they expect to have problems run aground, maybe even worse and get hit by one of these world waves. When we're building our networks and our security, whether it be some of the less regulated things like our voting machines, or maybe it's our business our homes, we have to remember that ultimately, breaches are inevitable. We need to kind of embrace this chaos. We have to design things to be able to handle the inevitable failure. And unfortunately, when we're looking at things like our elections right now, the US government is regulating balloons the kids play with more than they are our voting machines that are out there. So we've got to be careful about that jack and, and they put 250 million dollars of Feds just passed the Senate approved a $250. Two and $50 billion spending bill down protected 2020 elections. But both the NSA and the FBI are warning us that, you know, the bottom line is not enough, because we are under attack and our 2020 elections are really going to be heavily influenced by our friends, the Russians and the Chinese.

Jack Heath 1:51
Yeah, they seem to be adept at it. All right, Craig. All right. Anything else on the tech front?

Craig Peterson 1:57
Yeah, real quick here. If people want to check out my site, I've got a really good article on how to detect a phishing site, how to know that your target or what you are, that site you're on isn't real. And another one about the myths of multi-factor authentication In other words, where you can set it up so the website verifies that you are who you say you are when you go to log in, maybe using text messages or something else. Those are both up on Craig peterson.com.

Jack Heath 2:25
All right, thank you, Craig. Craig Peterson, thank you very much for this Monday morning. Get us going on the tech side.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

I was on with Jack Heath on NH Today this AM and I talked with him about Shipbuilding and how ships have been built since the 15th century.  That may sound like old tech but there are lessons that we can take in the high tech sector that will help us be safer. So here we go with Mr. Heath.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

Not If, But When -- Don’t Think You Are Not A Target 

--- 

Automated Machine-Generated Transcript:

Jack Heath 0:00
Here is Craig Peterson with a high tech or Tech Talk check-in Good morning, sir Craig, how are you?

Craig Peterson 0:06
Hey, good morning.  That was good news about Kate there. Glad to hear that. That's really kind of cool. Yeah. Yeah. How are you doing? So let's break. Well, I'm looking right now and I talked a lot about this on my show on Saturday, but embracing the chaos. You know, we need to learn something as business people in the government about principles of shipbuilding that we've been using since the 15th century. Shipbuilders expect failure. They expect to have leaks, they expect to have problems run aground, maybe even worse and get hit by one of these world waves. When we're building our networks and our security, whether it be some of the less regulated things like our voting machines, or maybe it's our business our homes, we have to remember that ultimately, breaches are inevitable. We need to kind of embrace this chaos. We have to design things to be able to handle the inevitable failure. And unfortunately, when we're looking at things like our elections right now, the US government is regulating balloons the kids play with more than they are our voting machines that are out there. So we've got to be careful about that jack and, and they put 250 million dollars of Feds just passed the Senate approved a $250. Two and $50 billion spending bill down protected 2020 elections. But both the NSA and the FBI are warning us that, you know, the bottom line is not enough, because we are under attack and our 2020 elections are really going to be heavily influenced by our friends, the Russians and the Chinese.

Jack Heath 1:51
Yeah, they seem to be adept at it. All right, Craig. All right. Anything else on the tech front?

Craig Peterson 1:57
Yeah, real quick here. If people want to check out my site, I've got a really good article on how to detect a phishing site, how to know that your target or what you are, that site you're on isn't real. And another one about the myths of multi-factor authentication In other words, where you can set it up so the website verifies that you are who you say you are when you go to log in, maybe using text messages or something else. Those are both up on Craig peterson.com.

Jack Heath 2:25
All right, thank you, Craig. Craig Peterson, thank you very much for this Monday morning. Get us going on the tech side.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

I was on with Jack Heath on NH Today this AM and I talked with him about Shipbuilding and how ships have been built since the 15th century.  That may sound like old tech but there are lessons that we can take in the high tech sector that will help us be safer. So here we go with Mr. Heath.

These and more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

Not If, But When -- Don’t Think You Are Not A Target 

--- 

Automated Machine-Generated Transcript:

Jack Heath 0:00
Here is Craig Peterson with a high tech or Tech Talk check-in Good morning, sir Craig, how are you?

Craig Peterson 0:06
Hey, good morning.  That was good news about Kate there. Glad to hear that. That's really kind of cool. Yeah. Yeah. How are you doing? So let's break. Well, I'm looking right now and I talked a lot about this on my show on Saturday, but embracing the chaos. You know, we need to learn something as business people in the government about principles of shipbuilding that we've been using since the 15th century. Shipbuilders expect failure. They expect to have leaks, they expect to have problems run aground, maybe even worse and get hit by one of these world waves. When we're building our networks and our security, whether it be some of the less regulated things like our voting machines, or maybe it's our business our homes, we have to remember that ultimately, breaches are inevitable. We need to kind of embrace this chaos. We have to design things to be able to handle the inevitable failure. And unfortunately, when we're looking at things like our elections right now, the US government is regulating balloons the kids play with more than they are our voting machines that are out there. So we've got to be careful about that jack and, and they put 250 million dollars of Feds just passed the Senate approved a $250. Two and $50 billion spending bill down protected 2020 elections. But both the NSA and the FBI are warning us that, you know, the bottom line is not enough, because we are under attack and our 2020 elections are really going to be heavily influenced by our friends, the Russians and the Chinese.

Jack Heath 1:51
Yeah, they seem to be adept at it. All right, Craig. All right. Anything else on the tech front?

Craig Peterson 1:57
Yeah, real quick here. If people want to check out my site, I've got a really good article on how to detect a phishing site, how to know that your target or what you are, that site you're on isn't real. And another one about the myths of multi-factor authentication In other words, where you can set it up so the website verifies that you are who you say you are when you go to log in, maybe using text messages or something else. Those are both up on Craig peterson.com.

Jack Heath 2:25
All right, thank you, Craig. Craig Peterson, thank you very much for this Monday morning. Get us going on the tech side.

Transcribed by https://otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

Today there is a ton of stuff going on in the world of Technology and we are going to hit a number of topics from being aware of fake sexual harassment claims being used to mask malware to the advantages and disadvantages of future military technology, and why everyone should be using multi-factor authentication -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

Don’t Take The Bait - Fake Sexual Harassment Claims

Can You Detect A Phishing Attempt?

Vulnerability in Popular Anti-Virus Program

Bots Losing Panache as Cybercriminals Hire In Third World

Not If, But When -- Don’t Think You Are Not A Target

Big Tech Has Your Private Medical Records -- Through Hospital Partnerships   

Future Defense and Military Tech

Best Practices in Authentication Still Mostly Ignored By Businesses

---

Automated Machine-Generated Transcript:

Craig Peterson 0:05
Hello everybody! Craig Peterson here. Welcome. Welcome, you are listening to me on WGAN and online at Craig Peterson dot com. Thanks for joining me. Today we are going to be talking about some of the most important things that are happening in technology as we do every week and more particularly what's going on in this security realm. We'll talk about how you can detect if it's a phishing site that you have gone to, New malware from TrikBot here, a brand new one. Some complaints here about McAfee. Every piece of anti-virus software McAfee makes has vulnerabilities. We'll talk about that major, major security problem. We've got an accounting fraud here and how it's getting harder to detect and Why we have breaches? You know, I talked to so many people, I have a lot of customers, a lot of business customers. And they're sitting there saying, Well, you know, this is all inevitable. So what should I do about that? We'll talk about that. Google, you might have heard of project Nightingale. We'll get to that today as well. Defense firms are on track to make some very, very scary hardware. We'll talk about that as well as some of the myths of multi-factor authentication. And there are a lot of myths out there about all kinds of this security stuff, frankly, but let's start with our friends at Microsoft. I bet you thought I was going to say Apple, didn't you? Well, we had a big patch day, Patch Tuesday, and it fixed 13 critical flaws this week, and one zero-day vulnerability. Let's start by explaining what a zero-day is. In this case, we're talking about a zero-day attack, which refers to a vulnerability that is undetectable by any current antivirus software or anti-malware software that has seen this particular problem before. Now you noticed that made a difference a distinction between anti-virus and anti-malware, right? Because anti-virus software behaves in a certain way. Anti-malware behaves well, frankly, a little bit differently. So what are the pros? What are the cons? What's the difference between antivirus and anti-malware? Well, as a general rule here, anti-virus is a subset of anti-malware. Anti-virus is something that we're doing now will probably continue to do forever. Still, it does not catch me. Most of the nastiness that's out there today, anti-virus is you know, at best release Some people would say zero percent effective, but I give it the kind of the benefit of the doubt. And it's about 20% effective. So if you have antivirus software, it's only useful about 20% of the time against all of these different types of attacks, it's probably close to 10%. If you pull in the human element into all of this, anti-malware software behaves a lot differently than antivirus software. Some of it is whitelisting, where it knows this is a legitimate piece of software that was not modified. So it allows it to run that on one side. These are quite difficult to keep up to date because you have to continually monitor what's going on in what the software upgrades are. What the checksums of that new version of the software are, their libraries, are they all legitimate all those DLL files and everything else they're using. It gets pretty darn complicated from the whitelist listing side. And there's a couple of companies that do whitelist. Some of them, frankly, do better than others.

Craig Peterson 4:07
Some of them, in reality, isn't even really doing whitelisting when you get right down to it. And then there is the next level up, which is the anti-malware software. And anti-malware is software that looks at the behavior typically of what's going on. And there are there's software out there right now malware this designed to fool the anti-malware software to so it looks at it and says, Okay, this just installed Wait a minute, started opening a bunch of files. Wait a minute, is writing to a bunch of files. Wait a minute, and it's changing all these file names. That's the type of behavior that would be typical of ransomware. Good anti-malware software looks at the behavior of a program as it is opening all kinds of part the TCP/IP packets, that are trying to use a network to get to all of these other computers that are out there on the network. What is it doing? How is it doing? Why is it doing all of that? That's good anti-malware software. So it will do all of that it looks at checksums, it looks at just all kinds of things. And it typically has about a 10% performance penalty on your computer, and it can be a little bit higher than that. But it's they're busy looking at everything, examine everything trying to figure out what to do. So we have anti-malware software out there, as well as anti-virus. Those are the two significant types of software you'll put on to your computers. And frankly, anti-malware like well we use has multiple layers of software, and it ties into external databases and, and Cisco Telos to get updates and everything else. So that's what we use us what we do. So, in this case, we're talking about a zero-day Hack against some of this Microsoft software. So what does that mean? Well, that means that we're as of right now, none of the antivirus software knows how to detect this as a virus, none of it. That's zero-day, it's day zero. So tomorrow will be zero-day plus one, right? So day one of this out in the wild. And Microsoft, with their Patch Tuesday, decided they would plug 73 security vulnerabilities in their software products, including 13 of them, given the top level of a critical security vulnerability. And I guess it's kind of fortunate that this month only one of the flaws is known to be exploited. And this is a CV, that's what they're called that scripting engine vulnerability and Internet Explorer, and the sooner they get rid of Internet Explorer entirely, the better off everybody lives. Everybody's lives will be IE; they built it into the kernel so that they could have more control over it. You might remember the lawsuit against Microsoft saying, Oh, you can't ship a web browser that's integrated right into the kernel. Because now, you make it so that none of the other web browsers can work on internet XP on Windows, which was right in the very beginning. And you're blocking us out of there, and thereby it's anti-competitive, you know, it's all true. Now, IE because it's inside all these versions of Windows, these vulnerabilities can affect users who are no longer even using Internet Explorer at all. In other words, you don't have to launch the browser. You don't have to go out to the internet. You could get nailed on it right away. Okay. Now Microsoft Office is using the same rendering engine that has this vulnerability that internet access Laura has, and it can be embedded and in fact, triggered by an active x control on a booby-trapped web page. Active x is one of the worst things Microsoft could have ever done. It's right up there with some of the vulnerabilities and flash and Java. You know, are you kidding me you allow a web page to run code on a machine. And they at least they have markers on it, but it can be Mark now was safe for installation. The whole thing's crazy. I still don't understand Microsoft, and what they're doing here.

Craig Peterson 8:36
So bottom line, make sure you do your update. I checked right before I went on air, and there aren't any significant problems that have been found with the updates here for November from our friends at Microsoft. They're often are. We also had this week, and some more patches come out from our friends, my friends, and yours from Intel. Now Intel makes a lot of the computer chips that are inside our computers, mainly for using a Windows machine. But Macs use Intel chips to, although they don't have to, I don't know why Apple went with Intel, you know, my guess was it was less expensive. And Intel also had some outstanding power performance numbers saw, you know, I can't blame them. But we have a bunch of patches that came out from Intel, that make all of their CPUs almost every processor they've made in the modern era is entirely vulnerable.

Craig Peterson 9:39
And that's a terrible thing, including vulnerable not just on your desktop, but vulnerable in all kinds of operating systems and data centers. So, if you think hey, listen, I went ahead, and we moved all of our stuff to the cloud. They are just taking care of because it's in the cloud. Microsoft knows what they're doing. The answer to that is, well, they kind of know what they're doing. But they're stuck with this Intel vulnerability. There will be more patches coming out according to the people that found these vulnerabilities in every model of Intel CPU, Major, major, vulnerabilities. According to these people, there are more than Intel hasn't passed on yet for whatever reason. It's really, it's kind of crazy, frankly. So we got Microsoft patches for some major ones. This week. We've got Intel patches, some major ones this week, we've got Adobe patches that are out as well. So make sure you do the upgrades. I'm not going to go into all the details here. Man Adobe light set of patches this month only 11 security vulnerabilities from Adobe and Adobe Bridge, animate illustrator, and Media Encoder. Two months in a row where there are no patches for Flash Player. I'm not sure what that's about if they keep happening with flash player or if something else is going on. All right, stick around. We're going to be right back. You, of course, listening to Craig Peterson here on WGAN, make sure you visit me online at Craig Peterson dot com. We've had a few pop-up-trainings already. I'm doing some Facebook Lives and getting information out, and you'll only find out about them if you're on my regular email list. Craig Peterson dot com slash subscribe, and all of today's articles are up there as well. And there's a sign up right there too. So make sure you sign up to find out about all of the latest that you need to know. Craig peterson.com, when we come back, we're going to talk about chick bought something new going on out there trying to get us to do something we just shouldn't be doing. Stick around. We'll be right back.

Craig Peterson 12:02
Hey, welcome back, everybody. Craig Peterson here, little beach music. I was out for the last week and a half out at a conference in Phoenix, Well I guess isn't exactly near the beaches is it, but it was sure nice and warm. And then I got back home, and you know what's happening up here in the northeast? Yeah, a little bit of cold weather. Some of it's a little too cold for my liking. You know, it just came on so fast. We were like in the 60s and 70s. And then all of a sudden it's like the 30s and 40s. I don't know what's going on. Well, let's talk about this TrikBot. It is a new malware that's out there. I've spoken to many times here on the show about what the FBI has been warning businesses, which is the business email compromise. You probably heard of that before bc we're talking about something that's cost businesses. Well over 10 billion, I think it's over $14 billion now. And we're not just talking about a little waste of time. No, we're talking about these guys and gals going right after our business bank accounts. And the way they do it is they're kind of sneaky about it, they get and get you to, to basically for the money, right to wire the money to do other things that are going to hurt your business. You may not realize it at the time, and they're just trying to fool you. Right. So how do you fool someone? And I know I know you can't fool an honest man. I've heard that so many times in the past, and there's a lot of truth to that. But here's what they're starting to do now. And you might have gotten one of these. I have had several listeners reach out to me. I and quite a few saying hey, I just got this email chain that, you know it's it's got a video of me visiting this, this nasty website out there right so you guys are probably heard about that one before it's been around a little while. Well, now what's happening is they are sending an email that appears to come from the US Equal Opportunity Commission. This email is saying that wait a minute here, and we have a sexual harassment complaint against you. Now I understand as a business owner, how this can be kind of crazy. And I owned a building, a business office that I had my business running out of, little more than 20 years, maybe a little longer. Ago now. And that business office, I put in doors, and all of the doors were floor to ceiling glass because I didn't want anybody saying that I was harassing somebody or doing something illegal. Now, of course, I, you know, we didn't have microphones and cameras and things. But I just wanted everyone to feel reasonably comfortable that no one was going to corner anybody. And, you know, I think I was kind of mostly successful about that one of these days or forever sitting down having a beer, you might want to ask me what happened there. But anyway, this is something called Trikbot, and it's a banking Trojan. And it's going after employees of large companies. And it's trying to scare these employees into thinking that the US equal Equal Employment Opportunity Commission EOC is coming after them. And they are trying to get them to and are being reasonably successful in having them handing over sensitive information. And they're using a bunch of different social engineering techniques, including malicious payloads or redirecting them to fraudulent sites they control by emails that look like coming by somebody they trust, etc. Okay? Now, these spearfishing emails, and I'll read you the text in one here in just a minute here. But they, what they end up doing is dropping a malicious payload on to your computer. And as part of this campaign, these malware operators use the information they've collected from people, such as their names that company they work for job titles, phone numbers, to customize these phishing emails to make them a lot more convincing. Now think about your business and your business's website and other information that you're making available to the public. Digital website has, who the officers of the corporation are.

Craig Peterson 17:04
Now I know that all of us for our businesses, we have to file with the state chapter file with the IRS and various other things. But when it comes to the state, those records tend to be public. So people can go online, they can find out who the President is, who the officers of the corporation are, who the Registered Agent is, etc., etc. Right? And so now a bad guy can go online and find out almost anything they want to find out about a smaller company because it's right there on the website. Now is that easy or what? Now let's go into one of these pieces of email. Everything from the email subject This is from bleeping computer dot com. Everything from the email subject and the message content to the malicious attachment. Each of these mouse spam email Males comes containing the potential victim's name. Now I'm looking at it here. It's got a form, and it seems like it's legit. It has the logo of what I assume is the US Equal Employment Opportunity Commission because it looks official enough to me, and the title at the top is the U.S. Equal Opportunity employment commission harassment complaint. Then the complete submission of a complainant form has initiated an intake interview with an EOC officer. Okay, this is what they're sending out right now. It looks very, very legitimate. And they use the name of the victim with a grievance raised against you. That's a subject for each of the phishing emails, and they're trying to get you to pay attention. They also have a customized email body to instill a sense of urgency. So it'll say, dear name of the victim, private and confidential. One of your co-workers has lodged a complaint with the EEOC. Now on top of it, all the malicious attachments, drop TrikBot payloads also have customized names. And again, it's the name of the victim-dash harassment complaint letter, and it's got a phone number on it. The entire purpose is to get you to open that attachment. And by adding this personal touch to the phishing emails, they've been increasing their chance of people opening them. Now, you know, I do a little bit of marketing for some of the courses that we offer and, and for some of the other services, you know, like the security services that we offer the businesses, so I've studied some of the marketing stuff that's out there. And I can tell you right now, most people, if you get an email that looks like that are not opening it. If you're concerned about a particular email and you have listened to my show for the last 20 plus years. You're very, very worried about it and legitimately so.

Craig Peterson 20:10
So I'm not sure just how effective this is, you know, spam emails right now have an open rate of about, well, it's less than 1%. Legitimate emails have an open rate of, you know, as much as 15 to 20%. So I don't know how well they're doing. But when they're sending out 10's or hundreds of millions of emails, we're talking about some pretty darn serious stuff here. A lot of potential victims. These are highly targeted and regularly updated. That goes into some of the problems with antivirus software we will talk about later on. And that is if it hasn't seen that before, it's going to get tricked. This spear-phishing campaign delivers the malware payload. It's evolving. It's a banking Trojan. The purpose is to get you to give some banking information out. And apparently, it's been pretty successful. By the way, it's been in the wild since October 2016, one of the most aggressive pieces of malware that are out there right now. Stick around. When we come back, we'll be talking about McAfee's antivirus software and what's going on with that. Especially as it relates to some of the malware that's spreading out there in the world, right now. Make sure you are on my email list. So you keep up to date with everything that's going on. Craig Peterson comm slash subscribe. I'll let you know about the pop-up-trainings. I want you to pay close attention because I'm not going to hound you about this stuff. And we've had a lot of people attending them. They're free. Usually, they have two-hours worth of content and questions and answers. Stick around. We'll be right back.

Craig Peterson 22:05
Hey, everybody, welcome back. Hey, did you see this? It was an announcement by one of the investment firms saying that Tesla might be missing the boat when it comes to electric cars? You know, we've all thought Tesla was the leader in the in that isn't so many ways right and built their battery factory. They've been just doing all kinds of amazing things, but it looks like they might be losing a little bit of an edge when it comes to the overall electric car business. Because now you've got Ford and GM, the major US manufacturers, I think Chrysler as well. I know Ford and GM both have some major stuff going on, as well as the Japanese firms like the Nissan LEAF. That's been all-electric for a long time, although Nissan stops making the thing some of these us manufacturers are definitely in the middle of it all. And you probably heard me a couple of weeks ago talking about some of the real risks when it comes to Tesla electric cars, particularly in the event of an accident. It's a scary thing. Frankly, it's a frightening thing being involved with the MS for all of those years to think about it. Well, we spoke a little bit in the last segment about this TrikBot malware using fake sexual harassment complaints as bait. We started off the hour talking about Patch Tuesday, and 13 critical fixes for Microsoft software, this critical fixes out for Adobe software, you got to apply these patches. According to the stats I've seen. There are, on average, about 65% of Windows computers that do not get updated at all. If this is you if you're one of those people, I urge you to spend a few minutes, let's make sure that the machines are updated. I know some people that say forget about it. I'm just going to replace my computer when it's just so far out of date. I know some people have done that with cars, too. I had a good friend I haven't talked to in years. But he was telling me that his dad did the math, back in the day, many many years ago. His dad did the math, and he figured that if he paid for oil changes throughout the life of an engine just wasn't worth it. So he said, Hey, listen. What did an engine cost back in the day it was a couple of grand for a boxed engine, and he was a mechanic he could quickly put in a new engine. And if I pay for oil, filters and my time to change the oil
I will pass the break-even point at about 30,000 miles. So, in 30,000 miles, it was cheaper to replace the entire engine, than to pay for years of oil changes. Can you imagine that? So I did some quick mental math, and I agreed with him. He said, Listen, it's not as though I don't have oil in the engine. The engine will run off this known oil in it. But all I do is add oil when it needs oil added, and he never changed his oil. And at about 50 to 80,000 miles, you'd have to replace his engine. So he figured he was ahead of the game. Nowadays, with these new engines and filters and oils and the oil is just so thin. Nowadays. They're saying 10,000 miles give or take between oil changes, so it's not anywhere near as bad. Plus, some of the cars today will tell you, hey, I know Need an oil change? So you don't even have to keep track of the miles, you know, used to be 3000 miles. Do you remember you might not be old enough to remember, but the oil did not have the cleaners in it now, nowadays they have been detergents because your engines would get all sludgy? And what a mess ever take one of those apart, even just the head of the engine, the mess that was in there, we don't have those problems nowadays. Well, some people have taken that whole idea of, hey, it's cheaper to change the engine than it is to change my oil. They've taken that to the extreme. But you know, it is not like that when it comes to computers. You can't just have the laptop sitting on your desk or under your office and leave it there for years to come and say, Hey, listen, when it breaks down, I'll replace it. I'm not going to bother doing upgrades of my software won't work because it's running Windows XP, or whatever some old version of Windows, I'll go out to one of these, big-box retailers, and buy another computer and throw this one away.

