Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Craig is starting a new daily podcast called It's a Security Thing. Today's security thing discusses about the zero day virus attack on a police department in Maryland.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/31/2019

Salisbury Police Department - Ransomware Attack

Craig Peterson 0:00
Everybody, you know, I'm trying to do something a little different here. Now, you know, we were all into security, many of us that are listening, and this is going to be our Thursday and Friday for the next little while.

Anyways, I kind of a security update here is what's going on in the world helping me understand a little bit more, but this is geekier. Okay, this is going to be for the geeks amongst us, because we're going to talk about actual things that have happened over the last, you know, few weeks, month, maybe bit more, as well.

So we're going to start this out today, by talking about this zero day virus that hit we got there's a lot to talk about here. We've got a, you know, tomorrow, we'll talk a little bit more. But we've got a police department down in Maryland who got nailed. And I got to tell you both of these stories. Bottom line is they had very good backups. And that's always the first step. And I've got to warn people that because you think you have a backup, it's no indication that you really do have a backup. So keep that in mind as well. All right, that I have seen it time and time again, they think they're writing to tape or it's going to disc or going remotely. We have a client that has decided that they needed a cheaper disaster recovery solution than us. And they didn't understand what DR meant. Disaster Recovery what it really means. And what it means, by the way, is that you can get your business back online very quickly. You don't have to wait weeks in order to restore from backup tapes, or from online cloud, etc. You're back online, you're back in business in as little as five minutes, depending on on how much you want to pay.

So they were getting this disaster service from us that is designed specifically to allow them to get back on within four hours. And in reality, it's more like 15 minutes. But it's a four hour guarantee, because that's what the law requires if you are a public entity, or you are a division of a public entity, in case you didn't know, okay, so they thinking that day, we're just a division of a public company, you know, they bought us, but we do our little thing, they don't really bother us, they why they had signed up with us for disaster recovery, because we had told them, here's the law, Sarbanes Oxley, here's all your requirement. Here's what you need to be doing. And so we put it in place.

So they went out and they talked to this other vendor that all they offer is backup. Now, this is a vendor that was backing up their AS 400, which is kind of a mini computer of days gone by. Great little machine from IBM. And they had been backing this up, they were supposed to be providing disaster recovery. And everything in this company hadn't been. We were monitoring all the networks, we were looking at everything. We were taking care of all of the data transfers. And we went to our client and said, Hey, by the way,
what's this link for? Because, you know, it hasn't been active now, in six to eight weeks at all? What do you mean at all? I said, Well, you know, there's been no data transferred at all. And for a while there was kind of busy just a thought I double check, because it was out of the norm. Usually, we get more interested when there is more data than usual, as opposed to less data than usual. In this case, it was less data than usual. They said, oh, yeah, well, that's our backup line. That's for our AS400 that's our main system. Well, why isn't there any traffic on it? Well, this company who was supposed to be providing them with some form of DR service and also backup hadn't been doing it their site with their their software and everything was broken and they never noticed. And the company our client never noticed. And so they were not only out of compliance with the law, but they would have been in deep trouble, even if they just had a hard disk crash, let alone their systems are brought down by someone who's malicious. Very, very big deal.

So now that have gone to these guys that failed them already. And today, can you do a cheaper backup, you know, we need disaster recovery, too. And they say, Oh, yeah, we can do cheaper, of course, they can do cheaper and that's what I want to drive home here everybody.

They can do cheaper because they're not monitoring it. They can do cheaper because they don't have multiple generations of backups, which is another problem. Because if you don't have multiple generations of backup, what happens when you get ransomware? What happens when you get nailed like this Salisbury, Maryland police department. This happened January 24th. Okay.

So you get ransomware and your backups are overwritten because they run normally right and the overwritten with what with your data encrypted by the ransomers. So you can't get your data back. All you can get back is another copy of your encrypted ransom data. That's what they signed up for. This drives me crazy people. Absolutely crazy because they're doing the wrong thing. Of course, it costs more to do what we're doing for them, of course. But we're doing everything that should be done. We check their backups, integrity weekly.We have multiple generations of their backup going back for years, which is also required by law. Now, we don't keep every backup for all those years. But we have kind of what's called a grandfather, father, son type of relationship in these backups. And if you want to know more, let me know and I can, I can help you out. But we also spin up machines. So at least every month, all of their machines get spun up in our cloud. So we know that and not only is the backup data proper, but on top of it, their machines will come online in the cloud if they have a major failure. But no, they they went with a much cheaper option that has proven to not work already. I don't get it. I just don't get it.

So Salisbury Police. Captain Richard Kaiser, told the Daily Times of Salisbury that the police department's entire internal computer network was compromised January 9, in a ransomware attack is in negotiations with the attacker who asked for an undisclosed sum quickly disintegrated. Now, that's the normal first response is let's negotiate. And, you know, I do this work with the FBI in regard program. And the FBI is advice is always don't pay ransoms. But the police department was negotiating because I knew it was going to be expensive to restore it. Everything all that does is two things it encourages them to do it again but guess what? The second thing is it encourages them to attack you again because they know you will pay a ransom okay so is that stupid or what right and police department ok, ok. It will be a $5,000 okay no problem and then who are they going to try and attack next time the police department right.

So the captain says there was a backup system and they were able to recover stuff from backups there's no evidence anything was stolen or download of course there isn't because there was ransomware and I gotta tell you to ransomware is often used as a cover for them to steal your data in police departments ability to respond to calls wasn't hampered because they still had a paper system in place and the police are working with the FBI. Interesting eh? Salisbury, Maryland. This can happen to you this happened a couple of weeks ago in Salisbury. Something to keep an eye out for, make sure you have good backups. Make sure you understand what backups are about. And you may want to sign up for my course. Next week. I got free tickets. I'm going to give away a ton of my best information. And if you want to go further, you can go further. But I am going to get you out of this rut that you're in. Do it yourself. security done the right way. That's what this is all about. http://CraigPeterson.com.

Anyways, have a great day. And you know what, it's all just a security thing. Fellow security geeks. I will be back tomorrow. Take care. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is starting a new daily podcast called It's a Security Thing. Today's security thing discusses about the zero day virus attack on a police department in Maryland.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/31/2019

Salisbury Police Department - Ransomware Attack

Craig Peterson 0:00
Everybody, you know, I'm trying to do something a little different here. Now, you know, we were all into security, many of us that are listening, and this is going to be our Thursday and Friday for the next little while.

Anyways, I kind of a security update here is what's going on in the world helping me understand a little bit more, but this is geekier. Okay, this is going to be for the geeks amongst us, because we're going to talk about actual things that have happened over the last, you know, few weeks, month, maybe bit more, as well.