Craig Peterson 27:14
That is a very, very bad idea.

Craig Peterson 27:16
And I suspect that's where some of the 65% of people come in, that are not maintaining their computers. Now you have to keep them because unlike your car, your computer is continuously under attack. So, that means you have to not just upgrading and updating windows but all of the software that's on your computer. You know, I talked a little bit earlier about Internet Explorer, and only Internet Explorer alone having it on your computer will cause other programs on your computer to get infected and allow hackers access. It's just plain old, not worth it. Well, let's talk about Anti-virus doctrine. Oh, you remember I said antivirus software? Yeah, I convinced myself that it's, it's about 10% effective at no more than that guaranteed. And we can go through all the numbers again, if you want to buy me a beer sometime we'll sit down and go through all the numbers, and how virus software does not work.

Craig Peterson 28:19
Well, Let's talk about some software that doesn't work. McAfee antivirus software. In an article from ZD net, has a code execution vulnerability, a severe security flaw that can bypass the self-defense mechanisms built into McAfee antivirus, very, very big deal. Safe breach labs, their cybersecurity team. It is one of the groups that go around and test software, tries to find vulnerabilities, and then lets the manufacturer know so they can take care of it. But they're saying that this particular vulnerability can be used to bypass McAfee self-defense mechanisms and could lead to further attacks on a compromised system. Now, this vulnerability exists because of a failure by McAfee's programmers to validate whether or not these DLL's it's loading have been signed, let alone appropriately signed. Remember, I even mentioned that in the first segment today. These self-defense mechanisms are essential, and they need to be in place, even though the antivirus software is going to be at best 10% effective at least you would have 10% effectiveness right. So because they can bypass the self-defense mechanisms and leading to further attacks on a compromised system. It needs to get fixed right away. See an arbitrary unsigned DLL that gets loaded into multiple services that run is NT authority, backslash system.

Craig Peterson 30:06
Now, the only good news is that attackers need to have administrative privileges to take advantage of it. However, I rarely walk into a business where everyone isn't running with, with, frankly, administrative privileges. The companies do that, and I understand why they do it. It's a bad thing to do should never do it. Right. But I know why they do it. They do it because, oh, it's just so much easier if I have to install software right or to call the IT person. And the IT person is the Assistant to the owner. And she's always busy. He's still running around doing stuff. I don't have the time, and I can't keep asking for permission to do things. So, everybody gets administrative authority. There are three main ways and which is why vulnerability gets exploited according to the Safebreach lab. Anti-virus software might not detect the binary, and it loads it without any verification against it. Impacted software includes McAfee total protection, anti-virus plus AVP from McAfee, and Internet Security up to and including the version 16.0 point 22. You must get the latest software. So, if you have McAfee update, pronto. And as I said, you should update, anyways. And don't use antivirus. I recommend getting a robust anti-malware stack of software.

Craig Peterson 31:39
So what are people doing? Vendors doing? They're just renaming their stuff is anti-malware stacks. Yeah, yeah, that'll fix the problem. Your listening to Craig Peterson on WGAN stick around. We'll be right back.

Craig Peterson 32:02
You know, it's funny how you get used to the weather, whether it's hot or cold. You're listening to Craig Peterson here on WGAN. And online at Craig Peterson dot com. You'll find my Facebook page by going to Craig peterson.com slash Facebook. And I've started posting some stuff up there. Well, I do that actually, every day. My wife is the one that's putting the articles up that I come up with every week, every day. But you are also starting to find I'm doing Facebook Lives and YouTube lives, and just you know, I'm getting a little better at some of this stuff. And there are a lot of possible angles here. By the way, you know, I mentioned I was at this conference, and I was learning a little bit more about marketing and product development out there. Product development is what I kind of love doing, Right. We can do it quickly. We know what we're doing. We know how to do it. So we're trying to figure out how can we produce a very inexpensive product that is going to help a lot of people when it comes to security. And I think we've got the answer. I don't want to be, you know, mean and nasty about this, but we're working on it. And we should have something in a couple of weeks from now, that I think is going to change lives. I think this is going to be earth-shattering. If we do this the right way, it is going to change everything for anybody that decides that this is for them. So we'll be talking about that in a couple of weeks from now. But it's an idea from another industry that in fact, it's the tennis, tennis training business, and I think it's like the world's most perfect idea. Here when it comes to us, so we'll be talking more about that. But you can find that you can find information on the articles that I have every week, you can see all of that stuff you can find out about the free pop up classes, the pop-up-trainings that I've been doing, you can find out about some of these Facebook Lives and YouTube Live. All of these are free training. I'm just trying to get this information into your hands. You know, the Whats, the Why, and the Hows, all of that stuff. And there's only one way to get it. And that is to sign up, go to Craig Peterson dot com slash subscribe, and I will make sure that we send you every week just a quick summary of the stuff that's going on. I'm going to have a special sign-ups for these pop-up-security-trainings, So no, I'm not going to send you a lot of emails unless you ask me to write by default. We got a great article from Joan over at darkreading.com. Dark reading dot com is one of those websites, one of many to which I pay quite a bit of attention. They do have some great, great content. In this article, they're talking about fraud and how it has changed. You, I'm sure, are familiar with our friend, the Nigerian prince, and all the things he did and how he tried to get his money out of the country. And all he needed was to use your US-based account, and you could keep some of that money. You remember that right then, it's just full of misspellings. It was just terrible, and there are reasons for the misspellings, there are reasons for the way they do things. No doubt about it. Well, things have changed. Now economics have changed. And they are swamped, making a whole lot of money. And they're doing it in different ways. They've done it before. You know, we've got tools now to detect and mitigate some of these attacks. And the easiest way to do that we have some software that all the email flows through, and it's looking for patterns look, make it look like it's a bot that sending out these emails. And when we put those this particular filter in place, in fact, it's and AI bought itself. That right the Battle of the AI that's coming to, but you know, the amount of spam these things dropped by 90 plus percent. It's just it's dramatic, how much it helps.

Craig Peterson 36:58
Well, what has happened now is the bad guys have found that labor is getting cheaper and cheaper in some of these developing nations out there. And they're able to get people in Venezuela, for instance, where they are starving to death where they are picking through garbage because of their socialist government. And man, I saw this thing the other day, it just shocked me, they were using a sharpie to write on people's forearms a number, so they knew when they could get food. Yeah, when they could get food from the grocery store. That's how bad it is in Venezuela. So you have to wait in line. You have to obtain a number one thing. God is not a tattoo. It's a sharpie, but you have to get a number there on your forearm, and then you can get Food. And if you can't wait, and if you don't get enough food for your family, you're going to have to go through the garbage. It's just absolutely insane. Well, cybercriminals are hiring workers in Venezuela now, where the hourly wage has gone way down compared to other currencies. I am not sure if you remember, but Venezuela used to be the wealthiest nations in Central and South America by far and is now one of the poorest countries in the world thanks to their socialist government. Well, the hourly wage is so low that it now makes economic sense to pay people to manually carry out the fraud to write these fraudulent emails to research to get the stolen account data instead of using bots like they have been doing before. So, here's a quote straight from the article. "attackers are giving people a script and saying here's a quota you have to hit, criminals are always trying to figure out what is the lowest hanging fruit as merchants and companies evolve with defenses, these attackers evolved, humans just happened to have become the flavor of the month." So, these human-driven attacks are increasing quickly and exponentially. Now, the most recent fraud report that came out covering q3 2019. So. just this last month, found that attacks carried out directly by humans, both loan perpetrators who are trying to get money to support their families in third world countries, and organized criminal groups increased 33% over the previous quarter, nearly one in every five fraud attacks are manual now rather than automated.

Craig Peterson 39:57
Now, of course, their goal is to look as legitimate as possible. Having humans involved does increase your chance of success. And so many people worldwide speak English because English is the international language of business. And it's causing a problem. This quarterly report that came out from our coasts looked at 1.3 billion transactions spanning account registrations, logins, and payments in the financial services, e-commerce, travel, social media, gaming, and entertainment industry's overall fraud increased 30%. In q3, and bought driven account registration fraud is up 70% as cybercriminals test stolen credentials, in advanced of what in advance of the US holiday season. Isn't that amazing? But now every third attack on financial services is manual. Attacks are coming from fraudsters now with access to stolen identity information. They're using the latest tools. Over half of the attacks that originate from Russia and China are now human-driven. It is changing everything. The data highlights that the entire attack incentive for countries across the globe is economically based. We've got some substantial economic things happening here in the US. If a nation's currency is worth only a fraction of the US dollar, then the incentive of a criminal in that country to defraud an American business
is very high, because they've got that multiplier based on the value of their currency compared to the value of the US dollar. So, it's incredible what's going on. You've got to watch it. You got to be careful that There are a lot of bad guys out there that are looking to get their hands into your accounts. And we've got this shopping season right in front of us now. So what I would suggest to everybody is, check with your bank, depending on your bank, some of the banks and doesn't matter if it's visa or if it's MasterCard visa sent tends to be pushing this a lot more than MasterCard is. But whether it's Visa or MasterCard, you're going to find that they have virtual card numbers that you can use. And the idea behind these virtual card numbers is that you have a one-time card number that you can use when you are buying something online. So, instead of having your regular credit card number that you're using, that's sitting there in a merchant database, that may or may not be configured appropriately or secured. Remember, a secure server doesn't mean that their servers secure; it just means that your data going to it is protected in transit. Instead of giving them your real credit card number, and having that stored in a potentially insecure database, now all you have to do is give them that temporary credit card number. Go to your bank, and you can usually check on the website before you start buying stuff online for Black Friday. And we're going to have some Black Friday deals to or Cyber Monday, or you know, whatever it is for Christmas, for Hanukkah, for whatever you're celebrating. We have birthdays to over this holiday season. Get your bank to give you access, and this will be online access to get a different virtual credit card number every time you do a transaction online. It's cheaper for them to do that than It is for them to issue new credit cards when compromised or stolen. It keeps happening. All right, stick around. We will be back. We got one hour to go. We're going to talk about Google's project Nightingale and see if that's scary enough for you. We are concerned here about some of the defense firms, multi-factor authentication. I will run through how you can tell right what's the best way to do it. And how to detect a phishing site. We'll get to all of that. In the next hour. You're listening to Craig Peterson on WGAN and online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 44:52
Hello, everybody, Craig Peters on here on WGAN and online at Craig peterson.com. Hopefully, you join me there and sign up for my email list. I get you in my newsletter. You can do that by just going to Craig peterson.com slash subscribe and subscribing to my newsletter. Every Saturday, we are here and talking about some of the latest in technology and security. The things that frankly you don't hear about, at least not the right answers in the general media out there. It's just amazing to me how many things they get wrong, again and again, and again. I try never to attribute to malice what can be easily attributed to incompetence. Is that a terrible thing to say about some new people in the media? You know, if you get right down to it, they have so many things that they have to know about and be semi experts on to write some of the articles, so I guess I really can't blame them for well for least Some of that. Well, let's talk about the chaos here for a couple of minutes. We are in the new normal. Now I'm not talking about with President Obama said the new normal was, which is people high, you know, unemployed, high levels of unemployment and stagnant economy and stuff. I'm talking about a recent survey that was conducted by a security company out there that showed that 86% of 250 top security officials who participated in this survey believe that cybersecurity breaches are inevitable. Now that opens up a whole can of worms because it's unavoidable, does that mean there's nothing you can do about it? I think by definition, it does. It is inevitably going to happen no matter what you do. So why do anything? Many people have done nothing. Remember, in the last segment, and if you've been listening in the previous hour, I talked a little bit about how 65% or so of computers never were upgraded. That's, that's a bad thing, right? And nowadays, when we get right down to it, and we're talking about these 250 professionals, people that know what's going on. We're talking about people who realize that the complexity of today's cybersecurity in businesses makes it so that it's almost inevitable. Now, when we think about cybersecurity, and we're thinking about companies. Obviously there is some truth to this for home users and, and that's why we did this security summer you know, I had that hundred and 50 pages of cheat sheets that we gave away to everybody. Who participated in this. And it was designed to help you understand what you had to do in different circumstances. And hopefully, you got all of those I start, you know, they were all sent out well, by the end of September, because, you know, summer doesn't end until September 21. So I little extra time as my team and I delved into that labor of love out there. But there are a lot of pieces moving parts to this puzzle, and it makes it very, very difficult. Nowadays, we're making our lives even worse because of cloud adoption. We're using cloud services. We're using hybrid environments spread across physical machines, different locations, different teams, various cloud providers, and now businesses are using something called containers. I remember when I first heard about them, I was thinking about, well oil container on Okay, so we're talking about the types of things you put on a truck and then put on a ship right or, or you can rent while you are making the improvements like I did in my kitchen.

Craig Peterson 49:11
I got one of these little containers, one of these small pod containers, and loaded it up with all of our stuff while we were working on it. Yeah, that's not what the containers at the businesses are using. These dedicated containers perform a specific purpose, like running a website, or a database or something else. It's just getting very, very difficult to keep track of it all. And frankly, that's why we're seeing some of the major breakdowns. Now we do not see in these in breakdowns like Equifax. What was that? It was, Oh, yeah, a username of admin with a password of admin rights. Stuff like that is just plain old, stupid, but because of everything so complicated and were not tested thoroughly, they broke in. Now, if you are in a business-like, for instance, a shipbuilder, you are thinking about failures. Because if you're out in that open ocean and you get a rogue wave that comes in, hit you on the side, your ship is going to flip over. Now obviously, you don't want to name your ship, Concordia. Another one just ran aground this week over Norway. Of course, the big Concordia running the ground was in Italy, and what a mess. But shipbuilders realize that ultimately, ships are going to fail. There is going to be that rogue wave, or it is going to run aground or the propulsion systems going to go down. And the extremes are like submarines where you have all the compartments, and the idea is that a breach might occur in one compartment, but the other compartments will not. So we're spending billions of dollars, and we're likely preventing a lot of bad stuff. The number of high profile breaches is just increasing and causing devastating damage to us as consumers. It's going to last for decades. And why? Well, like so many other industries, people in the security business are not preparing to fail. And companies are not preparing to fail. It's like what I teach in my backup course, the three to one backup methodology, and I should do another pop-up-training on that. Frankly, you've got to have multiple copies of backups numerous generations of backups on various types of media, in numerous sites, because of Smith's commentary. Now, you might not be familiar with Smith's commentary, but Smith's commentary on Murphy's Law is that Murphy was an optimist. And of course, Murphy's Law is, if anything can go wrong, it will. So shipbuilders have engineered the systems, they have segments in the halls, they have multiple hulls, double triple hulled ships so that if it's carrying oil or something else, if there is a penetration to the hull, the ship won't dump oil or whatever, into the ocean. It's been done this way since the 15th century. And it's been done in today's modern vessels as well. Even the Titanic had some of these things in place, although it had some other problems. I don't know if you've seen some of the more recent studies, by the way, on the Titanic. It's fascinating. But it looks like what happened was, there was a fire in the Titanic's hold coal fire that they couldn't put out. And they had been smoldering and caused a weakening of the ship's hull. And that's why when it hit that iceberg it tore open. But that's another story here. So let's talk about some principles here security principles that they use in shipbuilding that we need to look at in modern IT. Shipbuilders assume that at some point, the ship will suffer leak. So how do you protect against that? How can you fix that? Well, they create holes that prevent a single leakage from sinking the whole ship. So, in the same way, you have to assume there might be a breach in your corporate environment and segment your network so that it doesn't spread. There's a lot of details we could discuss, and maybe I should do some Facebook lives on these things.

Craig Peterson 53:52
Your staff who's responsible for maintaining the ship's hull is monitoring for leaks. They're watching for leaks, and they're regularly patching. They're painting they're scraping right to get rid of the rust and to make sure that there isn't a major flaw in the ship's surface, or you know, hull, they're trying to keep the ship safe. So, in the same way, our modern security teams have to be vigilant about monitoring and patching. To prevent these cracks in the perimeter, as well as the interior. We just last week had a client who had an internal breach. They were using a VPN to allow our remote office to get into their primary network. That remote office was breached and was used as a launching pad to get onto their primary network. And then once on one machine on the main network that they could breach, they now we're able to spread within the main network. We got to watch this. The ship's most sensitive equipment is in the engine room. And in the tape game you know in the case of a business you got to venture critical IT assets are considered ships that staff lookouts 24 seven to make sure there is a good watch, we need to do something similar with our data. Keeping the crew from accessing the bridge is an important safety measure. We got to make sure that our user identities get set up correctly and their employees, contractors, remote users can only get data they should be getting to. And we could go into attack after attack after attack. But the bottom line is when you're designing your security, you have to anticipate a breach. You've got to patch everything, keep it patched and up to date. And you've got to segment your networks. And if you need to be secure, the newest types of networking are called zero trust networks where nothing can talk to anything else on the network. Unless it's explicitly allowed because we can't trust it. So the very least segment out your Internet of Things devices, make sure your sales guys are on a different network than your accounting people. Right? Break it all down in the business space. When we get back, we're going to talk about us in the consumer world and Google's Project Nightingale, man, is this a scary project, but you know, heck, it's Google, but not can do anything wrong right here listening to Craig Peterson right here on WGAN.

Craig Peterson 56:43
Hello, everybody. Welcome back. Craig Peterson here after the top of the hour. And we are talking about the latest in security and technology. What's going on out there? We cover in some depth here some of the things that you need to understand. Some of these things are specific questions that I've gotten from you. So if you have a question of any sort you'd like me to answer on the air or maybe answer directly, email me. It is ME at Craig peterson.com. I am glad to do it, or you can drop it on my Facebook page. Now I have to say that I get thousands of emails a day. So sometimes it can take me a while to get around to it. So don't feel bad if I don't answer your question right away. But I am pretty good about answering most of the questions that people ask and particularly if you email them me at Craig Peterson, dot com that's so that's what I monitor kind of the most. Some of my team helps you track that too, which is a very, very good thing. Mountain View, California dateline. It is a scary story. And you know, we just had Halloween, but here's what's going on. You might not be aware of it. HIPAA is a law put in place, oh, decades ago now, I think maybe even as much 20 years ago. The most significant part of HIPAA is this whole concept of portability. Now, you may not realize it, the bill was certainly not advertised as being this way, but it is this way. Here's the problem. Before HIPAA went into place, what was going on if you had your medical records, and those medical records had to be kept private, they could not share them with anything and what HIPAA did was. It defined the rules for sharing, among other things. Before HIPAA, your medical records were considered private and kept secret. After HIPAA went into place, your medical records could now be shared anywhere almost in the medical community. And of course, with portability, the idea is, well, you've got your medical records, you want to go to Florida for the winter. So you want the doctors in Florida to be able to have access to your medical records, which is all well and good. It makes a lot of sense. However, other things going on in there still are. If I want the medical records of every patient in hospital x or health plan, why? And I say, Hey, listen, I'm going to buy the company. I'm thinking about buying the company. I'm thinking about purchasing that hospital. The hospital has the right to give me all of your records. That's the bottom line. Scary. And that's been happening. Our medical records have been shared and traded like trading cards. So, one of the largest health systems here in the United States is called Ascension Health. And you might have heard of it before, mainly if you are at all involved in the Catholic nonprofit health system. The Catholic Church has taken care of millions of patients for free, much of the time, you know, no charge to the patient. But the Catholic Church has been behind many of these medical hospitals and medical treatment that has been out there that we have used for generations, frankly, and you know, good on them. It has been wonderful. And they've kept costs under control reasonably right. By right by where I live. There's a Catholic medical center that is renowned in the region for its cardio care. And like many other hospitals that are out there, they will also provide charitable care for those people who can't afford it. So Ascension partnered is with Google Now ascension is, again, the largest health system here in the country. And it partnered with Google. And Google now has access to detailed medical records on 10s of millions of Americans according to a report by the Wall Street Journal, and It is code-named Project Nightingale, I'm sure you can figure out why they call it at night and Gail. And it has enabled at least 150 Google employees to see patient health information that includes diagnosis laboratory test results, hospital records, and other data. Now, remember before HIPAA, man, you could have sued and won if your medical data got shared without your knowledge, let alone your permission. Now, some of the negative results of those HIPAA regulations are coming to light, where the largest health system in the United States, Ascension, shared your medical data with Google. That is a very, very big, big deal. Now, this is reported by the Wall Street Journal, and it's according to internal documents and the newspapers other sources in all the data amounts to complete medical records and contains patient names and birthdates according to The Wall Street Journal. Now, this is a move by Google to try and get a strong grip on the medical business, the sprawling healthcare industry. In November, Google announced a deal to buy Fitbit that has gone through. I'm sure you've seen that. So now, it has access to all the sensitive health data that amassed from Fitbit. How much information have you been giving them? They've got all kinds of health records. They've got what have you put into those things? And we have Google, Microsoft, Apple, and many others competing to get access to all of our medical records and to be the storehouse so that when you go to Florida today, your records are there because you shared them on purpose. Neither Google nor Ascension, according to The Wall Street Journal journal, neither Google nor the country's largest health system Ascension has notified patients or doctors about the data sharing 2600 hospitals, doctors' offices, and other facilities across 21 states and the District of Columbia. So Google's ultimate goal is to develop the searchable cloud-based tool, but here's what I found particularly interesting, and that is about transforming care. In a statement from Ascension, the VP of strategy and innovations, Eduardo Conrato said, "as a healthcare environments continue to evolve rapidly, we must transform to meet better the needs and expectations of those we serve, as well as our caregivers and providers." So what are they doing? Here? Well, it turns out that apparently, they're having the hospitals enter in your data to these healthcare records, uploading them, analyzing them, and helping the doctors come up with diagnosis as well as prognosis frankly. They're hoping to improve outcomes, reduce costs, and save lives ultimately, and you know what they probably will. But the issue at hand here goes back to the HIPAA act of 1996. And should we be able to control our medical records? That's the big question. It looks like the answer to that is no and has been for 30 years. Thirty ish years not quite 25. All right. When we get back, we're going to talk about Rola robots of the killer variety. What is going on with some of these government contractors out there? Man is a scary show, isn't it today well after compensate next week, you're listening to Craig Peterson here on WGAN and Tune on Wednesday mornings at 738 with Ken and Matt, and I'll be online there too.

Craig Peterson 1:06:38
Hey, Craig Peterson here. WGAN. Online Craig Peterson dot com. We are nearing the end of the show here. We only got two more segments together. But that's enough time to cover a couple of these articles I want to get to today. Let's start with this one first here, which is the Robots. You know, I have long been concerned about robots as have many other people. Some people much smarter than I have been very concerned about them. Take a look at what ElonMusk has been saying. That's part of the reason he wants to move us to Mars is artificial intelligence and robotics. Think back wow, even to the like the early 1990s with iRobot. And, and that Russian author, I can't remember what his name was, but it's been a concern for a very long time. Now, things changing rapidly. In an article from QZ.com, a new report is out from Pax, a nonprofit based in the Netherlands that's campaigning for peace around the world. And of course, Pax is the word for peace in many languages, and they're warning about this new potential trend that's coming out. I don't know if you've seen some of these moves. Movies where there are swarms of drones. And those drones swarm in on something. There was a recent one, and I think it was Angel has fallen with Gerald Butler. And the President is tagged by the attack by this swarm of drones. We had the same thing happened. I think it was only one or two drones in South America trying to take out a president down there. Well, our militaries are looking at some of this newer technology to conduct war. And you know, frankly, they have to because the bad guys, the other guys, whoever our ultimate future opponents are, are looking at this as well. China has spent a lot of time on it. And if you look at something like these drones, you could easily have killer drones out there. These drones have to have an ounce of high explosives in them, get close to a combatant, and explode themselves in Kill the combatant. That's all it takes. We're worried about what's being called this third revolution in warfare. The first revolution was gunpowder. You know, you could argue right bows and arrows and various things, but the gun powder was a considerable revolution in warfare. And then you had the atomic bomb, which was not too long afterward. The Chinese invented gunpowder. But now activists and military leaders are calling for international regulations kind of like what we have with the Geneva Convention where we defined how wars get fought. They want to govern all-new weapons systems that have a type of artificial intelligence in them, a type of machine learning. They don't want life or death decisions to be made on their own by these intelligent systems. And they're looking to ban them outright. Key governments, including the US and Russia, have resisted it so far, and I understand right.

Craig Peterson 1:10:18
But what are you going to do? nears we can tell militaries have not yet deployed killer robots on the battlefield? At least offensively? What are you going to do with a robot that makes life or death decisions and gets it wrong or gets it right heaven forbid, either way, where you've got a robot out there that it doesn't have to think twice about pulling the trigger to kill someone because it doesn't think twice about it. It's almost like having some of our troops sitting in Virginia, flying a killer drone in the air that's over a site 5000 miles away. And just pulling the trigger and off that missile goes. That is not a life or death decision made by that missile. That is a life or death decision made by a human that has to pull that trigger. That's frankly a very, very big deal. The big difference between the two. Now this organization called PAX has identified at least 30 Global arms manufacturers that don't have policies against developing these types of automatic life or death, killer weapon systems. And apparently, they're doing it at a rate that's outpacing regulation. Now, this is normal when it comes to technology. I've talked about this so many times. Technology always leads any regulation, and it's still in front of the laws. It's still outpacing the regulatory ability of governments, but we're talking about companies that include Lockheed Martin, Boeing, Raytheon. We've got some Chinese state-owned conglomerates like a Vic cask, Israeli firms IAIL bit Raphael, Roz tech of Russia, Turkey's STM. It is a very, very big deal. So what are we going to do about it? It's, it is a very, very good question and courts are trying to address it. You will see this article if you're interested in it up on my website as well at Craig Peterson, dot com. Still, activists don't believe that the military use or some degree of artificial intelligence is problematic in itself. The problem or the systems that are designed with AI to select and engage targets, right? The terminology that's used is acquired, identify, and engage targets. And they're able to do it at least three times faster than any human. Today, we use those types of systems, but a human still has to authorize it. So I'm I'm concerned about this packs is more concerned about the potential deployment of artificial intelligence and offensive systems, the systems that are used to go after people that will select and attack targets on their own without human oversight. I think that all makes sense. And the question is, are we going to get regulations are we going to have a Geneva convention that covers this type of technology out there? Who's accountable if an autonomous atomic weapon broke existing international law or some of these future laws or regulations, and we're talking about lives on the lines? We're not talking about weapons destroying weapons. So I'm very, very concerned, defense firms. According to courts, they're not building these weapons in a vacuum. The PAX guys are saying companies believe that's what militaries want in the Arsenal's and I'm not sure the wrong about that. Google and Amazon have both face public criticism about what they have been doing for the military. Although I have to say both of them have been to face about it, notably Google who is developing artificial intelligence at three facilities in China with the involvement of the Chinese government. And they're not doing it here in the US and yet at the same time, they won't do minor things that are designed to help protect us in that it states you know, Google I just don't get it. Understand this stuff. But there's a whole list here of weapons that are existing now. These little loitering munitions, kind of like land mines that sit in the area they wait, like maybe loiter in the area for hours before they attack a target, small or cheap that can be easy to produce.

Craig Peterson 1:15:17
And there there's just a whole lot of them. They've got STM This is a Turkish state-owned defense company that produces an AI-equipped loading munitions got facial recognition, kind of like again Angel has fallen can automatically select an attack targets using coordinates pre-selected by an operator they're looking to use Turkey is Kamikaze drones and Syria. There's harpy a fire and forget luxury munition manufactured by Israeli aerospace industry ranges 62 miles tail off for two hours. What's next, right, what are we going to do? All right, stick around. We're going to talk about the mess of multifactor authentication. How did he tech, a phishing site when we get back? You're listening to Craig Peterson, right here on WGAN. And of course online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 1:16:25
Hey, welcome back, everybody. Craig Peterson here, Happy Saturday weekend. Whenever you're listening to this, of course, we podcast this show as well. And with more than 20 million podcasts, there's bound to be an episode that you're interested in as well. You can listen to that by just going to your favorite podcast streaming site that you'd like to, and you can sign up under iTunes or Spotify. I'm on TuneIn. I'm kind of all over the place, and we've had a lot of good Great people downloading it, which makes me happy as well. You will find all of that. The easiest way is to go to Craig Peterson com slash iTunes, I should put a special page up that just gives all the podcast info, but for now, slash iTunes. And I'd really appreciate it if you would subscribe because that's what really helps drive up our numbers. And that's what helps get people to notice. And in fact, if we had a whole bunch of people sign-up at once or you know, over a week, then the algorithms would notice that, and they would get promoted a little bit more. So I would love it if you do that. But you know, that's up to you. Again, Craig peterson.com slash iTunes. Hopefully, I've earned a five-star rating from you. Or you can just with the TuneIn app, which by the way, you can listen to WGAN on the TuneIn app as well. And you can listen to me on Wednesday mornings at 738. with Matt and can on the TuneIn app so even if you're on the road anywhere in the world, you can listen to this station you can listen to me, and my podcast is also here on tune in. All right, an app, and a website. We got some how's here, you know, I talk a lot about the what and the why. And I give you some how's as we go through the show and a lot of the How is really left for trainings when I do courses and trainings. But we got two articles that I really want you guys to understand a little bit better. And one is from sigh where ones from dark reading. And we're going to start with this first one which is which is the myths of multi-factor authentication. Now without multifactor authentication also called two-factor authentication. In one employee, employees leave, they can quickly get back on if you don't change their passwords, but if you take their token, their physical token back, then life's a little safer. If people lose passwords, if you are a home user, and your password is stolen or compromised, someone can log into the websites. So let's talk about what this is. The best type of basic security is something you have, along with something that you know. So something that, you know, that would be an example of, for instance, your username and your password. So you put them together. And that's something that you know, your username and your password. And then something that you have might be, for instance, a token a digital token. I don't know if you've seen these. We use the type with a lot of our customers that aren't very, you know, technically advanced, that have had like a little six-digit number that keeps churning Gene on the token. So when they go to log in, so for instance, they will use this for a defense contractor or a doctor's office where they have to keep information safe. And when they log in, they're going to put it in their username, and they're going to put in their password. And then they're going to look at their token. And they're going to type in that number that changes every 60 seconds or so. Now you can do this type of two-factor authentication in several different ways. You can do it with your cell phone, a lot of people do it that way, where you get a text message from the website, giving you a code that you can type in.

Craig Peterson 1:20:46
Now that's cutesy, Don't you love that I get my code on my phone. That is eminently hackable. One of the articles that I found this week, but I'm not going to share with you guys because it's you I don't have enough time. But it's, it's all about this guy that just lost $20 million in Bitcoin because he was using two-factor authentication, but he was using his phone, and then somebody sim-jacked them. And that's where a cybercriminal takes over your phone number so that when they try and log in, in this case to his Bitcoin account, I'm simplifying this I know. But when they go to log into his bit calling account, it sends a text message, and then he types it in, and then he's in Okay, so using your smartphone with SMS with text messages is not very smart because it's easy enough to get around. So use something like we use dual DUO. It ties right in with one password, which we also use. It's fantastic for your business. Now, if you're home, you User look at Google Authenticator. That's what it's called Google Authenticator. It's free. And when you go to a website, and you sign up, and you go to your settings and your security settings, you'll find there that it often has Google Authenticator as one of the two-factor authentications. So you install this app on your phone, you're going to scan a little code that comes up on the screen using your phone, a short QR code, or maybe you're going to type something in the URL, etc. And it will set you up. Now when you go to that website, later on, to log in, you're going to put in your username, you're going to put in your password. You can open up your phone, the Google Authenticator app, and you're going to go to the authenticator app section for that website is going to give you this six-digit code. You're going to type it in, and it knows that it's you. That is an excellent way of doing it. Mike Soft, of course, being Microsoft has to do differently than everyone else. And Microsoft has its authenticator app that you can use to authenticate their websites. I don't think anybody uses Microsoft authenticator other than Microsoft, but I could be dead wrong there. So that's the easiest, cheapest, and best way to do multifactor authentication, not using text messages.

Craig Peterson 1:23:28
Now the myths are that large enterprises only should use MF phase multifactor authentication, absolutely false and home users should as well. Retirees should, in fact, use it. It is more critical for small businesses or home users to use MFA than it is for the large enterprise because you probably don't have all of the other security defenses and staff in place. It's only used to protect privileged users again, wrong. You don't want your bank account emptied. It's not working Perfect, which is true, but it's darn close, mainly if you're not using text messages. And it doesn't disrupt users' productivity. Because multifactor authentication usually, you only have to use it maybe once a day.
In some cases, you have to use it more or less. Some sites, it's only once a week that you have to use it. Now let's move on to our next one. It is how to detect a phishing site. Now we're talking about the pH fishing. And this is where the bad guys are trying to con you out of giving your information. So here are the main tips for detecting whether or not you are on a phishing site. Number one is to check the connection type. Make sure that the address bar shows a lot on it or and or has an HTTPS tag. Now that doesn't guarantee that it is who you think it is. If you want to dig into more, if you click that lock that's up on that URL bar, click that lock it, you can scroll through, and you can get more details, it'll tell you who signed this certificate and who the company is, that is using their certificates. So, you can usually make sure that it is who you think it is, okay? Most legitimate websites have valid SSL certificates issued by an authorized provider. In other words, you don't have to install some certificate on your browser. And they also indicate who the actual company is. Look closely at the URL. They, these phishing sites have URLs that are very similar to the real ones. So it might be micro snot. Instead of Microsoft, something that's easy enough for you to overlook. So look at them very carefully, make sure it is legit. They might be doing something like using.net instead of com or.edu or some other extension co look at it closely. There are online resources you can use. There's something called the whois database. It's been around for a long time part of the In fact, the whole internet structure that came into effect in the early 90s. You can do what's called a whois lookup if you're on a Mac Linux machine, you just use the whois command if you're on Windows, or a Mac, you can or Linux, you can use a web browser and just say who is space and the website that you're interested in. And usually, the search engines will send you to one of the main whois servers that are out there, and you can see where their site supposed to be, what it is, what they are, what the real domain name is. Website content setting up a website. It's a massive project that takes a lot of time, a lot of energy. If there's a lot of grammatical mistakes, low-resolution pictures, a lot of advertising, you're probably on a phishing site. Look for the privacy policy, contact information, those types of pages. Those are usually pretty much dead giveaways of a legitimate website versus a phishing site. So be careful when you're going online. Another tip is one that I've seen far too many times. Many people, instead of typing in the URL into the browser, they'll type it into a search engine which continually amazes me people do it all the time.

Craig Peterson 1:27:59
I have a Client whose accountant, their lead accountant, was going to Google and typing in the website address of the bank including.com. And Google would come up with the search results, and you click on the top one kind of blindly, right, not paying attention. Well, that's a great way that if the Google database is poisoned. An excellent way for the bad guys to get you to click on their website instead of the legitimate bank website. You might want to use a bookmark once you've got the correct URL, and then just double check when you log in that it is a secure server, and that it does have the right certificate. All right, everybody. Hey, thanks for being with us today. We'll be back next Saturday, same time 1:00 pm on WGAN. And I'm releasing these podcasts. They also go out on Saturday. So if you subscribe, you'll get all of this for Free, plus more subscribe Craig Peterson com slash subscribe. Easy enough, go to Craig peterson.com you can subscribe to my mailing list there, my newsletter, and you'll get all of this and more

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

Today there is a ton of stuff going on in the world of Technology and we are going to hit a number of topics from being aware of fake sexual harassment claims being used to mask malware to the advantages and disadvantages of future military technology, and why everyone should be using multi-factor authentication -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

Don’t Take The Bait - Fake Sexual Harassment Claims

Can You Detect A Phishing Attempt?

Vulnerability in Popular Anti-Virus Program

Bots Losing Panache as Cybercriminals Hire In Third World

Not If, But When -- Don’t Think You Are Not A Target

Big Tech Has Your Private Medical Records -- Through Hospital Partnerships   

Future Defense and Military Tech

Best Practices in Authentication Still Mostly Ignored By Businesses

---

Automated Machine-Generated Transcript:

Craig Peterson 0:05
Hello everybody! Craig Peterson here. Welcome. Welcome, you are listening to me on WGAN and online at Craig Peterson dot com. Thanks for joining me. Today we are going to be talking about some of the most important things that are happening in technology as we do every week and more particularly what's going on in this security realm. We'll talk about how you can detect if it's a phishing site that you have gone to, New malware from TrikBot here, a brand new one. Some complaints here about McAfee. Every piece of anti-virus software McAfee makes has vulnerabilities. We'll talk about that major, major security problem. We've got an accounting fraud here and how it's getting harder to detect and Why we have breaches? You know, I talked to so many people, I have a lot of customers, a lot of business customers. And they're sitting there saying, Well, you know, this is all inevitable. So what should I do about that? We'll talk about that. Google, you might have heard of project Nightingale. We'll get to that today as well. Defense firms are on track to make some very, very scary hardware. We'll talk about that as well as some of the myths of multi-factor authentication. And there are a lot of myths out there about all kinds of this security stuff, frankly, but let's start with our friends at Microsoft. I bet you thought I was going to say Apple, didn't you? Well, we had a big patch day, Patch Tuesday, and it fixed 13 critical flaws this week, and one zero-day vulnerability. Let's start by explaining what a zero-day is. In this case, we're talking about a zero-day attack, which refers to a vulnerability that is undetectable by any current antivirus software or anti-malware software that has seen this particular problem before. Now you noticed that made a difference a distinction between anti-virus and anti-malware, right? Because anti-virus software behaves in a certain way. Anti-malware behaves well, frankly, a little bit differently. So what are the pros? What are the cons? What's the difference between antivirus and anti-malware? Well, as a general rule here, anti-virus is a subset of anti-malware. Anti-virus is something that we're doing now will probably continue to do forever. Still, it does not catch me. Most of the nastiness that's out there today, anti-virus is you know, at best release Some people would say zero percent effective, but I give it the kind of the benefit of the doubt. And it's about 20% effective. So if you have antivirus software, it's only useful about 20% of the time against all of these different types of attacks, it's probably close to 10%. If you pull in the human element into all of this, anti-malware software behaves a lot differently than antivirus software. Some of it is whitelisting, where it knows this is a legitimate piece of software that was not modified. So it allows it to run that on one side. These are quite difficult to keep up to date because you have to continually monitor what's going on in what the software upgrades are. What the checksums of that new version of the software are, their libraries, are they all legitimate all those DLL files and everything else they're using. It gets pretty darn complicated from the whitelist listing side. And there's a couple of companies that do whitelist. Some of them, frankly, do better than others.

Craig Peterson 4:07
Some of them, in reality, isn't even really doing whitelisting when you get right down to it. And then there is the next level up, which is the anti-malware software. And anti-malware is software that looks at the behavior typically of what's going on. And there are there's software out there right now malware this designed to fool the anti-malware software to so it looks at it and says, Okay, this just installed Wait a minute, started opening a bunch of files. Wait a minute, is writing to a bunch of files. Wait a minute, and it's changing all these file names. That's the type of behavior that would be typical of ransomware. Good anti-malware software looks at the behavior of a program as it is opening all kinds of part the TCP/IP packets, that are trying to use a network to get to all of these other computers that are out there on the network. What is it doing? How is it doing? Why is it doing all of that? That's good anti-malware software. So it will do all of that it looks at checksums, it looks at just all kinds of things. And it typically has about a 10% performance penalty on your computer, and it can be a little bit higher than that. But it's they're busy looking at everything, examine everything trying to figure out what to do. So we have anti-malware software out there, as well as anti-virus. Those are the two significant types of software you'll put on to your computers. And frankly, anti-malware like well we use has multiple layers of software, and it ties into external databases and, and Cisco Telos to get updates and everything else. So that's what we use us what we do. So, in this case, we're talking about a zero-day Hack against some of this Microsoft software. So what does that mean? Well, that means that we're as of right now, none of the antivirus software knows how to detect this as a virus, none of it. That's zero-day, it's day zero. So tomorrow will be zero-day plus one, right? So day one of this out in the wild. And Microsoft, with their Patch Tuesday, decided they would plug 73 security vulnerabilities in their software products, including 13 of them, given the top level of a critical security vulnerability. And I guess it's kind of fortunate that this month only one of the flaws is known to be exploited. And this is a CV, that's what they're called that scripting engine vulnerability and Internet Explorer, and the sooner they get rid of Internet Explorer entirely, the better off everybody lives. Everybody's lives will be IE; they built it into the kernel so that they could have more control over it. You might remember the lawsuit against Microsoft saying, Oh, you can't ship a web browser that's integrated right into the kernel. Because now, you make it so that none of the other web browsers can work on internet XP on Windows, which was right in the very beginning. And you're blocking us out of there, and thereby it's anti-competitive, you know, it's all true. Now, IE because it's inside all these versions of Windows, these vulnerabilities can affect users who are no longer even using Internet Explorer at all. In other words, you don't have to launch the browser. You don't have to go out to the internet. You could get nailed on it right away. Okay. Now Microsoft Office is using the same rendering engine that has this vulnerability that internet access Laura has, and it can be embedded and in fact, triggered by an active x control on a booby-trapped web page. Active x is one of the worst things Microsoft could have ever done. It's right up there with some of the vulnerabilities and flash and Java. You know, are you kidding me you allow a web page to run code on a machine. And they at least they have markers on it, but it can be Mark now was safe for installation. The whole thing's crazy. I still don't understand Microsoft, and what they're doing here.

Craig Peterson 8:36
So bottom line, make sure you do your update. I checked right before I went on air, and there aren't any significant problems that have been found with the updates here for November from our friends at Microsoft. They're often are. We also had this week, and some more patches come out from our friends, my friends, and yours from Intel. Now Intel makes a lot of the computer chips that are inside our computers, mainly for using a Windows machine. But Macs use Intel chips to, although they don't have to, I don't know why Apple went with Intel, you know, my guess was it was less expensive. And Intel also had some outstanding power performance numbers saw, you know, I can't blame them. But we have a bunch of patches that came out from Intel, that make all of their CPUs almost every processor they've made in the modern era is entirely vulnerable.

Craig Peterson 9:39
And that's a terrible thing, including vulnerable not just on your desktop, but vulnerable in all kinds of operating systems and data centers. So, if you think hey, listen, I went ahead, and we moved all of our stuff to the cloud. They are just taking care of because it's in the cloud. Microsoft knows what they're doing. The answer to that is, well, they kind of know what they're doing. But they're stuck with this Intel vulnerability. There will be more patches coming out according to the people that found these vulnerabilities in every model of Intel CPU, Major, major, vulnerabilities. According to these people, there are more than Intel hasn't passed on yet for whatever reason. It's really, it's kind of crazy, frankly. So we got Microsoft patches for some major ones. This week. We've got Intel patches, some major ones this week, we've got Adobe patches that are out as well. So make sure you do the upgrades. I'm not going to go into all the details here. Man Adobe light set of patches this month only 11 security vulnerabilities from Adobe and Adobe Bridge, animate illustrator, and Media Encoder. Two months in a row where there are no patches for Flash Player. I'm not sure what that's about if they keep happening with flash player or if something else is going on. All right, stick around. We're going to be right back. You, of course, listening to Craig Peterson here on WGAN, make sure you visit me online at Craig Peterson dot com. We've had a few pop-up-trainings already. I'm doing some Facebook Lives and getting information out, and you'll only find out about them if you're on my regular email list. Craig Peterson dot com slash subscribe, and all of today's articles are up there as well. And there's a sign up right there too. So make sure you sign up to find out about all of the latest that you need to know. Craig peterson.com, when we come back, we're going to talk about chick bought something new going on out there trying to get us to do something we just shouldn't be doing. Stick around. We'll be right back.