So we're going to start this out today, by talking about this zero day virus that hit we got there's a lot to talk about here. We've got a, you know, tomorrow, we'll talk a little bit more. But we've got a police department down in Maryland who got nailed. And I got to tell you both of these stories. Bottom line is they had very good backups. And that's always the first step. And I've got to warn people that because you think you have a backup, it's no indication that you really do have a backup. So keep that in mind as well. All right, that I have seen it time and time again, they think they're writing to tape or it's going to disc or going remotely. We have a client that has decided that they needed a cheaper disaster recovery solution than us. And they didn't understand what DR meant. Disaster Recovery what it really means. And what it means, by the way, is that you can get your business back online very quickly. You don't have to wait weeks in order to restore from backup tapes, or from online cloud, etc. You're back online, you're back in business in as little as five minutes, depending on on how much you want to pay.

So they were getting this disaster service from us that is designed specifically to allow them to get back on within four hours. And in reality, it's more like 15 minutes. But it's a four hour guarantee, because that's what the law requires if you are a public entity, or you are a division of a public entity, in case you didn't know, okay, so they thinking that day, we're just a division of a public company, you know, they bought us, but we do our little thing, they don't really bother us, they why they had signed up with us for disaster recovery, because we had told them, here's the law, Sarbanes Oxley, here's all your requirement. Here's what you need to be doing. And so we put it in place.

So they went out and they talked to this other vendor that all they offer is backup. Now, this is a vendor that was backing up their AS 400, which is kind of a mini computer of days gone by. Great little machine from IBM. And they had been backing this up, they were supposed to be providing disaster recovery. And everything in this company hadn't been. We were monitoring all the networks, we were looking at everything. We were taking care of all of the data transfers. And we went to our client and said, Hey, by the way,
what's this link for? Because, you know, it hasn't been active now, in six to eight weeks at all? What do you mean at all? I said, Well, you know, there's been no data transferred at all. And for a while there was kind of busy just a thought I double check, because it was out of the norm. Usually, we get more interested when there is more data than usual, as opposed to less data than usual. In this case, it was less data than usual. They said, oh, yeah, well, that's our backup line. That's for our AS400 that's our main system. Well, why isn't there any traffic on it? Well, this company who was supposed to be providing them with some form of DR service and also backup hadn't been doing it their site with their their software and everything was broken and they never noticed. And the company our client never noticed. And so they were not only out of compliance with the law, but they would have been in deep trouble, even if they just had a hard disk crash, let alone their systems are brought down by someone who's malicious. Very, very big deal.

So now that have gone to these guys that failed them already. And today, can you do a cheaper backup, you know, we need disaster recovery, too. And they say, Oh, yeah, we can do cheaper, of course, they can do cheaper and that's what I want to drive home here everybody.

They can do cheaper because they're not monitoring it. They can do cheaper because they don't have multiple generations of backups, which is another problem. Because if you don't have multiple generations of backup, what happens when you get ransomware? What happens when you get nailed like this Salisbury, Maryland police department. This happened January 24th. Okay.

So you get ransomware and your backups are overwritten because they run normally right and the overwritten with what with your data encrypted by the ransomers. So you can't get your data back. All you can get back is another copy of your encrypted ransom data. That's what they signed up for. This drives me crazy people. Absolutely crazy because they're doing the wrong thing. Of course, it costs more to do what we're doing for them, of course. But we're doing everything that should be done. We check their backups, integrity weekly.We have multiple generations of their backup going back for years, which is also required by law. Now, we don't keep every backup for all those years. But we have kind of what's called a grandfather, father, son type of relationship in these backups. And if you want to know more, let me know and I can, I can help you out. But we also spin up machines. So at least every month, all of their machines get spun up in our cloud. So we know that and not only is the backup data proper, but on top of it, their machines will come online in the cloud if they have a major failure. But no, they they went with a much cheaper option that has proven to not work already. I don't get it. I just don't get it.

So Salisbury Police. Captain Richard Kaiser, told the Daily Times of Salisbury that the police department's entire internal computer network was compromised January 9, in a ransomware attack is in negotiations with the attacker who asked for an undisclosed sum quickly disintegrated. Now, that's the normal first response is let's negotiate. And, you know, I do this work with the FBI in regard program. And the FBI is advice is always don't pay ransoms. But the police department was negotiating because I knew it was going to be expensive to restore it. Everything all that does is two things it encourages them to do it again but guess what? The second thing is it encourages them to attack you again because they know you will pay a ransom okay so is that stupid or what right and police department ok, ok. It will be a $5,000 okay no problem and then who are they going to try and attack next time the police department right.

So the captain says there was a backup system and they were able to recover stuff from backups there's no evidence anything was stolen or download of course there isn't because there was ransomware and I gotta tell you to ransomware is often used as a cover for them to steal your data in police departments ability to respond to calls wasn't hampered because they still had a paper system in place and the police are working with the FBI. Interesting eh? Salisbury, Maryland. This can happen to you this happened a couple of weeks ago in Salisbury. Something to keep an eye out for, make sure you have good backups. Make sure you understand what backups are about. And you may want to sign up for my course. Next week. I got free tickets. I'm going to give away a ton of my best information. And if you want to go further, you can go further. But I am going to get you out of this rut that you're in. Do it yourself. security done the right way. That's what this is all about. http://CraigPeterson.com.

Anyways, have a great day. And you know what, it's all just a security thing. Fellow security geeks. I will be back tomorrow. Take care. Bye bye.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on the WGAN Morning News with Matt and Joe. Joe sits in for Ken this morning. They talked about the Apple FaceTime bug that lets you hear what's happening to the other end of the line even before they answer the call. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

How A Hacked Phone May Have Led Killers To Khashoggi
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/30/2019

Apple Facepalm - Why Is Apple Making These Mistakes - Can We Trust The News

Craig Peterson 0:00
Hey, Top of the morning to your Craig Peterson here. And it's been a very busy week. Hopefully you've been getting my emails this week leading up to a big deal. Next week, I'm going to be doing some more free teaching and helping you we're going to do handheld, guided through cleaning up your computers at your office. So this is exciting to me. I've never done this before. And it's something that I'm really dedicating 2019 to do help small businesses clean up their security stance. So this morning, I was on with Ken and Matt will actually Joe and Matt because Ken was out this morning and we got into quite a deep discussion when it comes to this whole face palm problem. Yeah, the problem that Apple's having right now and why is it what happened when Steve Jobs left? What did he really leave behind when we talked about the Apple as the corporation. And we talked about privacy in general are tied it into Khashoggi tied it into surveillance capitalism. And it was quite the discussion this morning. In fact, we went a little bit long in that segment. So here we go and shout out to all of our listeners. And I got some notes this last week to from people from who listened on the weekends. I thought that was kind of cool. They kind of binge listen to my podcast on the weekend, so shout out to the binge listeners and to all of you who reached out to people in the gym and driving into work, etc. etc. Anyways, here we go. with Joe and Matt

Unknown 1:45
Back again. 7:38 WGAN Morning News Wednesday. That means time to talk to Craig Peterson. He is with us Joe Reagan in for Ken  this morning and Craig is on the phone. Craig, how are you? Hey, good morning. And I understand you guys have some questions.

Unknown 2:00
About face time. Talk to you. Matt will mention a little bit earlier, Craig. We have questions about so many things, so many things. But yeah, I was gonna start and lead off with the FaceTime thing. So is it true that if I dial, you know, a friend of mine on FaceTime, I can secretly hear everything he's doing, and I can spy on him and then use it against him later for blackmail. Oh yeah. And it records it in a broadcast to the CIA and the Russian mafia. The Russians got a bit yeah, yeah.

Unknown 2:30
What about the Chinese time Oh, well, that's only if it's a Huawei phone right yeah. Huawei they got a new laptop out to the looks pretty cool but I wouldn't buy it they here's what's going on Apple course has some FaceTime for a long time. One of apples real big things that they're constantly bragging about. We talked about this before is how they put security first, they're not in the business of selling your information. They want to sell you a new people.

Unknown 3:00
hardware or some software, etc. And because of that people kind of expect Apple to always be the most secure device out there and it's time for the globe to turn on and off if you have any gloating music there man gloating music that's a good one. I've gotten a good ones. But hold on. Let me look for it because I do want to gloat. So

Unknown 3:25
you should probably just keep talking while I'm looking for it. Because I don't think I have anybody go for it. Okay. No gloating music. So here's what happened. Apple introduced a new feature on FaceTime. And this feature set up for group calls. kind of the thing you might have done with Google Hangouts or some of these other pieces of software out there so you can get all your family and friends on and have a call with someone Happy birthday, etc. Really kind of a cool feature with one minor problem and that is that this specific feature in FaceTime this group calling

Unknown 4:00
Had the bug that you mentioned. And this particular bug what it is, as soon as you call someone, and their phone started to ring to let them know, hey, there's a group FaceTime call coming in that the microphone would go hot on the devices that were being called. So now you could listen in while that phone was ringing because it was transmitting to you and either the audio from the other side. So as you said, All you had to do is make a group FaceTime call and you could listen in and kind of spy on whoever you're talking to. are going to talk to that even answered the phone yet, and you could hear what was going on. So it's a big phone pod, no question about that. And it is a flaw that was reported to Apple apparently a couple of weeks ago, Apple has turned off the feature so the group FaceTime is where there was a problem there was never reported problem with regular face time but it has

Unknown 5:00
has been turned off until they can fix this eavesdropping flaw and it was fired by the way by a kid

Unknown 5:07
a 14 year old man yeah exactly the cleanest the face poem by security researchers. In other words, Apple's faces in their palm at this point because Apple security team should have known better should have been tested a little bit better. And a lot of people are saying, Hey, listen, this is what's been happening with Tim Cook. He's a bean counter. He's not in love with this technology. Like, of course, you know, the previous slide that other guy that was there before

Unknown 5:39
and we're seeing more books slipping through, in fact, the latest upgrade to iOS and again, what does Apple brag about it Hey, listen, unlike most of the Android phones out there, you're going to be able to get updates are going to just install automatically. In fact, Apple Now by default is automatically installing updates include security fixes.

Unknown 6:01
Just going to install is just going to work like just going to be good you know haha you guys with the Android phones they can't get support for new security sorry I can't hear you Craig. I'm playing my gloating music

Unknown 6:19
out there now Apple latest update is breaking many people's ability to receive phone calls and use Wi Fi so yeah Facebook is kind of an understatement and apples really got a bit of a black Okay Can I ask you a question though about you know since you just mentioned Tim Cook and how we might not have quite as hands on obsessive of a style as somebody else who may have previously held his job

Unknown 6:48
Why does that somehow result in bugs I Why is the CEO involved in that at all like why should Steve Jobs Tim Cook etc be even responsible in the at the end of the day for a bug cropping up?

Unknown 7:00
For the technology being a certain way or whatnot, I mean, I suppose they certainly give leadership to the organization and whatnot. But but that really, I mean, this is a really big company with a lot of engineers and people that are creating software and and people that are creating hardware and whatnot, how in the world would it get to the point where Steve Jobs would have to be yelling at people in order to make sure there was no bug well, but that's the culture that was built inside Apple rather than building a company where you have smaller teams who are you know, have a visionary in them and saying this is really what we want to do with this design and and other software teams that that do code reviews and go through it all have more individual responsibility. Steve Jobs set up a company where he was the man he was at, and as you pointed out here, Matt was in I am for that anyway so much you said Steve Jobs would go to the these small group

Unknown 8:00
meetings that were implementing one feature in an Apple device and he would just rip them to shreds and check. Can't believe you didn't do this. And there's this problem and that problem because he was so involved. So these teams ended up getting a little bit lazy by most business standards. And we're basically relied on Steve Jobs come down, scream at people and even fire whole departments. Remember what happened with Apple Maps where Apple Maps was a major mess up a piece of trash and he wants in the meeting and said, So who's responsible for this and fired the whole department. It was just crazy. The whole team so I think that's the problem. Now in order to get around that we've got to cook is out there. Now he has a bug bounty and they're paying people who find bugs and Apple software thousands to even hundreds of thousands of dollars at a cracker conference.

Unknown 9:00
Just a couple of years ago, Apple made a surprise announcement that it would pay bounties for bugs as high as $200,000 to hackers and responsibly turned over crucial flaws. So instead of finding most of these flaws internally because you're not going to find every one of them, you know, the team that wrote the software is not the team that should be looking at what the flaws are. But they decided, hey, we'll just go to the bad guys and have them pay us well, you know what a major bug and Apple software is worth a lot more than $200,000 look at this other article I have on my site today about to showcase this Israeli company called the NSO group is a creator of some software was called Pegasus and Pegasus sells for millions of dollars and it's used by governments. It's used by oppressive regimes and apparently it might have been used by the Saudis to find peace.

Unknown 10:00
Yogi and it uses bugs in software, Apple software, Android software, you name it software in order to get around security that's some place so you end up with a person like Khashoggi you know whether you liked the guy thought he was credible or not but being tracked the software being sold to the worst of the worst according to NSA whistleblower Edward Snowden and use to track people. So if someone's going to go to Pegasus over there, and Israel, the Santa soul group and say, Hey, listen, guys, for a million bucks. I'll tell you how you can just call someone and listen in to the conversation or they gonna go to Apple and say, please Apple, give me $1,000 because I told you about this major problem, Craig and that there is an interesting point because you have a lot of you mentioned a couple times here just some of the mean just part of the the general business model of how tech is evolving towards and you know, also one of the things you're talking about today is there was a new book by Trish

Unknown 11:00
Zubov about the business models about how this is all playing into it. And really how this is creating kind of an environment of this surveillance capitalism where we as a as a as a as individuals have ever really surrendered some amount of privacy in order to achieve convenience and because we're not paying for any of these products you know we're not really the true consumer we are at the end of the day the product of this market where our data our our location and all this stuff is being sold and I don't think there's really been a whole lot whether it be whether your government that's that's exploding this or whether your private business there really hasn't been a whole lot of conversation on that right? No, not at all. And there's going to be a conversation because people are getting more and more upset. Look at what's happening with Facebook 10 years ago. Nobody was worried about the we know what Facebook was tracking today and and you had Zuckerberg in some early messages that had been released due to a lawsuit in the year