Craig Peterson 12:02
Hey, welcome back, everybody. Craig Peterson here, little beach music. I was out for the last week and a half out at a conference in Phoenix, Well I guess isn't exactly near the beaches is it, but it was sure nice and warm. And then I got back home, and you know what's happening up here in the northeast? Yeah, a little bit of cold weather. Some of it's a little too cold for my liking. You know, it just came on so fast. We were like in the 60s and 70s. And then all of a sudden it's like the 30s and 40s. I don't know what's going on. Well, let's talk about this TrikBot. It is a new malware that's out there. I've spoken to many times here on the show about what the FBI has been warning businesses, which is the business email compromise. You probably heard of that before bc we're talking about something that's cost businesses. Well over 10 billion, I think it's over $14 billion now. And we're not just talking about a little waste of time. No, we're talking about these guys and gals going right after our business bank accounts. And the way they do it is they're kind of sneaky about it, they get and get you to, to basically for the money, right to wire the money to do other things that are going to hurt your business. You may not realize it at the time, and they're just trying to fool you. Right. So how do you fool someone? And I know I know you can't fool an honest man. I've heard that so many times in the past, and there's a lot of truth to that. But here's what they're starting to do now. And you might have gotten one of these. I have had several listeners reach out to me. I and quite a few saying hey, I just got this email chain that, you know it's it's got a video of me visiting this, this nasty website out there right so you guys are probably heard about that one before it's been around a little while. Well, now what's happening is they are sending an email that appears to come from the US Equal Opportunity Commission. This email is saying that wait a minute here, and we have a sexual harassment complaint against you. Now I understand as a business owner, how this can be kind of crazy. And I owned a building, a business office that I had my business running out of, little more than 20 years, maybe a little longer. Ago now. And that business office, I put in doors, and all of the doors were floor to ceiling glass because I didn't want anybody saying that I was harassing somebody or doing something illegal. Now, of course, I, you know, we didn't have microphones and cameras and things. But I just wanted everyone to feel reasonably comfortable that no one was going to corner anybody. And, you know, I think I was kind of mostly successful about that one of these days or forever sitting down having a beer, you might want to ask me what happened there. But anyway, this is something called Trikbot, and it's a banking Trojan. And it's going after employees of large companies. And it's trying to scare these employees into thinking that the US equal Equal Employment Opportunity Commission EOC is coming after them. And they are trying to get them to and are being reasonably successful in having them handing over sensitive information. And they're using a bunch of different social engineering techniques, including malicious payloads or redirecting them to fraudulent sites they control by emails that look like coming by somebody they trust, etc. Okay? Now, these spearfishing emails, and I'll read you the text in one here in just a minute here. But they, what they end up doing is dropping a malicious payload on to your computer. And as part of this campaign, these malware operators use the information they've collected from people, such as their names that company they work for job titles, phone numbers, to customize these phishing emails to make them a lot more convincing. Now think about your business and your business's website and other information that you're making available to the public. Digital website has, who the officers of the corporation are.

Craig Peterson 17:04
Now I know that all of us for our businesses, we have to file with the state chapter file with the IRS and various other things. But when it comes to the state, those records tend to be public. So people can go online, they can find out who the President is, who the officers of the corporation are, who the Registered Agent is, etc., etc. Right? And so now a bad guy can go online and find out almost anything they want to find out about a smaller company because it's right there on the website. Now is that easy or what? Now let's go into one of these pieces of email. Everything from the email subject This is from bleeping computer dot com. Everything from the email subject and the message content to the malicious attachment. Each of these mouse spam email Males comes containing the potential victim's name. Now I'm looking at it here. It's got a form, and it seems like it's legit. It has the logo of what I assume is the US Equal Employment Opportunity Commission because it looks official enough to me, and the title at the top is the U.S. Equal Opportunity employment commission harassment complaint. Then the complete submission of a complainant form has initiated an intake interview with an EOC officer. Okay, this is what they're sending out right now. It looks very, very legitimate. And they use the name of the victim with a grievance raised against you. That's a subject for each of the phishing emails, and they're trying to get you to pay attention. They also have a customized email body to instill a sense of urgency. So it'll say, dear name of the victim, private and confidential. One of your co-workers has lodged a complaint with the EEOC. Now on top of it, all the malicious attachments, drop TrikBot payloads also have customized names. And again, it's the name of the victim-dash harassment complaint letter, and it's got a phone number on it. The entire purpose is to get you to open that attachment. And by adding this personal touch to the phishing emails, they've been increasing their chance of people opening them. Now, you know, I do a little bit of marketing for some of the courses that we offer and, and for some of the other services, you know, like the security services that we offer the businesses, so I've studied some of the marketing stuff that's out there. And I can tell you right now, most people, if you get an email that looks like that are not opening it. If you're concerned about a particular email and you have listened to my show for the last 20 plus years. You're very, very worried about it and legitimately so.

Craig Peterson 20:10
So I'm not sure just how effective this is, you know, spam emails right now have an open rate of about, well, it's less than 1%. Legitimate emails have an open rate of, you know, as much as 15 to 20%. So I don't know how well they're doing. But when they're sending out 10's or hundreds of millions of emails, we're talking about some pretty darn serious stuff here. A lot of potential victims. These are highly targeted and regularly updated. That goes into some of the problems with antivirus software we will talk about later on. And that is if it hasn't seen that before, it's going to get tricked. This spear-phishing campaign delivers the malware payload. It's evolving. It's a banking Trojan. The purpose is to get you to give some banking information out. And apparently, it's been pretty successful. By the way, it's been in the wild since October 2016, one of the most aggressive pieces of malware that are out there right now. Stick around. When we come back, we'll be talking about McAfee's antivirus software and what's going on with that. Especially as it relates to some of the malware that's spreading out there in the world, right now. Make sure you are on my email list. So you keep up to date with everything that's going on. Craig Peterson comm slash subscribe. I'll let you know about the pop-up-trainings. I want you to pay close attention because I'm not going to hound you about this stuff. And we've had a lot of people attending them. They're free. Usually, they have two-hours worth of content and questions and answers. Stick around. We'll be right back.

Craig Peterson 22:05
Hey, everybody, welcome back. Hey, did you see this? It was an announcement by one of the investment firms saying that Tesla might be missing the boat when it comes to electric cars? You know, we've all thought Tesla was the leader in the in that isn't so many ways right and built their battery factory. They've been just doing all kinds of amazing things, but it looks like they might be losing a little bit of an edge when it comes to the overall electric car business. Because now you've got Ford and GM, the major US manufacturers, I think Chrysler as well. I know Ford and GM both have some major stuff going on, as well as the Japanese firms like the Nissan LEAF. That's been all-electric for a long time, although Nissan stops making the thing some of these us manufacturers are definitely in the middle of it all. And you probably heard me a couple of weeks ago talking about some of the real risks when it comes to Tesla electric cars, particularly in the event of an accident. It's a scary thing. Frankly, it's a frightening thing being involved with the MS for all of those years to think about it. Well, we spoke a little bit in the last segment about this TrikBot malware using fake sexual harassment complaints as bait. We started off the hour talking about Patch Tuesday, and 13 critical fixes for Microsoft software, this critical fixes out for Adobe software, you got to apply these patches. According to the stats I've seen. There are, on average, about 65% of Windows computers that do not get updated at all. If this is you if you're one of those people, I urge you to spend a few minutes, let's make sure that the machines are updated. I know some people that say forget about it. I'm just going to replace my computer when it's just so far out of date. I know some people have done that with cars, too. I had a good friend I haven't talked to in years. But he was telling me that his dad did the math, back in the day, many many years ago. His dad did the math, and he figured that if he paid for oil changes throughout the life of an engine just wasn't worth it. So he said, Hey, listen. What did an engine cost back in the day it was a couple of grand for a boxed engine, and he was a mechanic he could quickly put in a new engine. And if I pay for oil, filters and my time to change the oil
I will pass the break-even point at about 30,000 miles. So, in 30,000 miles, it was cheaper to replace the entire engine, than to pay for years of oil changes. Can you imagine that? So I did some quick mental math, and I agreed with him. He said, Listen, it's not as though I don't have oil in the engine. The engine will run off this known oil in it. But all I do is add oil when it needs oil added, and he never changed his oil. And at about 50 to 80,000 miles, you'd have to replace his engine. So he figured he was ahead of the game. Nowadays, with these new engines and filters and oils and the oil is just so thin. Nowadays. They're saying 10,000 miles give or take between oil changes, so it's not anywhere near as bad. Plus, some of the cars today will tell you, hey, I know Need an oil change? So you don't even have to keep track of the miles, you know, used to be 3000 miles. Do you remember you might not be old enough to remember, but the oil did not have the cleaners in it now, nowadays they have been detergents because your engines would get all sludgy? And what a mess ever take one of those apart, even just the head of the engine, the mess that was in there, we don't have those problems nowadays. Well, some people have taken that whole idea of, hey, it's cheaper to change the engine than it is to change my oil. They've taken that to the extreme. But you know, it is not like that when it comes to computers. You can't just have the laptop sitting on your desk or under your office and leave it there for years to come and say, Hey, listen, when it breaks down, I'll replace it. I'm not going to bother doing upgrades of my software won't work because it's running Windows XP, or whatever some old version of Windows, I'll go out to one of these, big-box retailers, and buy another computer and throw this one away.

Craig Peterson 27:14
That is a very, very bad idea.

Craig Peterson 27:16
And I suspect that's where some of the 65% of people come in, that are not maintaining their computers. Now you have to keep them because unlike your car, your computer is continuously under attack. So, that means you have to not just upgrading and updating windows but all of the software that's on your computer. You know, I talked a little bit earlier about Internet Explorer, and only Internet Explorer alone having it on your computer will cause other programs on your computer to get infected and allow hackers access. It's just plain old, not worth it. Well, let's talk about Anti-virus doctrine. Oh, you remember I said antivirus software? Yeah, I convinced myself that it's, it's about 10% effective at no more than that guaranteed. And we can go through all the numbers again, if you want to buy me a beer sometime we'll sit down and go through all the numbers, and how virus software does not work.

Craig Peterson 28:19
Well, Let's talk about some software that doesn't work. McAfee antivirus software. In an article from ZD net, has a code execution vulnerability, a severe security flaw that can bypass the self-defense mechanisms built into McAfee antivirus, very, very big deal. Safe breach labs, their cybersecurity team. It is one of the groups that go around and test software, tries to find vulnerabilities, and then lets the manufacturer know so they can take care of it. But they're saying that this particular vulnerability can be used to bypass McAfee self-defense mechanisms and could lead to further attacks on a compromised system. Now, this vulnerability exists because of a failure by McAfee's programmers to validate whether or not these DLL's it's loading have been signed, let alone appropriately signed. Remember, I even mentioned that in the first segment today. These self-defense mechanisms are essential, and they need to be in place, even though the antivirus software is going to be at best 10% effective at least you would have 10% effectiveness right. So because they can bypass the self-defense mechanisms and leading to further attacks on a compromised system. It needs to get fixed right away. See an arbitrary unsigned DLL that gets loaded into multiple services that run is NT authority, backslash system.

Craig Peterson 30:06
Now, the only good news is that attackers need to have administrative privileges to take advantage of it. However, I rarely walk into a business where everyone isn't running with, with, frankly, administrative privileges. The companies do that, and I understand why they do it. It's a bad thing to do should never do it. Right. But I know why they do it. They do it because, oh, it's just so much easier if I have to install software right or to call the IT person. And the IT person is the Assistant to the owner. And she's always busy. He's still running around doing stuff. I don't have the time, and I can't keep asking for permission to do things. So, everybody gets administrative authority. There are three main ways and which is why vulnerability gets exploited according to the Safebreach lab. Anti-virus software might not detect the binary, and it loads it without any verification against it. Impacted software includes McAfee total protection, anti-virus plus AVP from McAfee, and Internet Security up to and including the version 16.0 point 22. You must get the latest software. So, if you have McAfee update, pronto. And as I said, you should update, anyways. And don't use antivirus. I recommend getting a robust anti-malware stack of software.

Craig Peterson 31:39
So what are people doing? Vendors doing? They're just renaming their stuff is anti-malware stacks. Yeah, yeah, that'll fix the problem. Your listening to Craig Peterson on WGAN stick around. We'll be right back.

Craig Peterson 32:02
You know, it's funny how you get used to the weather, whether it's hot or cold. You're listening to Craig Peterson here on WGAN. And online at Craig Peterson dot com. You'll find my Facebook page by going to Craig peterson.com slash Facebook. And I've started posting some stuff up there. Well, I do that actually, every day. My wife is the one that's putting the articles up that I come up with every week, every day. But you are also starting to find I'm doing Facebook Lives and YouTube lives, and just you know, I'm getting a little better at some of this stuff. And there are a lot of possible angles here. By the way, you know, I mentioned I was at this conference, and I was learning a little bit more about marketing and product development out there. Product development is what I kind of love doing, Right. We can do it quickly. We know what we're doing. We know how to do it. So we're trying to figure out how can we produce a very inexpensive product that is going to help a lot of people when it comes to security. And I think we've got the answer. I don't want to be, you know, mean and nasty about this, but we're working on it. And we should have something in a couple of weeks from now, that I think is going to change lives. I think this is going to be earth-shattering. If we do this the right way, it is going to change everything for anybody that decides that this is for them. So we'll be talking about that in a couple of weeks from now. But it's an idea from another industry that in fact, it's the tennis, tennis training business, and I think it's like the world's most perfect idea. Here when it comes to us, so we'll be talking more about that. But you can find that you can find information on the articles that I have every week, you can see all of that stuff you can find out about the free pop up classes, the pop-up-trainings that I've been doing, you can find out about some of these Facebook Lives and YouTube Live. All of these are free training. I'm just trying to get this information into your hands. You know, the Whats, the Why, and the Hows, all of that stuff. And there's only one way to get it. And that is to sign up, go to Craig Peterson dot com slash subscribe, and I will make sure that we send you every week just a quick summary of the stuff that's going on. I'm going to have a special sign-ups for these pop-up-security-trainings, So no, I'm not going to send you a lot of emails unless you ask me to write by default. We got a great article from Joan over at darkreading.com. Dark reading dot com is one of those websites, one of many to which I pay quite a bit of attention. They do have some great, great content. In this article, they're talking about fraud and how it has changed. You, I'm sure, are familiar with our friend, the Nigerian prince, and all the things he did and how he tried to get his money out of the country. And all he needed was to use your US-based account, and you could keep some of that money. You remember that right then, it's just full of misspellings. It was just terrible, and there are reasons for the misspellings, there are reasons for the way they do things. No doubt about it. Well, things have changed. Now economics have changed. And they are swamped, making a whole lot of money. And they're doing it in different ways. They've done it before. You know, we've got tools now to detect and mitigate some of these attacks. And the easiest way to do that we have some software that all the email flows through, and it's looking for patterns look, make it look like it's a bot that sending out these emails. And when we put those this particular filter in place, in fact, it's and AI bought itself. That right the Battle of the AI that's coming to, but you know, the amount of spam these things dropped by 90 plus percent. It's just it's dramatic, how much it helps.

Craig Peterson 36:58
Well, what has happened now is the bad guys have found that labor is getting cheaper and cheaper in some of these developing nations out there. And they're able to get people in Venezuela, for instance, where they are starving to death where they are picking through garbage because of their socialist government. And man, I saw this thing the other day, it just shocked me, they were using a sharpie to write on people's forearms a number, so they knew when they could get food. Yeah, when they could get food from the grocery store. That's how bad it is in Venezuela. So you have to wait in line. You have to obtain a number one thing. God is not a tattoo. It's a sharpie, but you have to get a number there on your forearm, and then you can get Food. And if you can't wait, and if you don't get enough food for your family, you're going to have to go through the garbage. It's just absolutely insane. Well, cybercriminals are hiring workers in Venezuela now, where the hourly wage has gone way down compared to other currencies. I am not sure if you remember, but Venezuela used to be the wealthiest nations in Central and South America by far and is now one of the poorest countries in the world thanks to their socialist government. Well, the hourly wage is so low that it now makes economic sense to pay people to manually carry out the fraud to write these fraudulent emails to research to get the stolen account data instead of using bots like they have been doing before. So, here's a quote straight from the article. "attackers are giving people a script and saying here's a quota you have to hit, criminals are always trying to figure out what is the lowest hanging fruit as merchants and companies evolve with defenses, these attackers evolved, humans just happened to have become the flavor of the month." So, these human-driven attacks are increasing quickly and exponentially. Now, the most recent fraud report that came out covering q3 2019. So. just this last month, found that attacks carried out directly by humans, both loan perpetrators who are trying to get money to support their families in third world countries, and organized criminal groups increased 33% over the previous quarter, nearly one in every five fraud attacks are manual now rather than automated.

Craig Peterson 39:57
Now, of course, their goal is to look as legitimate as possible. Having humans involved does increase your chance of success. And so many people worldwide speak English because English is the international language of business. And it's causing a problem. This quarterly report that came out from our coasts looked at 1.3 billion transactions spanning account registrations, logins, and payments in the financial services, e-commerce, travel, social media, gaming, and entertainment industry's overall fraud increased 30%. In q3, and bought driven account registration fraud is up 70% as cybercriminals test stolen credentials, in advanced of what in advance of the US holiday season. Isn't that amazing? But now every third attack on financial services is manual. Attacks are coming from fraudsters now with access to stolen identity information. They're using the latest tools. Over half of the attacks that originate from Russia and China are now human-driven. It is changing everything. The data highlights that the entire attack incentive for countries across the globe is economically based. We've got some substantial economic things happening here in the US. If a nation's currency is worth only a fraction of the US dollar, then the incentive of a criminal in that country to defraud an American business
is very high, because they've got that multiplier based on the value of their currency compared to the value of the US dollar. So, it's incredible what's going on. You've got to watch it. You got to be careful that There are a lot of bad guys out there that are looking to get their hands into your accounts. And we've got this shopping season right in front of us now. So what I would suggest to everybody is, check with your bank, depending on your bank, some of the banks and doesn't matter if it's visa or if it's MasterCard visa sent tends to be pushing this a lot more than MasterCard is. But whether it's Visa or MasterCard, you're going to find that they have virtual card numbers that you can use. And the idea behind these virtual card numbers is that you have a one-time card number that you can use when you are buying something online. So, instead of having your regular credit card number that you're using, that's sitting there in a merchant database, that may or may not be configured appropriately or secured. Remember, a secure server doesn't mean that their servers secure; it just means that your data going to it is protected in transit. Instead of giving them your real credit card number, and having that stored in a potentially insecure database, now all you have to do is give them that temporary credit card number. Go to your bank, and you can usually check on the website before you start buying stuff online for Black Friday. And we're going to have some Black Friday deals to or Cyber Monday, or you know, whatever it is for Christmas, for Hanukkah, for whatever you're celebrating. We have birthdays to over this holiday season. Get your bank to give you access, and this will be online access to get a different virtual credit card number every time you do a transaction online. It's cheaper for them to do that than It is for them to issue new credit cards when compromised or stolen. It keeps happening. All right, stick around. We will be back. We got one hour to go. We're going to talk about Google's project Nightingale and see if that's scary enough for you. We are concerned here about some of the defense firms, multi-factor authentication. I will run through how you can tell right what's the best way to do it. And how to detect a phishing site. We'll get to all of that. In the next hour. You're listening to Craig Peterson on WGAN and online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 44:52
Hello, everybody, Craig Peters on here on WGAN and online at Craig peterson.com. Hopefully, you join me there and sign up for my email list. I get you in my newsletter. You can do that by just going to Craig peterson.com slash subscribe and subscribing to my newsletter. Every Saturday, we are here and talking about some of the latest in technology and security. The things that frankly you don't hear about, at least not the right answers in the general media out there. It's just amazing to me how many things they get wrong, again and again, and again. I try never to attribute to malice what can be easily attributed to incompetence. Is that a terrible thing to say about some new people in the media? You know, if you get right down to it, they have so many things that they have to know about and be semi experts on to write some of the articles, so I guess I really can't blame them for well for least Some of that. Well, let's talk about the chaos here for a couple of minutes. We are in the new normal. Now I'm not talking about with President Obama said the new normal was, which is people high, you know, unemployed, high levels of unemployment and stagnant economy and stuff. I'm talking about a recent survey that was conducted by a security company out there that showed that 86% of 250 top security officials who participated in this survey believe that cybersecurity breaches are inevitable. Now that opens up a whole can of worms because it's unavoidable, does that mean there's nothing you can do about it? I think by definition, it does. It is inevitably going to happen no matter what you do. So why do anything? Many people have done nothing. Remember, in the last segment, and if you've been listening in the previous hour, I talked a little bit about how 65% or so of computers never were upgraded. That's, that's a bad thing, right? And nowadays, when we get right down to it, and we're talking about these 250 professionals, people that know what's going on. We're talking about people who realize that the complexity of today's cybersecurity in businesses makes it so that it's almost inevitable. Now, when we think about cybersecurity, and we're thinking about companies. Obviously there is some truth to this for home users and, and that's why we did this security summer you know, I had that hundred and 50 pages of cheat sheets that we gave away to everybody. Who participated in this. And it was designed to help you understand what you had to do in different circumstances. And hopefully, you got all of those I start, you know, they were all sent out well, by the end of September, because, you know, summer doesn't end until September 21. So I little extra time as my team and I delved into that labor of love out there. But there are a lot of pieces moving parts to this puzzle, and it makes it very, very difficult. Nowadays, we're making our lives even worse because of cloud adoption. We're using cloud services. We're using hybrid environments spread across physical machines, different locations, different teams, various cloud providers, and now businesses are using something called containers. I remember when I first heard about them, I was thinking about, well oil container on Okay, so we're talking about the types of things you put on a truck and then put on a ship right or, or you can rent while you are making the improvements like I did in my kitchen.