Unknown 12:00
union we had Zuckerberg said he couldn't believe what fools people were giving him this information. So there's going to be more of a conversation. Facebook's kind of pulling up that saw people are eventually going to get completely upset about it Apple is be eventually they're going to go the way of the dinosaur or they're going to pull up their socks. But that's true of every tech company out there. And Joe, when we talk about this surveillance capitalism, where our information becomes the capital that's being used. It's a very concerning thing. And it's something that the industry is talking about. Now. They are putting together some groups they are starting to come up with standards. And by 2020, we are going to see some real privacy standards in place by the industries and we'll see if government tries to do anything about it. But frankly, laws rules and regulations they're always five or more years behind where that

Unknown 13:00
technology now, he talked about that. And there's you know, recently with, you know, the European Union has been talked about for the past probably a year, year and a half about some of their things that they've started to bring forward on privacy related legislation. It's caused a huge a lot of questions to be raised about foreign tech companies that might be holding data offshore and in the rights to who owns that data and how and you know, and I think it's funny because I can't tell you any times I've seen someone post that's stupid thing on Facebook that talks about, you know, oh, I hereby resend all my personal data and Facebook has no ownership and that's that's really she's not yes i like about five of those yesterday. Yeah, still making its way around for some reason. Yeah, yeah, there is a big problem guys and gals. If you're concerned about your privacy, there's really only one way to do it in this day and age and that's just connect your devices don't go online. But you know what, I don't think that's ever happened.

Unknown 14:00
You know, but no, it's not. Yeah, well, and I think another thing that's interesting too. And it's funny because I watch, you know, the computer I'm logged on to right now, obviously, I am a guest host here.

Unknown 14:10
So I do not have an account. So I'm operating off a guest account in the news that feed that I get on this computer is completely different than the news feed. I get on my personal phone. Now, it has two questions. One, what is Ken been searching because I'm getting a lot of the things that must be related to his profile. But how much of that, you know, when you look at how the algorithms and the automation that occurs in presenting information to a set of eyeballs? How much of that controls that information and really raises questions is the legitimacy of of what we're reading each day and taking for faculty. Oh, man, we can talk about that one for hours. But here's the bottom line. We thought the internet was going to be this place that kind of democracy, democratized information. We thought the internet was going to be a place where we could have open discussions and that maybe we could come to some agreements we could negotiate we could have

Unknown 15:00
Understand the other side. But ultimately what's happened is the Internet has provided us a place where we can go and we can be more polarized than we have ever been before. And part of the reason for that is what you kind of mentioned here, Joe, that these news feeds know what we like we have a big companies like the gray lady, it's a New York Times that says, if it was not for anti Trump articles, they would not be in business anymore. So with the New York Times is obviously catering to the anti Trump crowd. But that's being pushed through out all of the technology throughout all of these news sources from Twitter, if you want to call it a new source on out where they are catering to what we want to see and not necessarily what we should see. We're seeing stuff from our news feeds that is biased towards our thinking at least.

Unknown 16:00
This bias towards what they think that we're thinking and they think we want to see. So it's bad now it's getting worse as news organizations look at the Huffington Post look at what's been happening with a number of online news sites. Now they're laying people off because people aren't going to their site so they're getting more dramatic they're putting more stuff out there that just really clickbait they're making up stuff. They're lying about technology news all the way through political news, just to get your eyeballs to sell advertising and Joe that means we're in a bad spot. And that's why Frankly, I think, you know, radio and I heart is doing so well because we have these discussions, but you aren't going to see those on the Huffington Post. not see anything on the Huffington Post. They're laying off people left and right. Craig Peterson, our tech guru joins us at this time every Wednesday.

Unknown 17:00
Appreciate it. Craig and we'll talk again next week. Gentlemen, take care. Thank you much Craig. You know you mentioned but you know we only have about a minute before the break.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on the WGAN Morning News with Matt and Joe. Joe sits in for Ken this morning. They talked about the Apple FaceTime bug that lets you hear what's happening to the other end of the line even before they answer the call. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

How A Hacked Phone May Have Led Killers To Khashoggi
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/30/2019

Apple Facepalm - Why Is Apple Making These Mistakes - Can We Trust The News

Craig Peterson 0:00
Hey, Top of the morning to your Craig Peterson here. And it's been a very busy week. Hopefully you've been getting my emails this week leading up to a big deal. Next week, I'm going to be doing some more free teaching and helping you we're going to do handheld, guided through cleaning up your computers at your office. So this is exciting to me. I've never done this before. And it's something that I'm really dedicating 2019 to do help small businesses clean up their security stance. So this morning, I was on with Ken and Matt will actually Joe and Matt because Ken was out this morning and we got into quite a deep discussion when it comes to this whole face palm problem. Yeah, the problem that Apple's having right now and why is it what happened when Steve Jobs left? What did he really leave behind when we talked about the Apple as the corporation. And we talked about privacy in general are tied it into Khashoggi tied it into surveillance capitalism. And it was quite the discussion this morning. In fact, we went a little bit long in that segment. So here we go and shout out to all of our listeners. And I got some notes this last week to from people from who listened on the weekends. I thought that was kind of cool. They kind of binge listen to my podcast on the weekend, so shout out to the binge listeners and to all of you who reached out to people in the gym and driving into work, etc. etc. Anyways, here we go. with Joe and Matt

Unknown 1:45
Back again. 7:38 WGAN Morning News Wednesday. That means time to talk to Craig Peterson. He is with us Joe Reagan in for Ken  this morning and Craig is on the phone. Craig, how are you? Hey, good morning. And I understand you guys have some questions.

Unknown 2:00
About face time. Talk to you. Matt will mention a little bit earlier, Craig. We have questions about so many things, so many things. But yeah, I was gonna start and lead off with the FaceTime thing. So is it true that if I dial, you know, a friend of mine on FaceTime, I can secretly hear everything he's doing, and I can spy on him and then use it against him later for blackmail. Oh yeah. And it records it in a broadcast to the CIA and the Russian mafia. The Russians got a bit yeah, yeah.

Unknown 2:30
What about the Chinese time Oh, well, that's only if it's a Huawei phone right yeah. Huawei they got a new laptop out to the looks pretty cool but I wouldn't buy it they here's what's going on Apple course has some FaceTime for a long time. One of apples real big things that they're constantly bragging about. We talked about this before is how they put security first, they're not in the business of selling your information. They want to sell you a new people.

Unknown 3:00
hardware or some software, etc. And because of that people kind of expect Apple to always be the most secure device out there and it's time for the globe to turn on and off if you have any gloating music there man gloating music that's a good one. I've gotten a good ones. But hold on. Let me look for it because I do want to gloat. So

Unknown 3:25
you should probably just keep talking while I'm looking for it. Because I don't think I have anybody go for it. Okay. No gloating music. So here's what happened. Apple introduced a new feature on FaceTime. And this feature set up for group calls. kind of the thing you might have done with Google Hangouts or some of these other pieces of software out there so you can get all your family and friends on and have a call with someone Happy birthday, etc. Really kind of a cool feature with one minor problem and that is that this specific feature in FaceTime this group calling

Unknown 4:00
Had the bug that you mentioned. And this particular bug what it is, as soon as you call someone, and their phone started to ring to let them know, hey, there's a group FaceTime call coming in that the microphone would go hot on the devices that were being called. So now you could listen in while that phone was ringing because it was transmitting to you and either the audio from the other side. So as you said, All you had to do is make a group FaceTime call and you could listen in and kind of spy on whoever you're talking to. are going to talk to that even answered the phone yet, and you could hear what was going on. So it's a big phone pod, no question about that. And it is a flaw that was reported to Apple apparently a couple of weeks ago, Apple has turned off the feature so the group FaceTime is where there was a problem there was never reported problem with regular face time but it has

Unknown 5:00
has been turned off until they can fix this eavesdropping flaw and it was fired by the way by a kid

Unknown 5:07
a 14 year old man yeah exactly the cleanest the face poem by security researchers. In other words, Apple's faces in their palm at this point because Apple security team should have known better should have been tested a little bit better. And a lot of people are saying, Hey, listen, this is what's been happening with Tim Cook. He's a bean counter. He's not in love with this technology. Like, of course, you know, the previous slide that other guy that was there before

Unknown 5:39
and we're seeing more books slipping through, in fact, the latest upgrade to iOS and again, what does Apple brag about it Hey, listen, unlike most of the Android phones out there, you're going to be able to get updates are going to just install automatically. In fact, Apple Now by default is automatically installing updates include security fixes.

Unknown 6:01
Just going to install is just going to work like just going to be good you know haha you guys with the Android phones they can't get support for new security sorry I can't hear you Craig. I'm playing my gloating music

Unknown 6:19
out there now Apple latest update is breaking many people's ability to receive phone calls and use Wi Fi so yeah Facebook is kind of an understatement and apples really got a bit of a black Okay Can I ask you a question though about you know since you just mentioned Tim Cook and how we might not have quite as hands on obsessive of a style as somebody else who may have previously held his job

Unknown 6:48
Why does that somehow result in bugs I Why is the CEO involved in that at all like why should Steve Jobs Tim Cook etc be even responsible in the at the end of the day for a bug cropping up?

Unknown 7:00
For the technology being a certain way or whatnot, I mean, I suppose they certainly give leadership to the organization and whatnot. But but that really, I mean, this is a really big company with a lot of engineers and people that are creating software and and people that are creating hardware and whatnot, how in the world would it get to the point where Steve Jobs would have to be yelling at people in order to make sure there was no bug well, but that's the culture that was built inside Apple rather than building a company where you have smaller teams who are you know, have a visionary in them and saying this is really what we want to do with this design and and other software teams that that do code reviews and go through it all have more individual responsibility. Steve Jobs set up a company where he was the man he was at, and as you pointed out here, Matt was in I am for that anyway so much you said Steve Jobs would go to the these small group

Unknown 8:00
meetings that were implementing one feature in an Apple device and he would just rip them to shreds and check. Can't believe you didn't do this. And there's this problem and that problem because he was so involved. So these teams ended up getting a little bit lazy by most business standards. And we're basically relied on Steve Jobs come down, scream at people and even fire whole departments. Remember what happened with Apple Maps where Apple Maps was a major mess up a piece of trash and he wants in the meeting and said, So who's responsible for this and fired the whole department. It was just crazy. The whole team so I think that's the problem. Now in order to get around that we've got to cook is out there. Now he has a bug bounty and they're paying people who find bugs and Apple software thousands to even hundreds of thousands of dollars at a cracker conference.

Unknown 9:00
Just a couple of years ago, Apple made a surprise announcement that it would pay bounties for bugs as high as $200,000 to hackers and responsibly turned over crucial flaws. So instead of finding most of these flaws internally because you're not going to find every one of them, you know, the team that wrote the software is not the team that should be looking at what the flaws are. But they decided, hey, we'll just go to the bad guys and have them pay us well, you know what a major bug and Apple software is worth a lot more than $200,000 look at this other article I have on my site today about to showcase this Israeli company called the NSO group is a creator of some software was called Pegasus and Pegasus sells for millions of dollars and it's used by governments. It's used by oppressive regimes and apparently it might have been used by the Saudis to find peace.

Unknown 10:00
Yogi and it uses bugs in software, Apple software, Android software, you name it software in order to get around security that's some place so you end up with a person like Khashoggi you know whether you liked the guy thought he was credible or not but being tracked the software being sold to the worst of the worst according to NSA whistleblower Edward Snowden and use to track people. So if someone's going to go to Pegasus over there, and Israel, the Santa soul group and say, Hey, listen, guys, for a million bucks. I'll tell you how you can just call someone and listen in to the conversation or they gonna go to Apple and say, please Apple, give me $1,000 because I told you about this major problem, Craig and that there is an interesting point because you have a lot of you mentioned a couple times here just some of the mean just part of the the general business model of how tech is evolving towards and you know, also one of the things you're talking about today is there was a new book by Trish

Unknown 11:00
Zubov about the business models about how this is all playing into it. And really how this is creating kind of an environment of this surveillance capitalism where we as a as a as a as individuals have ever really surrendered some amount of privacy in order to achieve convenience and because we're not paying for any of these products you know we're not really the true consumer we are at the end of the day the product of this market where our data our our location and all this stuff is being sold and I don't think there's really been a whole lot whether it be whether your government that's that's exploding this or whether your private business there really hasn't been a whole lot of conversation on that right? No, not at all. And there's going to be a conversation because people are getting more and more upset. Look at what's happening with Facebook 10 years ago. Nobody was worried about the we know what Facebook was tracking today and and you had Zuckerberg in some early messages that had been released due to a lawsuit in the year

Unknown 12:00
union we had Zuckerberg said he couldn't believe what fools people were giving him this information. So there's going to be more of a conversation. Facebook's kind of pulling up that saw people are eventually going to get completely upset about it Apple is be eventually they're going to go the way of the dinosaur or they're going to pull up their socks. But that's true of every tech company out there. And Joe, when we talk about this surveillance capitalism, where our information becomes the capital that's being used. It's a very concerning thing. And it's something that the industry is talking about. Now. They are putting together some groups they are starting to come up with standards. And by 2020, we are going to see some real privacy standards in place by the industries and we'll see if government tries to do anything about it. But frankly, laws rules and regulations they're always five or more years behind where that

Unknown 13:00
technology now, he talked about that. And there's you know, recently with, you know, the European Union has been talked about for the past probably a year, year and a half about some of their things that they've started to bring forward on privacy related legislation. It's caused a huge a lot of questions to be raised about foreign tech companies that might be holding data offshore and in the rights to who owns that data and how and you know, and I think it's funny because I can't tell you any times I've seen someone post that's stupid thing on Facebook that talks about, you know, oh, I hereby resend all my personal data and Facebook has no ownership and that's that's really she's not yes i like about five of those yesterday. Yeah, still making its way around for some reason. Yeah, yeah, there is a big problem guys and gals. If you're concerned about your privacy, there's really only one way to do it in this day and age and that's just connect your devices don't go online. But you know what, I don't think that's ever happened.