Craig Peterson 49:11
I got one of these little containers, one of these small pod containers, and loaded it up with all of our stuff while we were working on it. Yeah, that's not what the containers at the businesses are using. These dedicated containers perform a specific purpose, like running a website, or a database or something else. It's just getting very, very difficult to keep track of it all. And frankly, that's why we're seeing some of the major breakdowns. Now we do not see in these in breakdowns like Equifax. What was that? It was, Oh, yeah, a username of admin with a password of admin rights. Stuff like that is just plain old, stupid, but because of everything so complicated and were not tested thoroughly, they broke in. Now, if you are in a business-like, for instance, a shipbuilder, you are thinking about failures. Because if you're out in that open ocean and you get a rogue wave that comes in, hit you on the side, your ship is going to flip over. Now obviously, you don't want to name your ship, Concordia. Another one just ran aground this week over Norway. Of course, the big Concordia running the ground was in Italy, and what a mess. But shipbuilders realize that ultimately, ships are going to fail. There is going to be that rogue wave, or it is going to run aground or the propulsion systems going to go down. And the extremes are like submarines where you have all the compartments, and the idea is that a breach might occur in one compartment, but the other compartments will not. So we're spending billions of dollars, and we're likely preventing a lot of bad stuff. The number of high profile breaches is just increasing and causing devastating damage to us as consumers. It's going to last for decades. And why? Well, like so many other industries, people in the security business are not preparing to fail. And companies are not preparing to fail. It's like what I teach in my backup course, the three to one backup methodology, and I should do another pop-up-training on that. Frankly, you've got to have multiple copies of backups numerous generations of backups on various types of media, in numerous sites, because of Smith's commentary. Now, you might not be familiar with Smith's commentary, but Smith's commentary on Murphy's Law is that Murphy was an optimist. And of course, Murphy's Law is, if anything can go wrong, it will. So shipbuilders have engineered the systems, they have segments in the halls, they have multiple hulls, double triple hulled ships so that if it's carrying oil or something else, if there is a penetration to the hull, the ship won't dump oil or whatever, into the ocean. It's been done this way since the 15th century. And it's been done in today's modern vessels as well. Even the Titanic had some of these things in place, although it had some other problems. I don't know if you've seen some of the more recent studies, by the way, on the Titanic. It's fascinating. But it looks like what happened was, there was a fire in the Titanic's hold coal fire that they couldn't put out. And they had been smoldering and caused a weakening of the ship's hull. And that's why when it hit that iceberg it tore open. But that's another story here. So let's talk about some principles here security principles that they use in shipbuilding that we need to look at in modern IT. Shipbuilders assume that at some point, the ship will suffer leak. So how do you protect against that? How can you fix that? Well, they create holes that prevent a single leakage from sinking the whole ship. So, in the same way, you have to assume there might be a breach in your corporate environment and segment your network so that it doesn't spread. There's a lot of details we could discuss, and maybe I should do some Facebook lives on these things.

Craig Peterson 53:52
Your staff who's responsible for maintaining the ship's hull is monitoring for leaks. They're watching for leaks, and they're regularly patching. They're painting they're scraping right to get rid of the rust and to make sure that there isn't a major flaw in the ship's surface, or you know, hull, they're trying to keep the ship safe. So, in the same way, our modern security teams have to be vigilant about monitoring and patching. To prevent these cracks in the perimeter, as well as the interior. We just last week had a client who had an internal breach. They were using a VPN to allow our remote office to get into their primary network. That remote office was breached and was used as a launching pad to get onto their primary network. And then once on one machine on the main network that they could breach, they now we're able to spread within the main network. We got to watch this. The ship's most sensitive equipment is in the engine room. And in the tape game you know in the case of a business you got to venture critical IT assets are considered ships that staff lookouts 24 seven to make sure there is a good watch, we need to do something similar with our data. Keeping the crew from accessing the bridge is an important safety measure. We got to make sure that our user identities get set up correctly and their employees, contractors, remote users can only get data they should be getting to. And we could go into attack after attack after attack. But the bottom line is when you're designing your security, you have to anticipate a breach. You've got to patch everything, keep it patched and up to date. And you've got to segment your networks. And if you need to be secure, the newest types of networking are called zero trust networks where nothing can talk to anything else on the network. Unless it's explicitly allowed because we can't trust it. So the very least segment out your Internet of Things devices, make sure your sales guys are on a different network than your accounting people. Right? Break it all down in the business space. When we get back, we're going to talk about us in the consumer world and Google's Project Nightingale, man, is this a scary project, but you know, heck, it's Google, but not can do anything wrong right here listening to Craig Peterson right here on WGAN.

Craig Peterson 56:43
Hello, everybody. Welcome back. Craig Peterson here after the top of the hour. And we are talking about the latest in security and technology. What's going on out there? We cover in some depth here some of the things that you need to understand. Some of these things are specific questions that I've gotten from you. So if you have a question of any sort you'd like me to answer on the air or maybe answer directly, email me. It is ME at Craig peterson.com. I am glad to do it, or you can drop it on my Facebook page. Now I have to say that I get thousands of emails a day. So sometimes it can take me a while to get around to it. So don't feel bad if I don't answer your question right away. But I am pretty good about answering most of the questions that people ask and particularly if you email them me at Craig Peterson, dot com that's so that's what I monitor kind of the most. Some of my team helps you track that too, which is a very, very good thing. Mountain View, California dateline. It is a scary story. And you know, we just had Halloween, but here's what's going on. You might not be aware of it. HIPAA is a law put in place, oh, decades ago now, I think maybe even as much 20 years ago. The most significant part of HIPAA is this whole concept of portability. Now, you may not realize it, the bill was certainly not advertised as being this way, but it is this way. Here's the problem. Before HIPAA went into place, what was going on if you had your medical records, and those medical records had to be kept private, they could not share them with anything and what HIPAA did was. It defined the rules for sharing, among other things. Before HIPAA, your medical records were considered private and kept secret. After HIPAA went into place, your medical records could now be shared anywhere almost in the medical community. And of course, with portability, the idea is, well, you've got your medical records, you want to go to Florida for the winter. So you want the doctors in Florida to be able to have access to your medical records, which is all well and good. It makes a lot of sense. However, other things going on in there still are. If I want the medical records of every patient in hospital x or health plan, why? And I say, Hey, listen, I'm going to buy the company. I'm thinking about buying the company. I'm thinking about purchasing that hospital. The hospital has the right to give me all of your records. That's the bottom line. Scary. And that's been happening. Our medical records have been shared and traded like trading cards. So, one of the largest health systems here in the United States is called Ascension Health. And you might have heard of it before, mainly if you are at all involved in the Catholic nonprofit health system. The Catholic Church has taken care of millions of patients for free, much of the time, you know, no charge to the patient. But the Catholic Church has been behind many of these medical hospitals and medical treatment that has been out there that we have used for generations, frankly, and you know, good on them. It has been wonderful. And they've kept costs under control reasonably right. By right by where I live. There's a Catholic medical center that is renowned in the region for its cardio care. And like many other hospitals that are out there, they will also provide charitable care for those people who can't afford it. So Ascension partnered is with Google Now ascension is, again, the largest health system here in the country. And it partnered with Google. And Google now has access to detailed medical records on 10s of millions of Americans according to a report by the Wall Street Journal, and It is code-named Project Nightingale, I'm sure you can figure out why they call it at night and Gail. And it has enabled at least 150 Google employees to see patient health information that includes diagnosis laboratory test results, hospital records, and other data. Now, remember before HIPAA, man, you could have sued and won if your medical data got shared without your knowledge, let alone your permission. Now, some of the negative results of those HIPAA regulations are coming to light, where the largest health system in the United States, Ascension, shared your medical data with Google. That is a very, very big, big deal. Now, this is reported by the Wall Street Journal, and it's according to internal documents and the newspapers other sources in all the data amounts to complete medical records and contains patient names and birthdates according to The Wall Street Journal. Now, this is a move by Google to try and get a strong grip on the medical business, the sprawling healthcare industry. In November, Google announced a deal to buy Fitbit that has gone through. I'm sure you've seen that. So now, it has access to all the sensitive health data that amassed from Fitbit. How much information have you been giving them? They've got all kinds of health records. They've got what have you put into those things? And we have Google, Microsoft, Apple, and many others competing to get access to all of our medical records and to be the storehouse so that when you go to Florida today, your records are there because you shared them on purpose. Neither Google nor Ascension, according to The Wall Street Journal journal, neither Google nor the country's largest health system Ascension has notified patients or doctors about the data sharing 2600 hospitals, doctors' offices, and other facilities across 21 states and the District of Columbia. So Google's ultimate goal is to develop the searchable cloud-based tool, but here's what I found particularly interesting, and that is about transforming care. In a statement from Ascension, the VP of strategy and innovations, Eduardo Conrato said, "as a healthcare environments continue to evolve rapidly, we must transform to meet better the needs and expectations of those we serve, as well as our caregivers and providers." So what are they doing? Here? Well, it turns out that apparently, they're having the hospitals enter in your data to these healthcare records, uploading them, analyzing them, and helping the doctors come up with diagnosis as well as prognosis frankly. They're hoping to improve outcomes, reduce costs, and save lives ultimately, and you know what they probably will. But the issue at hand here goes back to the HIPAA act of 1996. And should we be able to control our medical records? That's the big question. It looks like the answer to that is no and has been for 30 years. Thirty ish years not quite 25. All right. When we get back, we're going to talk about Rola robots of the killer variety. What is going on with some of these government contractors out there? Man is a scary show, isn't it today well after compensate next week, you're listening to Craig Peterson here on WGAN and Tune on Wednesday mornings at 738 with Ken and Matt, and I'll be online there too.

Craig Peterson 1:06:38
Hey, Craig Peterson here. WGAN. Online Craig Peterson dot com. We are nearing the end of the show here. We only got two more segments together. But that's enough time to cover a couple of these articles I want to get to today. Let's start with this one first here, which is the Robots. You know, I have long been concerned about robots as have many other people. Some people much smarter than I have been very concerned about them. Take a look at what ElonMusk has been saying. That's part of the reason he wants to move us to Mars is artificial intelligence and robotics. Think back wow, even to the like the early 1990s with iRobot. And, and that Russian author, I can't remember what his name was, but it's been a concern for a very long time. Now, things changing rapidly. In an article from QZ.com, a new report is out from Pax, a nonprofit based in the Netherlands that's campaigning for peace around the world. And of course, Pax is the word for peace in many languages, and they're warning about this new potential trend that's coming out. I don't know if you've seen some of these moves. Movies where there are swarms of drones. And those drones swarm in on something. There was a recent one, and I think it was Angel has fallen with Gerald Butler. And the President is tagged by the attack by this swarm of drones. We had the same thing happened. I think it was only one or two drones in South America trying to take out a president down there. Well, our militaries are looking at some of this newer technology to conduct war. And you know, frankly, they have to because the bad guys, the other guys, whoever our ultimate future opponents are, are looking at this as well. China has spent a lot of time on it. And if you look at something like these drones, you could easily have killer drones out there. These drones have to have an ounce of high explosives in them, get close to a combatant, and explode themselves in Kill the combatant. That's all it takes. We're worried about what's being called this third revolution in warfare. The first revolution was gunpowder. You know, you could argue right bows and arrows and various things, but the gun powder was a considerable revolution in warfare. And then you had the atomic bomb, which was not too long afterward. The Chinese invented gunpowder. But now activists and military leaders are calling for international regulations kind of like what we have with the Geneva Convention where we defined how wars get fought. They want to govern all-new weapons systems that have a type of artificial intelligence in them, a type of machine learning. They don't want life or death decisions to be made on their own by these intelligent systems. And they're looking to ban them outright. Key governments, including the US and Russia, have resisted it so far, and I understand right.

Craig Peterson 1:10:18
But what are you going to do? nears we can tell militaries have not yet deployed killer robots on the battlefield? At least offensively? What are you going to do with a robot that makes life or death decisions and gets it wrong or gets it right heaven forbid, either way, where you've got a robot out there that it doesn't have to think twice about pulling the trigger to kill someone because it doesn't think twice about it. It's almost like having some of our troops sitting in Virginia, flying a killer drone in the air that's over a site 5000 miles away. And just pulling the trigger and off that missile goes. That is not a life or death decision made by that missile. That is a life or death decision made by a human that has to pull that trigger. That's frankly a very, very big deal. The big difference between the two. Now this organization called PAX has identified at least 30 Global arms manufacturers that don't have policies against developing these types of automatic life or death, killer weapon systems. And apparently, they're doing it at a rate that's outpacing regulation. Now, this is normal when it comes to technology. I've talked about this so many times. Technology always leads any regulation, and it's still in front of the laws. It's still outpacing the regulatory ability of governments, but we're talking about companies that include Lockheed Martin, Boeing, Raytheon. We've got some Chinese state-owned conglomerates like a Vic cask, Israeli firms IAIL bit Raphael, Roz tech of Russia, Turkey's STM. It is a very, very big deal. So what are we going to do about it? It's, it is a very, very good question and courts are trying to address it. You will see this article if you're interested in it up on my website as well at Craig Peterson, dot com. Still, activists don't believe that the military use or some degree of artificial intelligence is problematic in itself. The problem or the systems that are designed with AI to select and engage targets, right? The terminology that's used is acquired, identify, and engage targets. And they're able to do it at least three times faster than any human. Today, we use those types of systems, but a human still has to authorize it. So I'm I'm concerned about this packs is more concerned about the potential deployment of artificial intelligence and offensive systems, the systems that are used to go after people that will select and attack targets on their own without human oversight. I think that all makes sense. And the question is, are we going to get regulations are we going to have a Geneva convention that covers this type of technology out there? Who's accountable if an autonomous atomic weapon broke existing international law or some of these future laws or regulations, and we're talking about lives on the lines? We're not talking about weapons destroying weapons. So I'm very, very concerned, defense firms. According to courts, they're not building these weapons in a vacuum. The PAX guys are saying companies believe that's what militaries want in the Arsenal's and I'm not sure the wrong about that. Google and Amazon have both face public criticism about what they have been doing for the military. Although I have to say both of them have been to face about it, notably Google who is developing artificial intelligence at three facilities in China with the involvement of the Chinese government. And they're not doing it here in the US and yet at the same time, they won't do minor things that are designed to help protect us in that it states you know, Google I just don't get it. Understand this stuff. But there's a whole list here of weapons that are existing now. These little loitering munitions, kind of like land mines that sit in the area they wait, like maybe loiter in the area for hours before they attack a target, small or cheap that can be easy to produce.

Craig Peterson 1:15:17
And there there's just a whole lot of them. They've got STM This is a Turkish state-owned defense company that produces an AI-equipped loading munitions got facial recognition, kind of like again Angel has fallen can automatically select an attack targets using coordinates pre-selected by an operator they're looking to use Turkey is Kamikaze drones and Syria. There's harpy a fire and forget luxury munition manufactured by Israeli aerospace industry ranges 62 miles tail off for two hours. What's next, right, what are we going to do? All right, stick around. We're going to talk about the mess of multifactor authentication. How did he tech, a phishing site when we get back? You're listening to Craig Peterson, right here on WGAN. And of course online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 1:16:25
Hey, welcome back, everybody. Craig Peterson here, Happy Saturday weekend. Whenever you're listening to this, of course, we podcast this show as well. And with more than 20 million podcasts, there's bound to be an episode that you're interested in as well. You can listen to that by just going to your favorite podcast streaming site that you'd like to, and you can sign up under iTunes or Spotify. I'm on TuneIn. I'm kind of all over the place, and we've had a lot of good Great people downloading it, which makes me happy as well. You will find all of that. The easiest way is to go to Craig Peterson com slash iTunes, I should put a special page up that just gives all the podcast info, but for now, slash iTunes. And I'd really appreciate it if you would subscribe because that's what really helps drive up our numbers. And that's what helps get people to notice. And in fact, if we had a whole bunch of people sign-up at once or you know, over a week, then the algorithms would notice that, and they would get promoted a little bit more. So I would love it if you do that. But you know, that's up to you. Again, Craig peterson.com slash iTunes. Hopefully, I've earned a five-star rating from you. Or you can just with the TuneIn app, which by the way, you can listen to WGAN on the TuneIn app as well. And you can listen to me on Wednesday mornings at 738. with Matt and can on the TuneIn app so even if you're on the road anywhere in the world, you can listen to this station you can listen to me, and my podcast is also here on tune in. All right, an app, and a website. We got some how's here, you know, I talk a lot about the what and the why. And I give you some how's as we go through the show and a lot of the How is really left for trainings when I do courses and trainings. But we got two articles that I really want you guys to understand a little bit better. And one is from sigh where ones from dark reading. And we're going to start with this first one which is which is the myths of multi-factor authentication. Now without multifactor authentication also called two-factor authentication. In one employee, employees leave, they can quickly get back on if you don't change their passwords, but if you take their token, their physical token back, then life's a little safer. If people lose passwords, if you are a home user, and your password is stolen or compromised, someone can log into the websites. So let's talk about what this is. The best type of basic security is something you have, along with something that you know. So something that, you know, that would be an example of, for instance, your username and your password. So you put them together. And that's something that you know, your username and your password. And then something that you have might be, for instance, a token a digital token. I don't know if you've seen these. We use the type with a lot of our customers that aren't very, you know, technically advanced, that have had like a little six-digit number that keeps churning Gene on the token. So when they go to log in, so for instance, they will use this for a defense contractor or a doctor's office where they have to keep information safe. And when they log in, they're going to put it in their username, and they're going to put in their password. And then they're going to look at their token. And they're going to type in that number that changes every 60 seconds or so. Now you can do this type of two-factor authentication in several different ways. You can do it with your cell phone, a lot of people do it that way, where you get a text message from the website, giving you a code that you can type in.

Craig Peterson 1:20:46
Now that's cutesy, Don't you love that I get my code on my phone. That is eminently hackable. One of the articles that I found this week, but I'm not going to share with you guys because it's you I don't have enough time. But it's, it's all about this guy that just lost $20 million in Bitcoin because he was using two-factor authentication, but he was using his phone, and then somebody sim-jacked them. And that's where a cybercriminal takes over your phone number so that when they try and log in, in this case to his Bitcoin account, I'm simplifying this I know. But when they go to log into his bit calling account, it sends a text message, and then he types it in, and then he's in Okay, so using your smartphone with SMS with text messages is not very smart because it's easy enough to get around. So use something like we use dual DUO. It ties right in with one password, which we also use. It's fantastic for your business. Now, if you're home, you User look at Google Authenticator. That's what it's called Google Authenticator. It's free. And when you go to a website, and you sign up, and you go to your settings and your security settings, you'll find there that it often has Google Authenticator as one of the two-factor authentications. So you install this app on your phone, you're going to scan a little code that comes up on the screen using your phone, a short QR code, or maybe you're going to type something in the URL, etc. And it will set you up. Now when you go to that website, later on, to log in, you're going to put in your username, you're going to put in your password. You can open up your phone, the Google Authenticator app, and you're going to go to the authenticator app section for that website is going to give you this six-digit code. You're going to type it in, and it knows that it's you. That is an excellent way of doing it. Mike Soft, of course, being Microsoft has to do differently than everyone else. And Microsoft has its authenticator app that you can use to authenticate their websites. I don't think anybody uses Microsoft authenticator other than Microsoft, but I could be dead wrong there. So that's the easiest, cheapest, and best way to do multifactor authentication, not using text messages.

Craig Peterson 1:23:28
Now the myths are that large enterprises only should use MF phase multifactor authentication, absolutely false and home users should as well. Retirees should, in fact, use it. It is more critical for small businesses or home users to use MFA than it is for the large enterprise because you probably don't have all of the other security defenses and staff in place. It's only used to protect privileged users again, wrong. You don't want your bank account emptied. It's not working Perfect, which is true, but it's darn close, mainly if you're not using text messages. And it doesn't disrupt users' productivity. Because multifactor authentication usually, you only have to use it maybe once a day.
In some cases, you have to use it more or less. Some sites, it's only once a week that you have to use it. Now let's move on to our next one. It is how to detect a phishing site. Now we're talking about the pH fishing. And this is where the bad guys are trying to con you out of giving your information. So here are the main tips for detecting whether or not you are on a phishing site. Number one is to check the connection type. Make sure that the address bar shows a lot on it or and or has an HTTPS tag. Now that doesn't guarantee that it is who you think it is. If you want to dig into more, if you click that lock that's up on that URL bar, click that lock it, you can scroll through, and you can get more details, it'll tell you who signed this certificate and who the company is, that is using their certificates. So, you can usually make sure that it is who you think it is, okay? Most legitimate websites have valid SSL certificates issued by an authorized provider. In other words, you don't have to install some certificate on your browser. And they also indicate who the actual company is. Look closely at the URL. They, these phishing sites have URLs that are very similar to the real ones. So it might be micro snot. Instead of Microsoft, something that's easy enough for you to overlook. So look at them very carefully, make sure it is legit. They might be doing something like using.net instead of com or.edu or some other extension co look at it closely. There are online resources you can use. There's something called the whois database. It's been around for a long time part of the In fact, the whole internet structure that came into effect in the early 90s. You can do what's called a whois lookup if you're on a Mac Linux machine, you just use the whois command if you're on Windows, or a Mac, you can or Linux, you can use a web browser and just say who is space and the website that you're interested in. And usually, the search engines will send you to one of the main whois servers that are out there, and you can see where their site supposed to be, what it is, what they are, what the real domain name is. Website content setting up a website. It's a massive project that takes a lot of time, a lot of energy. If there's a lot of grammatical mistakes, low-resolution pictures, a lot of advertising, you're probably on a phishing site. Look for the privacy policy, contact information, those types of pages. Those are usually pretty much dead giveaways of a legitimate website versus a phishing site. So be careful when you're going online. Another tip is one that I've seen far too many times. Many people, instead of typing in the URL into the browser, they'll type it into a search engine which continually amazes me people do it all the time.