Unknown 14:00
You know, but no, it's not. Yeah, well, and I think another thing that's interesting too. And it's funny because I watch, you know, the computer I'm logged on to right now, obviously, I am a guest host here.

Unknown 14:10
So I do not have an account. So I'm operating off a guest account in the news that feed that I get on this computer is completely different than the news feed. I get on my personal phone. Now, it has two questions. One, what is Ken been searching because I'm getting a lot of the things that must be related to his profile. But how much of that, you know, when you look at how the algorithms and the automation that occurs in presenting information to a set of eyeballs? How much of that controls that information and really raises questions is the legitimacy of of what we're reading each day and taking for faculty. Oh, man, we can talk about that one for hours. But here's the bottom line. We thought the internet was going to be this place that kind of democracy, democratized information. We thought the internet was going to be a place where we could have open discussions and that maybe we could come to some agreements we could negotiate we could have

Unknown 15:00
Understand the other side. But ultimately what's happened is the Internet has provided us a place where we can go and we can be more polarized than we have ever been before. And part of the reason for that is what you kind of mentioned here, Joe, that these news feeds know what we like we have a big companies like the gray lady, it's a New York Times that says, if it was not for anti Trump articles, they would not be in business anymore. So with the New York Times is obviously catering to the anti Trump crowd. But that's being pushed through out all of the technology throughout all of these news sources from Twitter, if you want to call it a new source on out where they are catering to what we want to see and not necessarily what we should see. We're seeing stuff from our news feeds that is biased towards our thinking at least.

Unknown 16:00
This bias towards what they think that we're thinking and they think we want to see. So it's bad now it's getting worse as news organizations look at the Huffington Post look at what's been happening with a number of online news sites. Now they're laying people off because people aren't going to their site so they're getting more dramatic they're putting more stuff out there that just really clickbait they're making up stuff. They're lying about technology news all the way through political news, just to get your eyeballs to sell advertising and Joe that means we're in a bad spot. And that's why Frankly, I think, you know, radio and I heart is doing so well because we have these discussions, but you aren't going to see those on the Huffington Post. not see anything on the Huffington Post. They're laying off people left and right. Craig Peterson, our tech guru joins us at this time every Wednesday.

Unknown 17:00
Appreciate it. Craig and we'll talk again next week. Gentlemen, take care. Thank you much Craig. You know you mentioned but you know we only have about a minute before the break.

---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on the Jim Polito show as they discussed two factor authentication, how to manage your passwords, and the data breach that leaked 773 million emails.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

Biggest Data Breach Yet Has Leaked 773 Million Emails. Here’s What You Need To Do Now
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/29/2019

Safe Gun Technology - Huge Hack Collection - Proper Use Of Passwords And 2FA

Craig Peterson: 0:00

Hey, good morning, everybody. Craig Peterson here. Before I was on with Jim Polito this morning, it was talking about an interesting case down in Mass where there was a guy who was defending himself with a firearm and the bad guy decided he was going to take off and he hopped into his car and the guy with a firearm hopped on the hood of the car and held the you know the bad guy right obviously this whole thing has to go to court and everything figure out you know, was he a bad guy what happened here but but anyways he was on the hood of the car pointing his gun at them just incredible. So that's what we started out with today. Talking about that, what that meant, what that means. And I talked a little bit about the technology behind guns and some of the things that have been tried and frankly, and failed. And we also correspond some time about data leaks more on 1Password. And the way to use 2FA. All of that this morning with Mr. Jim Polito, take care Have a great day, everybody and keep an eye on your mailbox. Hopefully you've been getting my emails this week. We're building up to something big next week

Unknown 1:17
Everybody. Everyone's favorite Canadian and Tech Talk guru our good friend Craig Peterson. Good morning sir Good morning Jim How you doing today Craig I'm doing well interesting topic when it comes to firearms some technology proposed over the years you know these these guns we see on the sci fi movies they can only be fired by the rightful owner or someone who's on the guys side yeah and the fields of the years one what was interesting was you were a mike medic rings and that was used to unlock the city as this gun and then they're continually our proposals by

Unknown 2:00
Senator Schumer and other results as the years that they somehow build in some sort of computer thing that may be reached your fingerprints, or maybe he says DNA, none of those types of things, actually working guns. And that's just the work of science fiction Southern. There's really a lot of misunderstandings about firearms and using them safely and what the law allows and and what technology can do with them

Unknown 2:27
to go around corners with the Angelina Jolie and

Unknown 2:34
Mr. And Mrs. Smith or

Unknown 2:38
one of them. But anyway, it's understanding. Yeah, yeah, it is. And look, the bottom line is the real technology that the best control guns is between your ears. That's the real technology. So hey, here we go again. Craig. 773 million emails. What's going on?

Unknown 3:11
Yeah, as you as you were saying earlier this morning, it really is time to change your password again, your email password. And to that, and I'm continuing to recommend 1Password. It's a piece of software that now not only keeps track of your password and your accounts and automatically will fill them in for you on websites, as long as you remember your master password. Yeah, but it also keeps track of hacks, it keeps track of what passwords have been found out on the dark web. Yeah, really, it says all kinds of things. So what we're finding now is three quarters of a billion email addresses which tens of millions of passwords. This is likely a collection of passwords and email accounts that they've been found over the years.

Unknown 4:00
It's all the put together and is now being sold on the dark web.

Unknown 4:06
And if they're successful in using the gym, and that's what really kind of kept me going here, because the only reason that the bad guys is successful in using these passwords, some of which are older, is this piece, reuse the same credentials on multiple services. Yeah, and that simple, it's that so so they get one from you, and they get them all. Yeah, well, that's kind of what it is right? If you use the same email address, and you use the same password on multiple websites, or let's say you use it on your face website. And let's assume the bank has reasonable security and email says it's probably as reasonable security right? And then you use the same email address with the same password on Joe's morning cartoon website. And Joe's cartoon site gets hacked.

Unknown 5:00
Now what happens is the bad guys take your your email address and your password from Joe's cartoons that they stole. And they try it on Bank of America and you name it every major bank out there and the end you if you use the same email address and the same password, they are in your bank account information. It's just that simple. We're talking with our good friend Craig Peterson. And at the end of this segment, we're going to give you a number and you can text My name to it. And when you do, you'll get all of this information from Craig Peterson. He will not annoy you with incessant messages or try to sell you anything. It's just it's a great service that he offers to listeners to the show which we truly appreciate. Standard date and text rates apply. Okay, what was it password one is the Is it an app that you were talking about to help manage your passwords and protect you

Unknown 6:00
It's called 1Password. Oh 1Password. Just 1, and then password. Now they have some 3 levels, I use the paid stuff, we use it for businesses. So there's one other thing that you got to do. And that's called two factor authentication. And 1Password support a lot of two factor authentication sites. But at the very least, set up two factor authentication, sometimes a brief abbreviated to App a. And what that allows them to do now is in the simplest form, send a text message to your phone. So by the way, if you lose your phone, you might have some issues here. And if you also lose your phone number, change your phone number. Remember if you've used it for two factor authentication, but the idea is you try and log in on the website and then the website confirms what you know which is your username and password with something that you

Unknown 7:00
You have, which is your cell phone. Or in the case of one password, you've got the 1Password app on your phone. And that type of basic security something you know, along with something you have. So even if the bad guys have your know side to say, have your email address and your password, they don't have your phone. So if they try and log into your account, or if you try and log into your account, your your bank or whatever site you're going to, he's going to go ahead and send you a text message with a confirmation code. You then enter that confirmation cozy, and then you're all set. So if someone tries to log in and was on authorized, you're going to get that text message with that confirmation code. And immediately you're going to know something is a foot Now there are some major things in progress. This year, we're going to see some major advances because Google Chrome already has

Unknown 8:00
This built in so far is getting it a lot of browsers are getting and it's using some special types of two factor authentication the Yubikey than others and and I'm going to put together the master class that will have for the listeners again absolutely free for them to attend that explains how to do this yes particularly if you're a business you've got a fiduciary responsibility to keep data safe particularly personal information and you know I've got to help house because it's happening to everybody and Jim you brought up at three quarters of a billion

Unknown 8:39
in that one file that everybody okay

Unknown 8:45
yeah that is downtown. What's a huge But no, it is huge. Now I was reading that this is called what in the hacking world collection number one which means there could be

Unknown 9:00
More collections on the way Yeah, they're almost certainly are going to be

Unknown 9:06
you know that what here's what happens they say seals the data they break into a website and they use different technologies sequel injection other things but they use technologies to get at the database this behind the website and then once they're they have access to that database so just dump everything out of it because most businesses just hard keeping it safe enough, right you shouldn't be able to do that. But anyways, they dump it out and then they go ahead and they go to keep it as an eBay for the bad guy that goes to these websites on the dark web. Yeah, allow options allows them to sell things and then they start selling them and then after a while that data becomes signs of sale. So they sold your email address and password for effectively a fraction of a penny as part of our collection of a breach. And now it's been 16

Unknown 10:00
months since they did it last so they building these collections This is all collection of a one Jim because it's the biggest ever but there are dozens if not hundreds of these collections out there already and it's you have not changed your password in the last few months you are incredibly susceptible to having your data stolen your money stolen and your identity stolen and we talked before about this you could get pulled over by a police officer the side of the road for a broken taillight. Yeah, and all of a sudden it's a felony

Unknown 10:36
in the could happen to you because your data with solar you gotta keep up on that. I know, can you imagine that, that there's a warrant out for you, you know, and that's a standard part and folks don't understand a warren check is a standard part of a pullover just to make sure there's no outstanding warrants for you. And let's say somebody did take your identity.

Unknown 11:00
They went out and they did something that resulted in a warrant guess what they're gonna rescue and then you can you imagine you're trying to explain to the cop

Unknown 11:12
never been I've never been on the floor right you're

Unknown 11:17
you're you are in jail kissing the pavement and 10 degree weather is this can happen. Look at one password. This is it. One password is how you'll find it online. There's a couple of others that are okay. last pass is pretty good. But I really if you want the best stuff, one password is the way to go. Change your passwords, make it a year New Year's resolution, get one password, have it generate the passwords for you. There's lots of videos on how to use it out there and then go and use it all year long. Start using two factor authentication. You are the only one who cares enough about your personal information, frankly.

Unknown 12:00
really do anything as far as these big companies out there that lose your data, you're just the balance sheet entry. It's your life. You've got to take control. There's a lot of other information about this. There's information about other things. And Craig Peterson has it all. And as I said earlier, all the jab to do is text My name to this number 855-385-5553. That's 855-385-5553 standard data and text rates apply Craig as usual, right on top of things. We really appreciate the time

Unknown 12:40
Talk to you next week when we return a final word.

---

Don't miss any episode from Craig. Visit http://CraigPeterson.com/itunes. Subscribe and give us a rating!

Thanks, everyone, for listening and sharing our podcasts. We're really hitting it out of the park. This will be a great year! 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

Craig is on the Jim Polito show as they discussed two factor authentication, how to manage your passwords, and the data breach that leaked 773 million emails.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles:

Biggest Data Breach Yet Has Leaked 773 Million Emails. Here’s What You Need To Do Now
---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/29/2019

Safe Gun Technology - Huge Hack Collection - Proper Use Of Passwords And 2FA

Craig Peterson: 0:00

Hey, good morning, everybody. Craig Peterson here. Before I was on with Jim Polito this morning, it was talking about an interesting case down in Mass where there was a guy who was defending himself with a firearm and the bad guy decided he was going to take off and he hopped into his car and the guy with a firearm hopped on the hood of the car and held the you know the bad guy right obviously this whole thing has to go to court and everything figure out you know, was he a bad guy what happened here but but anyways he was on the hood of the car pointing his gun at them just incredible. So that's what we started out with today. Talking about that, what that meant, what that means. And I talked a little bit about the technology behind guns and some of the things that have been tried and frankly, and failed. And we also correspond some time about data leaks more on 1Password. And the way to use 2FA. All of that this morning with Mr. Jim Polito, take care Have a great day, everybody and keep an eye on your mailbox. Hopefully you've been getting my emails this week. We're building up to something big next week

Unknown 1:17
Everybody. Everyone's favorite Canadian and Tech Talk guru our good friend Craig Peterson. Good morning sir Good morning Jim How you doing today Craig I'm doing well interesting topic when it comes to firearms some technology proposed over the years you know these these guns we see on the sci fi movies they can only be fired by the rightful owner or someone who's on the guys side yeah and the fields of the years one what was interesting was you were a mike medic rings and that was used to unlock the city as this gun and then they're continually our proposals by

Unknown 2:00
Senator Schumer and other results as the years that they somehow build in some sort of computer thing that may be reached your fingerprints, or maybe he says DNA, none of those types of things, actually working guns. And that's just the work of science fiction Southern. There's really a lot of misunderstandings about firearms and using them safely and what the law allows and and what technology can do with them

Unknown 2:27
to go around corners with the Angelina Jolie and

Unknown 2:34
Mr. And Mrs. Smith or

Unknown 2:38
one of them. But anyway, it's understanding. Yeah, yeah, it is. And look, the bottom line is the real technology that the best control guns is between your ears. That's the real technology. So hey, here we go again. Craig. 773 million emails. What's going on?

Unknown 3:11
Yeah, as you as you were saying earlier this morning, it really is time to change your password again, your email password. And to that, and I'm continuing to recommend 1Password. It's a piece of software that now not only keeps track of your password and your accounts and automatically will fill them in for you on websites, as long as you remember your master password. Yeah, but it also keeps track of hacks, it keeps track of what passwords have been found out on the dark web. Yeah, really, it says all kinds of things. So what we're finding now is three quarters of a billion email addresses which tens of millions of passwords. This is likely a collection of passwords and email accounts that they've been found over the years.