Craig Peterson 1:27:59
I have a Client whose accountant, their lead accountant, was going to Google and typing in the website address of the bank including.com. And Google would come up with the search results, and you click on the top one kind of blindly, right, not paying attention. Well, that's a great way that if the Google database is poisoned. An excellent way for the bad guys to get you to click on their website instead of the legitimate bank website. You might want to use a bookmark once you've got the correct URL, and then just double check when you log in that it is a secure server, and that it does have the right certificate. All right, everybody. Hey, thanks for being with us today. We'll be back next Saturday, same time 1:00 pm on WGAN. And I'm releasing these podcasts. They also go out on Saturday. So if you subscribe, you'll get all of this for Free, plus more subscribe Craig Peterson com slash subscribe. Easy enough, go to Craig peterson.com you can subscribe to my mailing list there, my newsletter, and you'll get all of this and more

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!  

Today there is a ton of stuff going on in the world of Technology and we are going to hit a number of topics from being aware of fake sexual harassment claims being used to mask malware to the advantages and disadvantages of future military technology, and why everyone should be using multi-factor authentication -- so stay tuned.

For more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

Don’t Take The Bait - Fake Sexual Harassment Claims

Can You Detect A Phishing Attempt?

Vulnerability in Popular Anti-Virus Program

Bots Losing Panache as Cybercriminals Hire In Third World

Not If, But When -- Don’t Think You Are Not A Target

Big Tech Has Your Private Medical Records -- Through Hospital Partnerships   

Future Defense and Military Tech

Best Practices in Authentication Still Mostly Ignored By Businesses

---

Automated Machine-Generated Transcript:

Craig Peterson 0:05
Hello everybody! Craig Peterson here. Welcome. Welcome, you are listening to me on WGAN and online at Craig Peterson dot com. Thanks for joining me. Today we are going to be talking about some of the most important things that are happening in technology as we do every week and more particularly what's going on in this security realm. We'll talk about how you can detect if it's a phishing site that you have gone to, New malware from TrikBot here, a brand new one. Some complaints here about McAfee. Every piece of anti-virus software McAfee makes has vulnerabilities. We'll talk about that major, major security problem. We've got an accounting fraud here and how it's getting harder to detect and Why we have breaches? You know, I talked to so many people, I have a lot of customers, a lot of business customers. And they're sitting there saying, Well, you know, this is all inevitable. So what should I do about that? We'll talk about that. Google, you might have heard of project Nightingale. We'll get to that today as well. Defense firms are on track to make some very, very scary hardware. We'll talk about that as well as some of the myths of multi-factor authentication. And there are a lot of myths out there about all kinds of this security stuff, frankly, but let's start with our friends at Microsoft. I bet you thought I was going to say Apple, didn't you? Well, we had a big patch day, Patch Tuesday, and it fixed 13 critical flaws this week, and one zero-day vulnerability. Let's start by explaining what a zero-day is. In this case, we're talking about a zero-day attack, which refers to a vulnerability that is undetectable by any current antivirus software or anti-malware software that has seen this particular problem before. Now you noticed that made a difference a distinction between anti-virus and anti-malware, right? Because anti-virus software behaves in a certain way. Anti-malware behaves well, frankly, a little bit differently. So what are the pros? What are the cons? What's the difference between antivirus and anti-malware? Well, as a general rule here, anti-virus is a subset of anti-malware. Anti-virus is something that we're doing now will probably continue to do forever. Still, it does not catch me. Most of the nastiness that's out there today, anti-virus is you know, at best release Some people would say zero percent effective, but I give it the kind of the benefit of the doubt. And it's about 20% effective. So if you have antivirus software, it's only useful about 20% of the time against all of these different types of attacks, it's probably close to 10%. If you pull in the human element into all of this, anti-malware software behaves a lot differently than antivirus software. Some of it is whitelisting, where it knows this is a legitimate piece of software that was not modified. So it allows it to run that on one side. These are quite difficult to keep up to date because you have to continually monitor what's going on in what the software upgrades are. What the checksums of that new version of the software are, their libraries, are they all legitimate all those DLL files and everything else they're using. It gets pretty darn complicated from the whitelist listing side. And there's a couple of companies that do whitelist. Some of them, frankly, do better than others.

Craig Peterson 4:07
Some of them, in reality, isn't even really doing whitelisting when you get right down to it. And then there is the next level up, which is the anti-malware software. And anti-malware is software that looks at the behavior typically of what's going on. And there are there's software out there right now malware this designed to fool the anti-malware software to so it looks at it and says, Okay, this just installed Wait a minute, started opening a bunch of files. Wait a minute, is writing to a bunch of files. Wait a minute, and it's changing all these file names. That's the type of behavior that would be typical of ransomware. Good anti-malware software looks at the behavior of a program as it is opening all kinds of part the TCP/IP packets, that are trying to use a network to get to all of these other computers that are out there on the network. What is it doing? How is it doing? Why is it doing all of that? That's good anti-malware software. So it will do all of that it looks at checksums, it looks at just all kinds of things. And it typically has about a 10% performance penalty on your computer, and it can be a little bit higher than that. But it's they're busy looking at everything, examine everything trying to figure out what to do. So we have anti-malware software out there, as well as anti-virus. Those are the two significant types of software you'll put on to your computers. And frankly, anti-malware like well we use has multiple layers of software, and it ties into external databases and, and Cisco Telos to get updates and everything else. So that's what we use us what we do. So, in this case, we're talking about a zero-day Hack against some of this Microsoft software. So what does that mean? Well, that means that we're as of right now, none of the antivirus software knows how to detect this as a virus, none of it. That's zero-day, it's day zero. So tomorrow will be zero-day plus one, right? So day one of this out in the wild. And Microsoft, with their Patch Tuesday, decided they would plug 73 security vulnerabilities in their software products, including 13 of them, given the top level of a critical security vulnerability. And I guess it's kind of fortunate that this month only one of the flaws is known to be exploited. And this is a CV, that's what they're called that scripting engine vulnerability and Internet Explorer, and the sooner they get rid of Internet Explorer entirely, the better off everybody lives. Everybody's lives will be IE; they built it into the kernel so that they could have more control over it. You might remember the lawsuit against Microsoft saying, Oh, you can't ship a web browser that's integrated right into the kernel. Because now, you make it so that none of the other web browsers can work on internet XP on Windows, which was right in the very beginning. And you're blocking us out of there, and thereby it's anti-competitive, you know, it's all true. Now, IE because it's inside all these versions of Windows, these vulnerabilities can affect users who are no longer even using Internet Explorer at all. In other words, you don't have to launch the browser. You don't have to go out to the internet. You could get nailed on it right away. Okay. Now Microsoft Office is using the same rendering engine that has this vulnerability that internet access Laura has, and it can be embedded and in fact, triggered by an active x control on a booby-trapped web page. Active x is one of the worst things Microsoft could have ever done. It's right up there with some of the vulnerabilities and flash and Java. You know, are you kidding me you allow a web page to run code on a machine. And they at least they have markers on it, but it can be Mark now was safe for installation. The whole thing's crazy. I still don't understand Microsoft, and what they're doing here.

Craig Peterson 8:36
So bottom line, make sure you do your update. I checked right before I went on air, and there aren't any significant problems that have been found with the updates here for November from our friends at Microsoft. They're often are. We also had this week, and some more patches come out from our friends, my friends, and yours from Intel. Now Intel makes a lot of the computer chips that are inside our computers, mainly for using a Windows machine. But Macs use Intel chips to, although they don't have to, I don't know why Apple went with Intel, you know, my guess was it was less expensive. And Intel also had some outstanding power performance numbers saw, you know, I can't blame them. But we have a bunch of patches that came out from Intel, that make all of their CPUs almost every processor they've made in the modern era is entirely vulnerable.

Craig Peterson 9:39
And that's a terrible thing, including vulnerable not just on your desktop, but vulnerable in all kinds of operating systems and data centers. So, if you think hey, listen, I went ahead, and we moved all of our stuff to the cloud. They are just taking care of because it's in the cloud. Microsoft knows what they're doing. The answer to that is, well, they kind of know what they're doing. But they're stuck with this Intel vulnerability. There will be more patches coming out according to the people that found these vulnerabilities in every model of Intel CPU, Major, major, vulnerabilities. According to these people, there are more than Intel hasn't passed on yet for whatever reason. It's really, it's kind of crazy, frankly. So we got Microsoft patches for some major ones. This week. We've got Intel patches, some major ones this week, we've got Adobe patches that are out as well. So make sure you do the upgrades. I'm not going to go into all the details here. Man Adobe light set of patches this month only 11 security vulnerabilities from Adobe and Adobe Bridge, animate illustrator, and Media Encoder. Two months in a row where there are no patches for Flash Player. I'm not sure what that's about if they keep happening with flash player or if something else is going on. All right, stick around. We're going to be right back. You, of course, listening to Craig Peterson here on WGAN, make sure you visit me online at Craig Peterson dot com. We've had a few pop-up-trainings already. I'm doing some Facebook Lives and getting information out, and you'll only find out about them if you're on my regular email list. Craig Peterson dot com slash subscribe, and all of today's articles are up there as well. And there's a sign up right there too. So make sure you sign up to find out about all of the latest that you need to know. Craig peterson.com, when we come back, we're going to talk about chick bought something new going on out there trying to get us to do something we just shouldn't be doing. Stick around. We'll be right back.

Craig Peterson 12:02
Hey, welcome back, everybody. Craig Peterson here, little beach music. I was out for the last week and a half out at a conference in Phoenix, Well I guess isn't exactly near the beaches is it, but it was sure nice and warm. And then I got back home, and you know what's happening up here in the northeast? Yeah, a little bit of cold weather. Some of it's a little too cold for my liking. You know, it just came on so fast. We were like in the 60s and 70s. And then all of a sudden it's like the 30s and 40s. I don't know what's going on. Well, let's talk about this TrikBot. It is a new malware that's out there. I've spoken to many times here on the show about what the FBI has been warning businesses, which is the business email compromise. You probably heard of that before bc we're talking about something that's cost businesses. Well over 10 billion, I think it's over $14 billion now. And we're not just talking about a little waste of time. No, we're talking about these guys and gals going right after our business bank accounts. And the way they do it is they're kind of sneaky about it, they get and get you to, to basically for the money, right to wire the money to do other things that are going to hurt your business. You may not realize it at the time, and they're just trying to fool you. Right. So how do you fool someone? And I know I know you can't fool an honest man. I've heard that so many times in the past, and there's a lot of truth to that. But here's what they're starting to do now. And you might have gotten one of these. I have had several listeners reach out to me. I and quite a few saying hey, I just got this email chain that, you know it's it's got a video of me visiting this, this nasty website out there right so you guys are probably heard about that one before it's been around a little while. Well, now what's happening is they are sending an email that appears to come from the US Equal Opportunity Commission. This email is saying that wait a minute here, and we have a sexual harassment complaint against you. Now I understand as a business owner, how this can be kind of crazy. And I owned a building, a business office that I had my business running out of, little more than 20 years, maybe a little longer. Ago now. And that business office, I put in doors, and all of the doors were floor to ceiling glass because I didn't want anybody saying that I was harassing somebody or doing something illegal. Now, of course, I, you know, we didn't have microphones and cameras and things. But I just wanted everyone to feel reasonably comfortable that no one was going to corner anybody. And, you know, I think I was kind of mostly successful about that one of these days or forever sitting down having a beer, you might want to ask me what happened there. But anyway, this is something called Trikbot, and it's a banking Trojan. And it's going after employees of large companies. And it's trying to scare these employees into thinking that the US equal Equal Employment Opportunity Commission EOC is coming after them. And they are trying to get them to and are being reasonably successful in having them handing over sensitive information. And they're using a bunch of different social engineering techniques, including malicious payloads or redirecting them to fraudulent sites they control by emails that look like coming by somebody they trust, etc. Okay? Now, these spearfishing emails, and I'll read you the text in one here in just a minute here. But they, what they end up doing is dropping a malicious payload on to your computer. And as part of this campaign, these malware operators use the information they've collected from people, such as their names that company they work for job titles, phone numbers, to customize these phishing emails to make them a lot more convincing. Now think about your business and your business's website and other information that you're making available to the public. Digital website has, who the officers of the corporation are.

Craig Peterson 17:04
Now I know that all of us for our businesses, we have to file with the state chapter file with the IRS and various other things. But when it comes to the state, those records tend to be public. So people can go online, they can find out who the President is, who the officers of the corporation are, who the Registered Agent is, etc., etc. Right? And so now a bad guy can go online and find out almost anything they want to find out about a smaller company because it's right there on the website. Now is that easy or what? Now let's go into one of these pieces of email. Everything from the email subject This is from bleeping computer dot com. Everything from the email subject and the message content to the malicious attachment. Each of these mouse spam email Males comes containing the potential victim's name. Now I'm looking at it here. It's got a form, and it seems like it's legit. It has the logo of what I assume is the US Equal Employment Opportunity Commission because it looks official enough to me, and the title at the top is the U.S. Equal Opportunity employment commission harassment complaint. Then the complete submission of a complainant form has initiated an intake interview with an EOC officer. Okay, this is what they're sending out right now. It looks very, very legitimate. And they use the name of the victim with a grievance raised against you. That's a subject for each of the phishing emails, and they're trying to get you to pay attention. They also have a customized email body to instill a sense of urgency. So it'll say, dear name of the victim, private and confidential. One of your co-workers has lodged a complaint with the EEOC. Now on top of it, all the malicious attachments, drop TrikBot payloads also have customized names. And again, it's the name of the victim-dash harassment complaint letter, and it's got a phone number on it. The entire purpose is to get you to open that attachment. And by adding this personal touch to the phishing emails, they've been increasing their chance of people opening them. Now, you know, I do a little bit of marketing for some of the courses that we offer and, and for some of the other services, you know, like the security services that we offer the businesses, so I've studied some of the marketing stuff that's out there. And I can tell you right now, most people, if you get an email that looks like that are not opening it. If you're concerned about a particular email and you have listened to my show for the last 20 plus years. You're very, very worried about it and legitimately so.

Craig Peterson 20:10
So I'm not sure just how effective this is, you know, spam emails right now have an open rate of about, well, it's less than 1%. Legitimate emails have an open rate of, you know, as much as 15 to 20%. So I don't know how well they're doing. But when they're sending out 10's or hundreds of millions of emails, we're talking about some pretty darn serious stuff here. A lot of potential victims. These are highly targeted and regularly updated. That goes into some of the problems with antivirus software we will talk about later on. And that is if it hasn't seen that before, it's going to get tricked. This spear-phishing campaign delivers the malware payload. It's evolving. It's a banking Trojan. The purpose is to get you to give some banking information out. And apparently, it's been pretty successful. By the way, it's been in the wild since October 2016, one of the most aggressive pieces of malware that are out there right now. Stick around. When we come back, we'll be talking about McAfee's antivirus software and what's going on with that. Especially as it relates to some of the malware that's spreading out there in the world, right now. Make sure you are on my email list. So you keep up to date with everything that's going on. Craig Peterson comm slash subscribe. I'll let you know about the pop-up-trainings. I want you to pay close attention because I'm not going to hound you about this stuff. And we've had a lot of people attending them. They're free. Usually, they have two-hours worth of content and questions and answers. Stick around. We'll be right back.

Craig Peterson 22:05
Hey, everybody, welcome back. Hey, did you see this? It was an announcement by one of the investment firms saying that Tesla might be missing the boat when it comes to electric cars? You know, we've all thought Tesla was the leader in the in that isn't so many ways right and built their battery factory. They've been just doing all kinds of amazing things, but it looks like they might be losing a little bit of an edge when it comes to the overall electric car business. Because now you've got Ford and GM, the major US manufacturers, I think Chrysler as well. I know Ford and GM both have some major stuff going on, as well as the Japanese firms like the Nissan LEAF. That's been all-electric for a long time, although Nissan stops making the thing some of these us manufacturers are definitely in the middle of it all. And you probably heard me a couple of weeks ago talking about some of the real risks when it comes to Tesla electric cars, particularly in the event of an accident. It's a scary thing. Frankly, it's a frightening thing being involved with the MS for all of those years to think about it. Well, we spoke a little bit in the last segment about this TrikBot malware using fake sexual harassment complaints as bait. We started off the hour talking about Patch Tuesday, and 13 critical fixes for Microsoft software, this critical fixes out for Adobe software, you got to apply these patches. According to the stats I've seen. There are, on average, about 65% of Windows computers that do not get updated at all. If this is you if you're one of those people, I urge you to spend a few minutes, let's make sure that the machines are updated. I know some people that say forget about it. I'm just going to replace my computer when it's just so far out of date. I know some people have done that with cars, too. I had a good friend I haven't talked to in years. But he was telling me that his dad did the math, back in the day, many many years ago. His dad did the math, and he figured that if he paid for oil changes throughout the life of an engine just wasn't worth it. So he said, Hey, listen. What did an engine cost back in the day it was a couple of grand for a boxed engine, and he was a mechanic he could quickly put in a new engine. And if I pay for oil, filters and my time to change the oil
I will pass the break-even point at about 30,000 miles. So, in 30,000 miles, it was cheaper to replace the entire engine, than to pay for years of oil changes. Can you imagine that? So I did some quick mental math, and I agreed with him. He said, Listen, it's not as though I don't have oil in the engine. The engine will run off this known oil in it. But all I do is add oil when it needs oil added, and he never changed his oil. And at about 50 to 80,000 miles, you'd have to replace his engine. So he figured he was ahead of the game. Nowadays, with these new engines and filters and oils and the oil is just so thin. Nowadays. They're saying 10,000 miles give or take between oil changes, so it's not anywhere near as bad. Plus, some of the cars today will tell you, hey, I know Need an oil change? So you don't even have to keep track of the miles, you know, used to be 3000 miles. Do you remember you might not be old enough to remember, but the oil did not have the cleaners in it now, nowadays they have been detergents because your engines would get all sludgy? And what a mess ever take one of those apart, even just the head of the engine, the mess that was in there, we don't have those problems nowadays. Well, some people have taken that whole idea of, hey, it's cheaper to change the engine than it is to change my oil. They've taken that to the extreme. But you know, it is not like that when it comes to computers. You can't just have the laptop sitting on your desk or under your office and leave it there for years to come and say, Hey, listen, when it breaks down, I'll replace it. I'm not going to bother doing upgrades of my software won't work because it's running Windows XP, or whatever some old version of Windows, I'll go out to one of these, big-box retailers, and buy another computer and throw this one away.

Craig Peterson 27:14
That is a very, very bad idea.

Craig Peterson 27:16
And I suspect that's where some of the 65% of people come in, that are not maintaining their computers. Now you have to keep them because unlike your car, your computer is continuously under attack. So, that means you have to not just upgrading and updating windows but all of the software that's on your computer. You know, I talked a little bit earlier about Internet Explorer, and only Internet Explorer alone having it on your computer will cause other programs on your computer to get infected and allow hackers access. It's just plain old, not worth it. Well, let's talk about Anti-virus doctrine. Oh, you remember I said antivirus software? Yeah, I convinced myself that it's, it's about 10% effective at no more than that guaranteed. And we can go through all the numbers again, if you want to buy me a beer sometime we'll sit down and go through all the numbers, and how virus software does not work.

Craig Peterson 28:19
Well, Let's talk about some software that doesn't work. McAfee antivirus software. In an article from ZD net, has a code execution vulnerability, a severe security flaw that can bypass the self-defense mechanisms built into McAfee antivirus, very, very big deal. Safe breach labs, their cybersecurity team. It is one of the groups that go around and test software, tries to find vulnerabilities, and then lets the manufacturer know so they can take care of it. But they're saying that this particular vulnerability can be used to bypass McAfee self-defense mechanisms and could lead to further attacks on a compromised system. Now, this vulnerability exists because of a failure by McAfee's programmers to validate whether or not these DLL's it's loading have been signed, let alone appropriately signed. Remember, I even mentioned that in the first segment today. These self-defense mechanisms are essential, and they need to be in place, even though the antivirus software is going to be at best 10% effective at least you would have 10% effectiveness right. So because they can bypass the self-defense mechanisms and leading to further attacks on a compromised system. It needs to get fixed right away. See an arbitrary unsigned DLL that gets loaded into multiple services that run is NT authority, backslash system.

Craig Peterson 30:06
Now, the only good news is that attackers need to have administrative privileges to take advantage of it. However, I rarely walk into a business where everyone isn't running with, with, frankly, administrative privileges. The companies do that, and I understand why they do it. It's a bad thing to do should never do it. Right. But I know why they do it. They do it because, oh, it's just so much easier if I have to install software right or to call the IT person. And the IT person is the Assistant to the owner. And she's always busy. He's still running around doing stuff. I don't have the time, and I can't keep asking for permission to do things. So, everybody gets administrative authority. There are three main ways and which is why vulnerability gets exploited according to the Safebreach lab. Anti-virus software might not detect the binary, and it loads it without any verification against it. Impacted software includes McAfee total protection, anti-virus plus AVP from McAfee, and Internet Security up to and including the version 16.0 point 22. You must get the latest software. So, if you have McAfee update, pronto. And as I said, you should update, anyways. And don't use antivirus. I recommend getting a robust anti-malware stack of software.

Craig Peterson 31:39
So what are people doing? Vendors doing? They're just renaming their stuff is anti-malware stacks. Yeah, yeah, that'll fix the problem. Your listening to Craig Peterson on WGAN stick around. We'll be right back.

Craig Peterson 32:02
You know, it's funny how you get used to the weather, whether it's hot or cold. You're listening to Craig Peterson here on WGAN. And online at Craig Peterson dot com. You'll find my Facebook page by going to Craig peterson.com slash Facebook. And I've started posting some stuff up there. Well, I do that actually, every day. My wife is the one that's putting the articles up that I come up with every week, every day. But you are also starting to find I'm doing Facebook Lives and YouTube lives, and just you know, I'm getting a little better at some of this stuff. And there are a lot of possible angles here. By the way, you know, I mentioned I was at this conference, and I was learning a little bit more about marketing and product development out there. Product development is what I kind of love doing, Right. We can do it quickly. We know what we're doing. We know how to do it. So we're trying to figure out how can we produce a very inexpensive product that is going to help a lot of people when it comes to security. And I think we've got the answer. I don't want to be, you know, mean and nasty about this, but we're working on it. And we should have something in a couple of weeks from now, that I think is going to change lives. I think this is going to be earth-shattering. If we do this the right way, it is going to change everything for anybody that decides that this is for them. So we'll be talking about that in a couple of weeks from now. But it's an idea from another industry that in fact, it's the tennis, tennis training business, and I think it's like the world's most perfect idea. Here when it comes to us, so we'll be talking more about that. But you can find that you can find information on the articles that I have every week, you can see all of that stuff you can find out about the free pop up classes, the pop-up-trainings that I've been doing, you can find out about some of these Facebook Lives and YouTube Live. All of these are free training. I'm just trying to get this information into your hands. You know, the Whats, the Why, and the Hows, all of that stuff. And there's only one way to get it. And that is to sign up, go to Craig Peterson dot com slash subscribe, and I will make sure that we send you every week just a quick summary of the stuff that's going on. I'm going to have a special sign-ups for these pop-up-security-trainings, So no, I'm not going to send you a lot of emails unless you ask me to write by default. We got a great article from Joan over at darkreading.com. Dark reading dot com is one of those websites, one of many to which I pay quite a bit of attention. They do have some great, great content. In this article, they're talking about fraud and how it has changed. You, I'm sure, are familiar with our friend, the Nigerian prince, and all the things he did and how he tried to get his money out of the country. And all he needed was to use your US-based account, and you could keep some of that money. You remember that right then, it's just full of misspellings. It was just terrible, and there are reasons for the misspellings, there are reasons for the way they do things. No doubt about it. Well, things have changed. Now economics have changed. And they are swamped, making a whole lot of money. And they're doing it in different ways. They've done it before. You know, we've got tools now to detect and mitigate some of these attacks. And the easiest way to do that we have some software that all the email flows through, and it's looking for patterns look, make it look like it's a bot that sending out these emails. And when we put those this particular filter in place, in fact, it's and AI bought itself. That right the Battle of the AI that's coming to, but you know, the amount of spam these things dropped by 90 plus percent. It's just it's dramatic, how much it helps.

Craig Peterson 36:58
Well, what has happened now is the bad guys have found that labor is getting cheaper and cheaper in some of these developing nations out there. And they're able to get people in Venezuela, for instance, where they are starving to death where they are picking through garbage because of their socialist government. And man, I saw this thing the other day, it just shocked me, they were using a sharpie to write on people's forearms a number, so they knew when they could get food. Yeah, when they could get food from the grocery store. That's how bad it is in Venezuela. So you have to wait in line. You have to obtain a number one thing. God is not a tattoo. It's a sharpie, but you have to get a number there on your forearm, and then you can get Food. And if you can't wait, and if you don't get enough food for your family, you're going to have to go through the garbage. It's just absolutely insane. Well, cybercriminals are hiring workers in Venezuela now, where the hourly wage has gone way down compared to other currencies. I am not sure if you remember, but Venezuela used to be the wealthiest nations in Central and South America by far and is now one of the poorest countries in the world thanks to their socialist government. Well, the hourly wage is so low that it now makes economic sense to pay people to manually carry out the fraud to write these fraudulent emails to research to get the stolen account data instead of using bots like they have been doing before. So, here's a quote straight from the article. "attackers are giving people a script and saying here's a quota you have to hit, criminals are always trying to figure out what is the lowest hanging fruit as merchants and companies evolve with defenses, these attackers evolved, humans just happened to have become the flavor of the month." So, these human-driven attacks are increasing quickly and exponentially. Now, the most recent fraud report that came out covering q3 2019. So. just this last month, found that attacks carried out directly by humans, both loan perpetrators who are trying to get money to support their families in third world countries, and organized criminal groups increased 33% over the previous quarter, nearly one in every five fraud attacks are manual now rather than automated.

Craig Peterson 39:57
Now, of course, their goal is to look as legitimate as possible. Having humans involved does increase your chance of success. And so many people worldwide speak English because English is the international language of business. And it's causing a problem. This quarterly report that came out from our coasts looked at 1.3 billion transactions spanning account registrations, logins, and payments in the financial services, e-commerce, travel, social media, gaming, and entertainment industry's overall fraud increased 30%. In q3, and bought driven account registration fraud is up 70% as cybercriminals test stolen credentials, in advanced of what in advance of the US holiday season. Isn't that amazing? But now every third attack on financial services is manual. Attacks are coming from fraudsters now with access to stolen identity information. They're using the latest tools. Over half of the attacks that originate from Russia and China are now human-driven. It is changing everything. The data highlights that the entire attack incentive for countries across the globe is economically based. We've got some substantial economic things happening here in the US. If a nation's currency is worth only a fraction of the US dollar, then the incentive of a criminal in that country to defraud an American business
is very high, because they've got that multiplier based on the value of their currency compared to the value of the US dollar. So, it's incredible what's going on. You've got to watch it. You got to be careful that There are a lot of bad guys out there that are looking to get their hands into your accounts. And we've got this shopping season right in front of us now. So what I would suggest to everybody is, check with your bank, depending on your bank, some of the banks and doesn't matter if it's visa or if it's MasterCard visa sent tends to be pushing this a lot more than MasterCard is. But whether it's Visa or MasterCard, you're going to find that they have virtual card numbers that you can use. And the idea behind these virtual card numbers is that you have a one-time card number that you can use when you are buying something online. So, instead of having your regular credit card number that you're using, that's sitting there in a merchant database, that may or may not be configured appropriately or secured. Remember, a secure server doesn't mean that their servers secure; it just means that your data going to it is protected in transit. Instead of giving them your real credit card number, and having that stored in a potentially insecure database, now all you have to do is give them that temporary credit card number. Go to your bank, and you can usually check on the website before you start buying stuff online for Black Friday. And we're going to have some Black Friday deals to or Cyber Monday, or you know, whatever it is for Christmas, for Hanukkah, for whatever you're celebrating. We have birthdays to over this holiday season. Get your bank to give you access, and this will be online access to get a different virtual credit card number every time you do a transaction online. It's cheaper for them to do that than It is for them to issue new credit cards when compromised or stolen. It keeps happening. All right, stick around. We will be back. We got one hour to go. We're going to talk about Google's project Nightingale and see if that's scary enough for you. We are concerned here about some of the defense firms, multi-factor authentication. I will run through how you can tell right what's the best way to do it. And how to detect a phishing site. We'll get to all of that. In the next hour. You're listening to Craig Peterson on WGAN and online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 44:52
Hello, everybody, Craig Peters on here on WGAN and online at Craig peterson.com. Hopefully, you join me there and sign up for my email list. I get you in my newsletter. You can do that by just going to Craig peterson.com slash subscribe and subscribing to my newsletter. Every Saturday, we are here and talking about some of the latest in technology and security. The things that frankly you don't hear about, at least not the right answers in the general media out there. It's just amazing to me how many things they get wrong, again and again, and again. I try never to attribute to malice what can be easily attributed to incompetence. Is that a terrible thing to say about some new people in the media? You know, if you get right down to it, they have so many things that they have to know about and be semi experts on to write some of the articles, so I guess I really can't blame them for well for least Some of that. Well, let's talk about the chaos here for a couple of minutes. We are in the new normal. Now I'm not talking about with President Obama said the new normal was, which is people high, you know, unemployed, high levels of unemployment and stagnant economy and stuff. I'm talking about a recent survey that was conducted by a security company out there that showed that 86% of 250 top security officials who participated in this survey believe that cybersecurity breaches are inevitable. Now that opens up a whole can of worms because it's unavoidable, does that mean there's nothing you can do about it? I think by definition, it does. It is inevitably going to happen no matter what you do. So why do anything? Many people have done nothing. Remember, in the last segment, and if you've been listening in the previous hour, I talked a little bit about how 65% or so of computers never were upgraded. That's, that's a bad thing, right? And nowadays, when we get right down to it, and we're talking about these 250 professionals, people that know what's going on. We're talking about people who realize that the complexity of today's cybersecurity in businesses makes it so that it's almost inevitable. Now, when we think about cybersecurity, and we're thinking about companies. Obviously there is some truth to this for home users and, and that's why we did this security summer you know, I had that hundred and 50 pages of cheat sheets that we gave away to everybody. Who participated in this. And it was designed to help you understand what you had to do in different circumstances. And hopefully, you got all of those I start, you know, they were all sent out well, by the end of September, because, you know, summer doesn't end until September 21. So I little extra time as my team and I delved into that labor of love out there. But there are a lot of pieces moving parts to this puzzle, and it makes it very, very difficult. Nowadays, we're making our lives even worse because of cloud adoption. We're using cloud services. We're using hybrid environments spread across physical machines, different locations, different teams, various cloud providers, and now businesses are using something called containers. I remember when I first heard about them, I was thinking about, well oil container on Okay, so we're talking about the types of things you put on a truck and then put on a ship right or, or you can rent while you are making the improvements like I did in my kitchen.

Craig Peterson 49:11
I got one of these little containers, one of these small pod containers, and loaded it up with all of our stuff while we were working on it. Yeah, that's not what the containers at the businesses are using. These dedicated containers perform a specific purpose, like running a website, or a database or something else. It's just getting very, very difficult to keep track of it all. And frankly, that's why we're seeing some of the major breakdowns. Now we do not see in these in breakdowns like Equifax. What was that? It was, Oh, yeah, a username of admin with a password of admin rights. Stuff like that is just plain old, stupid, but because of everything so complicated and were not tested thoroughly, they broke in. Now, if you are in a business-like, for instance, a shipbuilder, you are thinking about failures. Because if you're out in that open ocean and you get a rogue wave that comes in, hit you on the side, your ship is going to flip over. Now obviously, you don't want to name your ship, Concordia. Another one just ran aground this week over Norway. Of course, the big Concordia running the ground was in Italy, and what a mess. But shipbuilders realize that ultimately, ships are going to fail. There is going to be that rogue wave, or it is going to run aground or the propulsion systems going to go down. And the extremes are like submarines where you have all the compartments, and the idea is that a breach might occur in one compartment, but the other compartments will not. So we're spending billions of dollars, and we're likely preventing a lot of bad stuff. The number of high profile breaches is just increasing and causing devastating damage to us as consumers. It's going to last for decades. And why? Well, like so many other industries, people in the security business are not preparing to fail. And companies are not preparing to fail. It's like what I teach in my backup course, the three to one backup methodology, and I should do another pop-up-training on that. Frankly, you've got to have multiple copies of backups numerous generations of backups on various types of media, in numerous sites, because of Smith's commentary. Now, you might not be familiar with Smith's commentary, but Smith's commentary on Murphy's Law is that Murphy was an optimist. And of course, Murphy's Law is, if anything can go wrong, it will. So shipbuilders have engineered the systems, they have segments in the halls, they have multiple hulls, double triple hulled ships so that if it's carrying oil or something else, if there is a penetration to the hull, the ship won't dump oil or whatever, into the ocean. It's been done this way since the 15th century. And it's been done in today's modern vessels as well. Even the Titanic had some of these things in place, although it had some other problems. I don't know if you've seen some of the more recent studies, by the way, on the Titanic. It's fascinating. But it looks like what happened was, there was a fire in the Titanic's hold coal fire that they couldn't put out. And they had been smoldering and caused a weakening of the ship's hull. And that's why when it hit that iceberg it tore open. But that's another story here. So let's talk about some principles here security principles that they use in shipbuilding that we need to look at in modern IT. Shipbuilders assume that at some point, the ship will suffer leak. So how do you protect against that? How can you fix that? Well, they create holes that prevent a single leakage from sinking the whole ship. So, in the same way, you have to assume there might be a breach in your corporate environment and segment your network so that it doesn't spread. There's a lot of details we could discuss, and maybe I should do some Facebook lives on these things.

Craig Peterson 53:52
Your staff who's responsible for maintaining the ship's hull is monitoring for leaks. They're watching for leaks, and they're regularly patching. They're painting they're scraping right to get rid of the rust and to make sure that there isn't a major flaw in the ship's surface, or you know, hull, they're trying to keep the ship safe. So, in the same way, our modern security teams have to be vigilant about monitoring and patching. To prevent these cracks in the perimeter, as well as the interior. We just last week had a client who had an internal breach. They were using a VPN to allow our remote office to get into their primary network. That remote office was breached and was used as a launching pad to get onto their primary network. And then once on one machine on the main network that they could breach, they now we're able to spread within the main network. We got to watch this. The ship's most sensitive equipment is in the engine room. And in the tape game you know in the case of a business you got to venture critical IT assets are considered ships that staff lookouts 24 seven to make sure there is a good watch, we need to do something similar with our data. Keeping the crew from accessing the bridge is an important safety measure. We got to make sure that our user identities get set up correctly and their employees, contractors, remote users can only get data they should be getting to. And we could go into attack after attack after attack. But the bottom line is when you're designing your security, you have to anticipate a breach. You've got to patch everything, keep it patched and up to date. And you've got to segment your networks. And if you need to be secure, the newest types of networking are called zero trust networks where nothing can talk to anything else on the network. Unless it's explicitly allowed because we can't trust it. So the very least segment out your Internet of Things devices, make sure your sales guys are on a different network than your accounting people. Right? Break it all down in the business space. When we get back, we're going to talk about us in the consumer world and Google's Project Nightingale, man, is this a scary project, but you know, heck, it's Google, but not can do anything wrong right here listening to Craig Peterson right here on WGAN.

Craig Peterson 56:43
Hello, everybody. Welcome back. Craig Peterson here after the top of the hour. And we are talking about the latest in security and technology. What's going on out there? We cover in some depth here some of the things that you need to understand. Some of these things are specific questions that I've gotten from you. So if you have a question of any sort you'd like me to answer on the air or maybe answer directly, email me. It is ME at Craig peterson.com. I am glad to do it, or you can drop it on my Facebook page. Now I have to say that I get thousands of emails a day. So sometimes it can take me a while to get around to it. So don't feel bad if I don't answer your question right away. But I am pretty good about answering most of the questions that people ask and particularly if you email them me at Craig Peterson, dot com that's so that's what I monitor kind of the most. Some of my team helps you track that too, which is a very, very good thing. Mountain View, California dateline. It is a scary story. And you know, we just had Halloween, but here's what's going on. You might not be aware of it. HIPAA is a law put in place, oh, decades ago now, I think maybe even as much 20 years ago. The most significant part of HIPAA is this whole concept of portability. Now, you may not realize it, the bill was certainly not advertised as being this way, but it is this way. Here's the problem. Before HIPAA went into place, what was going on if you had your medical records, and those medical records had to be kept private, they could not share them with anything and what HIPAA did was. It defined the rules for sharing, among other things. Before HIPAA, your medical records were considered private and kept secret. After HIPAA went into place, your medical records could now be shared anywhere almost in the medical community. And of course, with portability, the idea is, well, you've got your medical records, you want to go to Florida for the winter. So you want the doctors in Florida to be able to have access to your medical records, which is all well and good. It makes a lot of sense. However, other things going on in there still are. If I want the medical records of every patient in hospital x or health plan, why? And I say, Hey, listen, I'm going to buy the company. I'm thinking about buying the company. I'm thinking about purchasing that hospital. The hospital has the right to give me all of your records. That's the bottom line. Scary. And that's been happening. Our medical records have been shared and traded like trading cards. So, one of the largest health systems here in the United States is called Ascension Health. And you might have heard of it before, mainly if you are at all involved in the Catholic nonprofit health system. The Catholic Church has taken care of millions of patients for free, much of the time, you know, no charge to the patient. But the Catholic Church has been behind many of these medical hospitals and medical treatment that has been out there that we have used for generations, frankly, and you know, good on them. It has been wonderful. And they've kept costs under control reasonably right. By right by where I live. There's a Catholic medical center that is renowned in the region for its cardio care. And like many other hospitals that are out there, they will also provide charitable care for those people who can't afford it. So Ascension partnered is with Google Now ascension is, again, the largest health system here in the country. And it partnered with Google. And Google now has access to detailed medical records on 10s of millions of Americans according to a report by the Wall Street Journal, and It is code-named Project Nightingale, I'm sure you can figure out why they call it at night and Gail. And it has enabled at least 150 Google employees to see patient health information that includes diagnosis laboratory test results, hospital records, and other data. Now, remember before HIPAA, man, you could have sued and won if your medical data got shared without your knowledge, let alone your permission. Now, some of the negative results of those HIPAA regulations are coming to light, where the largest health system in the United States, Ascension, shared your medical data with Google. That is a very, very big, big deal. Now, this is reported by the Wall Street Journal, and it's according to internal documents and the newspapers other sources in all the data amounts to complete medical records and contains patient names and birthdates according to The Wall Street Journal. Now, this is a move by Google to try and get a strong grip on the medical business, the sprawling healthcare industry. In November, Google announced a deal to buy Fitbit that has gone through. I'm sure you've seen that. So now, it has access to all the sensitive health data that amassed from Fitbit. How much information have you been giving them? They've got all kinds of health records. They've got what have you put into those things? And we have Google, Microsoft, Apple, and many others competing to get access to all of our medical records and to be the storehouse so that when you go to Florida today, your records are there because you shared them on purpose. Neither Google nor Ascension, according to The Wall Street Journal journal, neither Google nor the country's largest health system Ascension has notified patients or doctors about the data sharing 2600 hospitals, doctors' offices, and other facilities across 21 states and the District of Columbia. So Google's ultimate goal is to develop the searchable cloud-based tool, but here's what I found particularly interesting, and that is about transforming care. In a statement from Ascension, the VP of strategy and innovations, Eduardo Conrato said, "as a healthcare environments continue to evolve rapidly, we must transform to meet better the needs and expectations of those we serve, as well as our caregivers and providers." So what are they doing? Here? Well, it turns out that apparently, they're having the hospitals enter in your data to these healthcare records, uploading them, analyzing them, and helping the doctors come up with diagnosis as well as prognosis frankly. They're hoping to improve outcomes, reduce costs, and save lives ultimately, and you know what they probably will. But the issue at hand here goes back to the HIPAA act of 1996. And should we be able to control our medical records? That's the big question. It looks like the answer to that is no and has been for 30 years. Thirty ish years not quite 25. All right. When we get back, we're going to talk about Rola robots of the killer variety. What is going on with some of these government contractors out there? Man is a scary show, isn't it today well after compensate next week, you're listening to Craig Peterson here on WGAN and Tune on Wednesday mornings at 738 with Ken and Matt, and I'll be online there too.

Craig Peterson 1:06:38
Hey, Craig Peterson here. WGAN. Online Craig Peterson dot com. We are nearing the end of the show here. We only got two more segments together. But that's enough time to cover a couple of these articles I want to get to today. Let's start with this one first here, which is the Robots. You know, I have long been concerned about robots as have many other people. Some people much smarter than I have been very concerned about them. Take a look at what ElonMusk has been saying. That's part of the reason he wants to move us to Mars is artificial intelligence and robotics. Think back wow, even to the like the early 1990s with iRobot. And, and that Russian author, I can't remember what his name was, but it's been a concern for a very long time. Now, things changing rapidly. In an article from QZ.com, a new report is out from Pax, a nonprofit based in the Netherlands that's campaigning for peace around the world. And of course, Pax is the word for peace in many languages, and they're warning about this new potential trend that's coming out. I don't know if you've seen some of these moves. Movies where there are swarms of drones. And those drones swarm in on something. There was a recent one, and I think it was Angel has fallen with Gerald Butler. And the President is tagged by the attack by this swarm of drones. We had the same thing happened. I think it was only one or two drones in South America trying to take out a president down there. Well, our militaries are looking at some of this newer technology to conduct war. And you know, frankly, they have to because the bad guys, the other guys, whoever our ultimate future opponents are, are looking at this as well. China has spent a lot of time on it. And if you look at something like these drones, you could easily have killer drones out there. These drones have to have an ounce of high explosives in them, get close to a combatant, and explode themselves in Kill the combatant. That's all it takes. We're worried about what's being called this third revolution in warfare. The first revolution was gunpowder. You know, you could argue right bows and arrows and various things, but the gun powder was a considerable revolution in warfare. And then you had the atomic bomb, which was not too long afterward. The Chinese invented gunpowder. But now activists and military leaders are calling for international regulations kind of like what we have with the Geneva Convention where we defined how wars get fought. They want to govern all-new weapons systems that have a type of artificial intelligence in them, a type of machine learning. They don't want life or death decisions to be made on their own by these intelligent systems. And they're looking to ban them outright. Key governments, including the US and Russia, have resisted it so far, and I understand right.

Craig Peterson 1:10:18
But what are you going to do? nears we can tell militaries have not yet deployed killer robots on the battlefield? At least offensively? What are you going to do with a robot that makes life or death decisions and gets it wrong or gets it right heaven forbid, either way, where you've got a robot out there that it doesn't have to think twice about pulling the trigger to kill someone because it doesn't think twice about it. It's almost like having some of our troops sitting in Virginia, flying a killer drone in the air that's over a site 5000 miles away. And just pulling the trigger and off that missile goes. That is not a life or death decision made by that missile. That is a life or death decision made by a human that has to pull that trigger. That's frankly a very, very big deal. The big difference between the two. Now this organization called PAX has identified at least 30 Global arms manufacturers that don't have policies against developing these types of automatic life or death, killer weapon systems. And apparently, they're doing it at a rate that's outpacing regulation. Now, this is normal when it comes to technology. I've talked about this so many times. Technology always leads any regulation, and it's still in front of the laws. It's still outpacing the regulatory ability of governments, but we're talking about companies that include Lockheed Martin, Boeing, Raytheon. We've got some Chinese state-owned conglomerates like a Vic cask, Israeli firms IAIL bit Raphael, Roz tech of Russia, Turkey's STM. It is a very, very big deal. So what are we going to do about it? It's, it is a very, very good question and courts are trying to address it. You will see this article if you're interested in it up on my website as well at Craig Peterson, dot com. Still, activists don't believe that the military use or some degree of artificial intelligence is problematic in itself. The problem or the systems that are designed with AI to select and engage targets, right? The terminology that's used is acquired, identify, and engage targets. And they're able to do it at least three times faster than any human. Today, we use those types of systems, but a human still has to authorize it. So I'm I'm concerned about this packs is more concerned about the potential deployment of artificial intelligence and offensive systems, the systems that are used to go after people that will select and attack targets on their own without human oversight. I think that all makes sense. And the question is, are we going to get regulations are we going to have a Geneva convention that covers this type of technology out there? Who's accountable if an autonomous atomic weapon broke existing international law or some of these future laws or regulations, and we're talking about lives on the lines? We're not talking about weapons destroying weapons. So I'm very, very concerned, defense firms. According to courts, they're not building these weapons in a vacuum. The PAX guys are saying companies believe that's what militaries want in the Arsenal's and I'm not sure the wrong about that. Google and Amazon have both face public criticism about what they have been doing for the military. Although I have to say both of them have been to face about it, notably Google who is developing artificial intelligence at three facilities in China with the involvement of the Chinese government. And they're not doing it here in the US and yet at the same time, they won't do minor things that are designed to help protect us in that it states you know, Google I just don't get it. Understand this stuff. But there's a whole list here of weapons that are existing now. These little loitering munitions, kind of like land mines that sit in the area they wait, like maybe loiter in the area for hours before they attack a target, small or cheap that can be easy to produce.