Unknown 4:00
It's all the put together and is now being sold on the dark web.

Unknown 4:06
And if they're successful in using the gym, and that's what really kind of kept me going here, because the only reason that the bad guys is successful in using these passwords, some of which are older, is this piece, reuse the same credentials on multiple services. Yeah, and that simple, it's that so so they get one from you, and they get them all. Yeah, well, that's kind of what it is right? If you use the same email address, and you use the same password on multiple websites, or let's say you use it on your face website. And let's assume the bank has reasonable security and email says it's probably as reasonable security right? And then you use the same email address with the same password on Joe's morning cartoon website. And Joe's cartoon site gets hacked.

Unknown 5:00
Now what happens is the bad guys take your your email address and your password from Joe's cartoons that they stole. And they try it on Bank of America and you name it every major bank out there and the end you if you use the same email address and the same password, they are in your bank account information. It's just that simple. We're talking with our good friend Craig Peterson. And at the end of this segment, we're going to give you a number and you can text My name to it. And when you do, you'll get all of this information from Craig Peterson. He will not annoy you with incessant messages or try to sell you anything. It's just it's a great service that he offers to listeners to the show which we truly appreciate. Standard date and text rates apply. Okay, what was it password one is the Is it an app that you were talking about to help manage your passwords and protect you

Unknown 6:00
It's called 1Password. Oh 1Password. Just 1, and then password. Now they have some 3 levels, I use the paid stuff, we use it for businesses. So there's one other thing that you got to do. And that's called two factor authentication. And 1Password support a lot of two factor authentication sites. But at the very least, set up two factor authentication, sometimes a brief abbreviated to App a. And what that allows them to do now is in the simplest form, send a text message to your phone. So by the way, if you lose your phone, you might have some issues here. And if you also lose your phone number, change your phone number. Remember if you've used it for two factor authentication, but the idea is you try and log in on the website and then the website confirms what you know which is your username and password with something that you

Unknown 7:00
You have, which is your cell phone. Or in the case of one password, you've got the 1Password app on your phone. And that type of basic security something you know, along with something you have. So even if the bad guys have your know side to say, have your email address and your password, they don't have your phone. So if they try and log into your account, or if you try and log into your account, your your bank or whatever site you're going to, he's going to go ahead and send you a text message with a confirmation code. You then enter that confirmation cozy, and then you're all set. So if someone tries to log in and was on authorized, you're going to get that text message with that confirmation code. And immediately you're going to know something is a foot Now there are some major things in progress. This year, we're going to see some major advances because Google Chrome already has

Unknown 8:00
This built in so far is getting it a lot of browsers are getting and it's using some special types of two factor authentication the Yubikey than others and and I'm going to put together the master class that will have for the listeners again absolutely free for them to attend that explains how to do this yes particularly if you're a business you've got a fiduciary responsibility to keep data safe particularly personal information and you know I've got to help house because it's happening to everybody and Jim you brought up at three quarters of a billion

Unknown 8:39
in that one file that everybody okay

Unknown 8:45
yeah that is downtown. What's a huge But no, it is huge. Now I was reading that this is called what in the hacking world collection number one which means there could be

Unknown 9:00
More collections on the way Yeah, they're almost certainly are going to be

Unknown 9:06
you know that what here's what happens they say seals the data they break into a website and they use different technologies sequel injection other things but they use technologies to get at the database this behind the website and then once they're they have access to that database so just dump everything out of it because most businesses just hard keeping it safe enough, right you shouldn't be able to do that. But anyways, they dump it out and then they go ahead and they go to keep it as an eBay for the bad guy that goes to these websites on the dark web. Yeah, allow options allows them to sell things and then they start selling them and then after a while that data becomes signs of sale. So they sold your email address and password for effectively a fraction of a penny as part of our collection of a breach. And now it's been 16

Unknown 10:00
months since they did it last so they building these collections This is all collection of a one Jim because it's the biggest ever but there are dozens if not hundreds of these collections out there already and it's you have not changed your password in the last few months you are incredibly susceptible to having your data stolen your money stolen and your identity stolen and we talked before about this you could get pulled over by a police officer the side of the road for a broken taillight. Yeah, and all of a sudden it's a felony

Unknown 10:36
in the could happen to you because your data with solar you gotta keep up on that. I know, can you imagine that, that there's a warrant out for you, you know, and that's a standard part and folks don't understand a warren check is a standard part of a pullover just to make sure there's no outstanding warrants for you. And let's say somebody did take your identity.

Unknown 11:00
They went out and they did something that resulted in a warrant guess what they're gonna rescue and then you can you imagine you're trying to explain to the cop

Unknown 11:12
never been I've never been on the floor right you're

Unknown 11:17
you're you are in jail kissing the pavement and 10 degree weather is this can happen. Look at one password. This is it. One password is how you'll find it online. There's a couple of others that are okay. last pass is pretty good. But I really if you want the best stuff, one password is the way to go. Change your passwords, make it a year New Year's resolution, get one password, have it generate the passwords for you. There's lots of videos on how to use it out there and then go and use it all year long. Start using two factor authentication. You are the only one who cares enough about your personal information, frankly.

Unknown 12:00
really do anything as far as these big companies out there that lose your data, you're just the balance sheet entry. It's your life. You've got to take control. There's a lot of other information about this. There's information about other things. And Craig Peterson has it all. And as I said earlier, all the jab to do is text My name to this number 855-385-5553. That's 855-385-5553 standard data and text rates apply Craig as usual, right on top of things. We really appreciate the time

Unknown 12:40
Talk to you next week when we return a final word.

---

Don't miss any episode from Craig. Visit http://CraigPeterson.com/itunes. Subscribe and give us a rating!

Thanks, everyone, for listening and sharing our podcasts. We're really hitting it out of the park. This will be a great year! 

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

This morning, Craig was on with Jack Heath discussing two things: One was the software sold by an Israeli used to track Khashoggi, and the impact of the current government shutdown.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

How A Hacked Phone May Have Led Killers To Khashoggi
---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/28/2019

Impact Of Government Shutdown - Hacked Phone May Have Led Killers To Khashoggi

Craig Peterson 0:00
Hey, good morning, everybody. Craig Peterson here. We had a great webinar session on Friday for all of those who signed up to find out more about their credit and keeping it locked up for free. So thanks everybody for attending. And also, of course, for all of your questions. And if you did sign up, that replay will be available probably a little bit later on this week, we're going to do a little bit of cleanup, because of course, the tech guys webinar recording didn't work quite the way we wanted it to. But anyway, so we'll have that out a little bit later on this week, we got more stuff coming out, I have really kind of turned a new leaf this year, you know how I've been trying to help people for ever, and particularly small businesses, because they're the hardest hit right now with the most to lose of everybody when it comes to the hackers. So I am starting a whole new series this year of webinars and all kinds of information, informational products, etc, etc. So that's all this year. And it starts this week. So as of Monday, and we