Craig Peterson 1:15:17
And there there's just a whole lot of them. They've got STM This is a Turkish state-owned defense company that produces an AI-equipped loading munitions got facial recognition, kind of like again Angel has fallen can automatically select an attack targets using coordinates pre-selected by an operator they're looking to use Turkey is Kamikaze drones and Syria. There's harpy a fire and forget luxury munition manufactured by Israeli aerospace industry ranges 62 miles tail off for two hours. What's next, right, what are we going to do? All right, stick around. We're going to talk about the mess of multifactor authentication. How did he tech, a phishing site when we get back? You're listening to Craig Peterson, right here on WGAN. And of course online, Craig peterson.com. Stick around. We'll be right back.

Craig Peterson 1:16:25
Hey, welcome back, everybody. Craig Peterson here, Happy Saturday weekend. Whenever you're listening to this, of course, we podcast this show as well. And with more than 20 million podcasts, there's bound to be an episode that you're interested in as well. You can listen to that by just going to your favorite podcast streaming site that you'd like to, and you can sign up under iTunes or Spotify. I'm on TuneIn. I'm kind of all over the place, and we've had a lot of good Great people downloading it, which makes me happy as well. You will find all of that. The easiest way is to go to Craig Peterson com slash iTunes, I should put a special page up that just gives all the podcast info, but for now, slash iTunes. And I'd really appreciate it if you would subscribe because that's what really helps drive up our numbers. And that's what helps get people to notice. And in fact, if we had a whole bunch of people sign-up at once or you know, over a week, then the algorithms would notice that, and they would get promoted a little bit more. So I would love it if you do that. But you know, that's up to you. Again, Craig peterson.com slash iTunes. Hopefully, I've earned a five-star rating from you. Or you can just with the TuneIn app, which by the way, you can listen to WGAN on the TuneIn app as well. And you can listen to me on Wednesday mornings at 738. with Matt and can on the TuneIn app so even if you're on the road anywhere in the world, you can listen to this station you can listen to me, and my podcast is also here on tune in. All right, an app, and a website. We got some how's here, you know, I talk a lot about the what and the why. And I give you some how's as we go through the show and a lot of the How is really left for trainings when I do courses and trainings. But we got two articles that I really want you guys to understand a little bit better. And one is from sigh where ones from dark reading. And we're going to start with this first one which is which is the myths of multi-factor authentication. Now without multifactor authentication also called two-factor authentication. In one employee, employees leave, they can quickly get back on if you don't change their passwords, but if you take their token, their physical token back, then life's a little safer. If people lose passwords, if you are a home user, and your password is stolen or compromised, someone can log into the websites. So let's talk about what this is. The best type of basic security is something you have, along with something that you know. So something that, you know, that would be an example of, for instance, your username and your password. So you put them together. And that's something that you know, your username and your password. And then something that you have might be, for instance, a token a digital token. I don't know if you've seen these. We use the type with a lot of our customers that aren't very, you know, technically advanced, that have had like a little six-digit number that keeps churning Gene on the token. So when they go to log in, so for instance, they will use this for a defense contractor or a doctor's office where they have to keep information safe. And when they log in, they're going to put it in their username, and they're going to put in their password. And then they're going to look at their token. And they're going to type in that number that changes every 60 seconds or so. Now you can do this type of two-factor authentication in several different ways. You can do it with your cell phone, a lot of people do it that way, where you get a text message from the website, giving you a code that you can type in.

Craig Peterson 1:20:46
Now that's cutesy, Don't you love that I get my code on my phone. That is eminently hackable. One of the articles that I found this week, but I'm not going to share with you guys because it's you I don't have enough time. But it's, it's all about this guy that just lost $20 million in Bitcoin because he was using two-factor authentication, but he was using his phone, and then somebody sim-jacked them. And that's where a cybercriminal takes over your phone number so that when they try and log in, in this case to his Bitcoin account, I'm simplifying this I know. But when they go to log into his bit calling account, it sends a text message, and then he types it in, and then he's in Okay, so using your smartphone with SMS with text messages is not very smart because it's easy enough to get around. So use something like we use dual DUO. It ties right in with one password, which we also use. It's fantastic for your business. Now, if you're home, you User look at Google Authenticator. That's what it's called Google Authenticator. It's free. And when you go to a website, and you sign up, and you go to your settings and your security settings, you'll find there that it often has Google Authenticator as one of the two-factor authentications. So you install this app on your phone, you're going to scan a little code that comes up on the screen using your phone, a short QR code, or maybe you're going to type something in the URL, etc. And it will set you up. Now when you go to that website, later on, to log in, you're going to put in your username, you're going to put in your password. You can open up your phone, the Google Authenticator app, and you're going to go to the authenticator app section for that website is going to give you this six-digit code. You're going to type it in, and it knows that it's you. That is an excellent way of doing it. Mike Soft, of course, being Microsoft has to do differently than everyone else. And Microsoft has its authenticator app that you can use to authenticate their websites. I don't think anybody uses Microsoft authenticator other than Microsoft, but I could be dead wrong there. So that's the easiest, cheapest, and best way to do multifactor authentication, not using text messages.

Craig Peterson 1:23:28
Now the myths are that large enterprises only should use MF phase multifactor authentication, absolutely false and home users should as well. Retirees should, in fact, use it. It is more critical for small businesses or home users to use MFA than it is for the large enterprise because you probably don't have all of the other security defenses and staff in place. It's only used to protect privileged users again, wrong. You don't want your bank account emptied. It's not working Perfect, which is true, but it's darn close, mainly if you're not using text messages. And it doesn't disrupt users' productivity. Because multifactor authentication usually, you only have to use it maybe once a day.
In some cases, you have to use it more or less. Some sites, it's only once a week that you have to use it. Now let's move on to our next one. It is how to detect a phishing site. Now we're talking about the pH fishing. And this is where the bad guys are trying to con you out of giving your information. So here are the main tips for detecting whether or not you are on a phishing site. Number one is to check the connection type. Make sure that the address bar shows a lot on it or and or has an HTTPS tag. Now that doesn't guarantee that it is who you think it is. If you want to dig into more, if you click that lock that's up on that URL bar, click that lock it, you can scroll through, and you can get more details, it'll tell you who signed this certificate and who the company is, that is using their certificates. So, you can usually make sure that it is who you think it is, okay? Most legitimate websites have valid SSL certificates issued by an authorized provider. In other words, you don't have to install some certificate on your browser. And they also indicate who the actual company is. Look closely at the URL. They, these phishing sites have URLs that are very similar to the real ones. So it might be micro snot. Instead of Microsoft, something that's easy enough for you to overlook. So look at them very carefully, make sure it is legit. They might be doing something like using.net instead of com or.edu or some other extension co look at it closely. There are online resources you can use. There's something called the whois database. It's been around for a long time part of the In fact, the whole internet structure that came into effect in the early 90s. You can do what's called a whois lookup if you're on a Mac Linux machine, you just use the whois command if you're on Windows, or a Mac, you can or Linux, you can use a web browser and just say who is space and the website that you're interested in. And usually, the search engines will send you to one of the main whois servers that are out there, and you can see where their site supposed to be, what it is, what they are, what the real domain name is. Website content setting up a website. It's a massive project that takes a lot of time, a lot of energy. If there's a lot of grammatical mistakes, low-resolution pictures, a lot of advertising, you're probably on a phishing site. Look for the privacy policy, contact information, those types of pages. Those are usually pretty much dead giveaways of a legitimate website versus a phishing site. So be careful when you're going online. Another tip is one that I've seen far too many times. Many people, instead of typing in the URL into the browser, they'll type it into a search engine which continually amazes me people do it all the time.

Craig Peterson 1:27:59
I have a Client whose accountant, their lead accountant, was going to Google and typing in the website address of the bank including.com. And Google would come up with the search results, and you click on the top one kind of blindly, right, not paying attention. Well, that's a great way that if the Google database is poisoned. An excellent way for the bad guys to get you to click on their website instead of the legitimate bank website. You might want to use a bookmark once you've got the correct URL, and then just double check when you log in that it is a secure server, and that it does have the right certificate. All right, everybody. Hey, thanks for being with us today. We'll be back next Saturday, same time 1:00 pm on WGAN. And I'm releasing these podcasts. They also go out on Saturday. So if you subscribe, you'll get all of this for Free, plus more subscribe Craig Peterson com slash subscribe. Easy enough, go to Craig peterson.com you can subscribe to my mailing list there, my newsletter, and you'll get all of this and more

Transcribed by https://otter.ai

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Welcome!

Good morning, everybody. I was on with Mr. Jim Polito this morning and we talked about TikTok and Chinese Technology Companies Spying and Monitoring through apps. So, here we go with Mr. Polito.

For more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

National Security and the Chinese-based Social App TikTok

--- 

Automated Machine Generated Transcript:

Here he is folks, the man with the plan, the Tech Talk guru. He's got it all covered. Our friend Craig Peterson. Good morning, Craig.

Hey, good morning, Jim. How are you today, buddy? I'm doing great. I enjoyed your Veterans Day show yesterday, by the way, for taking the time.

Yeah, a lot of people calling in.

I have two kids who were in the military as well in the Navy and my father in law. He was on a submarine in Hawaii, right there when the Japanese started shelling Pearl Harbor. My father in law passed many years ago. But, you know, we've all been touched by this, whether it's a more recent conflict or the older ones, so thanks to everybody. Sorry, I couldn't say anything yesterday.

No, but Craig, thank you. I really, I really appreciate that. And I appreciate the service of all. And really, it's, we can't do anything else and no need to thank us because it's Veterans Day, you do that.

So let me let me let you in on a secret here. There's the social media app TikTok. And I guess it's for the younger kids, like they all start being for younger kids, and then we take over the baby boomers, so like with Instagram and Facebook and all of that, so I joined TikTok, only so I could get the name, Jim Polito, you know on it like, and maybe someday. young folks will be using it who are my age or others but TikTok has some very serious issues surrounding it. Kind of a lot of controversy, right?

Yeah, it absolutely does. And what we're talking about here is an app spelled TIKTOK T-I-K-T-O-K. And it is very popular. It uses little videos that as you mentioned, it's mainly kids are using 15 seconds that allows you to put music on them. You can do some really fancy little video where you can and even Tom Brady who apparently Oh, yeah, Gronkowski. I'm sorry, Brady. Correct me here.

Yeah, yeah. Yeah. Yeah. So even though he's using it now. So I don't maybe it's already started to transition to older people like those celebrities. Like Will Smith on it all the time, you know and he's up there in age but he's trying to appeal to younger people so he wants to be there on that platform.

Yeah, he has a very cute little video in fact about TikTok and kind of getting pulled into it. And it's a lot of fun. A lot of people are doing that, you know, kind of like the old SnapChats and old its children use this very popular, but within the last two years, TikTok is really gained a lot of notoriety and a lot of popularity. However, it is owned by a company called ByteDance, which is a Chinese owned company which is the reason for the controversy.

There we go. Okay, now I get it.

A Congressional Committee called the Committee on Foreign investment in the United States. And they review for acquisitions of US businesses that could threaten national security. I don't know how Will Smith nows fear, national security. But when you get right down to it even if you take a photograph and you post it online on a website or a blog, etc. Remember nowadays that photograph has built right into it. GPS coordinates of where it was taken, what the picture that was that you took what it was about now using visual recognition software. And there's been some amazing things done so for instance, over in France, Notre Dame, the cathedral, Of course, burned down.

Yeah.

And that they're trying to figure out okay, so how can we rebuild it? What should we do? Should we stay true with what it was? They ended up taking the photographs that people had just posted online, just you know, hey, look at me, I'm on vacation at Notre Dame in Paris. And they were able to come completely stitch them together. So every inch of that Cathedral that was visible by these cameras, that was stitched together and they had a whole three-dimensional view of it.

Wow.

Now, they've done that with some other things before for instance, over in Iraq and, and other places in the Middle East with some of these thousand 2000 even older monuments are over there, those buildings that were destroyed by the Taliban. Again they were able to take the pictures that people had taken and posted online so and reconstruct the things visually. Technology has made that possible to do quite easily now, and that's part of the reason, Jim, why they say you know, you cannot take pictures in New York City inside of certain areas that are considered to be security threats. Because our enemies can go stitch them together and have a very detailed visual picture of everything with GPS coordinates that get them right down to the last yard. Right? That you're taking in, you know the meter. So with things like TikTok that are in control under control of the Chinese government, and of course, their socialist government is
exactly, you know,
Do we want them to have that kind of information that could be embedded in the videos or taking, maybe even in some cases tracking us when we're not using the application or writing videos, but now they've got more information on us here in the US.

It's a similar problem, of you, know when IBM sold Lenovo to China, I freaked out because here Lenovo is a company that makes laptops Some people love them the birth of laptops. But now they have a company which doesn't mean just the hardware. But they've got the names and addresses and phone numbers of everyone, including people in government NSA security risk. So let's think about our deployed soldiers. You know, you and I have talked a little bit about the Fitbit. And our soldiers are using these Fitbit when they run around our military bases overseas as well as here in the US. And they are uploading the information from the Fitbit to the internet so they can compete with each other right and have some fun.

Well, Jim, they put together heat maps using the Fitbit information, and you were able to go online and find our secret military bases.

Not good.

So we've gotten Soldiers using TikTok to talk to their friends back home. We've got people here doing the same thing. And we are leaking all kinds of information everywhere, really might not want to show and now the Feds are getting involved. They're going to look at this more. they may halt some sales of some of this technology.

But previously they this is what it's called that committee in the government here. They focused on companies with military intellectual concerns. Right. But now, this has triggered investigation of TikTok.

Yeah, I mean, the thing is, we're talking with Craig Peterson, our tech Talk Guru, the thing is, Craig, in the past, the stuff that people posted, legitimately and openly online on a social media platform, you know, you could I guess mine, you could go in and search and look for, but to actually control the platform. On the platform, you know, isn't that like the same issue we had with them selling us electronics and we find out all these electronics are constructed or assembled with a back door that the Chinese can use?

Yeah. And who knows what's in it right when these back doors are already existing in our security cameras that we put in, in not only businesses, but it turns out on our military bases, 90 plus percent of them are made in China, even if it's a US brand. And they have back doors. And I've been in small businesses where those cameras security cameras made in China have been used to break into the point of sale equipment to steal credit card and banking info.

Oh, boy. Yeah. See, that's just not good.

Right. Yeah. And so that's what we're looking at here. And then frankly, this is a real problem.

All right, Craig, where can folks get more information on this? I imagine if they text my name to this number

855-385-5563. So just text Jim to 855-385-5563.

All right, standard data and tax rates apply. You'll get all of this fascinating information, plus more from Craig and you won't have to worry about Craig, treating your data like the Chinese would, the Chinese Communist. Craig, thanks so much. We'll talk to you next week.

All right, thanks. Take care, Jim.

Transcription by otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

Welcome!

Good morning, everybody. I was on with Mr. Jim Polito this morning and we talked about TikTok and Chinese Technology Companies Spying and Monitoring through apps. So, here we go with Mr. Polito.

For more tech tips, news, and updates visit - CraigPeterson.com

--- 

Related articles:

National Security and the Chinese-based Social App TikTok

--- 

Automated Machine Generated Transcript:

Here he is folks, the man with the plan, the Tech Talk guru. He's got it all covered. Our friend Craig Peterson. Good morning, Craig.

Hey, good morning, Jim. How are you today, buddy? I'm doing great. I enjoyed your Veterans Day show yesterday, by the way, for taking the time.

Yeah, a lot of people calling in.

I have two kids who were in the military as well in the Navy and my father in law. He was on a submarine in Hawaii, right there when the Japanese started shelling Pearl Harbor. My father in law passed many years ago. But, you know, we've all been touched by this, whether it's a more recent conflict or the older ones, so thanks to everybody. Sorry, I couldn't say anything yesterday.

No, but Craig, thank you. I really, I really appreciate that. And I appreciate the service of all. And really, it's, we can't do anything else and no need to thank us because it's Veterans Day, you do that.

So let me let me let you in on a secret here. There's the social media app TikTok. And I guess it's for the younger kids, like they all start being for younger kids, and then we take over the baby boomers, so like with Instagram and Facebook and all of that, so I joined TikTok, only so I could get the name, Jim Polito, you know on it like, and maybe someday. young folks will be using it who are my age or others but TikTok has some very serious issues surrounding it. Kind of a lot of controversy, right?

Yeah, it absolutely does. And what we're talking about here is an app spelled TIKTOK T-I-K-T-O-K. And it is very popular. It uses little videos that as you mentioned, it's mainly kids are using 15 seconds that allows you to put music on them. You can do some really fancy little video where you can and even Tom Brady who apparently Oh, yeah, Gronkowski. I'm sorry, Brady. Correct me here.

Yeah, yeah. Yeah. Yeah. So even though he's using it now. So I don't maybe it's already started to transition to older people like those celebrities. Like Will Smith on it all the time, you know and he's up there in age but he's trying to appeal to younger people so he wants to be there on that platform.

Yeah, he has a very cute little video in fact about TikTok and kind of getting pulled into it. And it's a lot of fun. A lot of people are doing that, you know, kind of like the old SnapChats and old its children use this very popular, but within the last two years, TikTok is really gained a lot of notoriety and a lot of popularity. However, it is owned by a company called ByteDance, which is a Chinese owned company which is the reason for the controversy.

There we go. Okay, now I get it.

A Congressional Committee called the Committee on Foreign investment in the United States. And they review for acquisitions of US businesses that could threaten national security. I don't know how Will Smith nows fear, national security. But when you get right down to it even if you take a photograph and you post it online on a website or a blog, etc. Remember nowadays that photograph has built right into it. GPS coordinates of where it was taken, what the picture that was that you took what it was about now using visual recognition software. And there's been some amazing things done so for instance, over in France, Notre Dame, the cathedral, Of course, burned down.

Yeah.

And that they're trying to figure out okay, so how can we rebuild it? What should we do? Should we stay true with what it was? They ended up taking the photographs that people had just posted online, just you know, hey, look at me, I'm on vacation at Notre Dame in Paris. And they were able to come completely stitch them together. So every inch of that Cathedral that was visible by these cameras, that was stitched together and they had a whole three-dimensional view of it.

Wow.

Now, they've done that with some other things before for instance, over in Iraq and, and other places in the Middle East with some of these thousand 2000 even older monuments are over there, those buildings that were destroyed by the Taliban. Again they were able to take the pictures that people had taken and posted online so and reconstruct the things visually. Technology has made that possible to do quite easily now, and that's part of the reason, Jim, why they say you know, you cannot take pictures in New York City inside of certain areas that are considered to be security threats. Because our enemies can go stitch them together and have a very detailed visual picture of everything with GPS coordinates that get them right down to the last yard. Right? That you're taking in, you know the meter. So with things like TikTok that are in control under control of the Chinese government, and of course, their socialist government is
exactly, you know,
Do we want them to have that kind of information that could be embedded in the videos or taking, maybe even in some cases tracking us when we're not using the application or writing videos, but now they've got more information on us here in the US.

It's a similar problem, of you, know when IBM sold Lenovo to China, I freaked out because here Lenovo is a company that makes laptops Some people love them the birth of laptops. But now they have a company which doesn't mean just the hardware. But they've got the names and addresses and phone numbers of everyone, including people in government NSA security risk. So let's think about our deployed soldiers. You know, you and I have talked a little bit about the Fitbit. And our soldiers are using these Fitbit when they run around our military bases overseas as well as here in the US. And they are uploading the information from the Fitbit to the internet so they can compete with each other right and have some fun.

Well, Jim, they put together heat maps using the Fitbit information, and you were able to go online and find our secret military bases.

Not good.

So we've gotten Soldiers using TikTok to talk to their friends back home. We've got people here doing the same thing. And we are leaking all kinds of information everywhere, really might not want to show and now the Feds are getting involved. They're going to look at this more. they may halt some sales of some of this technology.

But previously they this is what it's called that committee in the government here. They focused on companies with military intellectual concerns. Right. But now, this has triggered investigation of TikTok.

Yeah, I mean, the thing is, we're talking with Craig Peterson, our tech Talk Guru, the thing is, Craig, in the past, the stuff that people posted, legitimately and openly online on a social media platform, you know, you could I guess mine, you could go in and search and look for, but to actually control the platform. On the platform, you know, isn't that like the same issue we had with them selling us electronics and we find out all these electronics are constructed or assembled with a back door that the Chinese can use?

Yeah. And who knows what's in it right when these back doors are already existing in our security cameras that we put in, in not only businesses, but it turns out on our military bases, 90 plus percent of them are made in China, even if it's a US brand. And they have back doors. And I've been in small businesses where those cameras security cameras made in China have been used to break into the point of sale equipment to steal credit card and banking info.

Oh, boy. Yeah. See, that's just not good.

Right. Yeah. And so that's what we're looking at here. And then frankly, this is a real problem.

All right, Craig, where can folks get more information on this? I imagine if they text my name to this number

855-385-5563. So just text Jim to 855-385-5563.

All right, standard data and tax rates apply. You'll get all of this fascinating information, plus more from Craig and you won't have to worry about Craig, treating your data like the Chinese would, the Chinese Communist. Craig, thanks so much. We'll talk to you next week.

All right, thanks. Take care, Jim.

Transcription by otter.ai

--- 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson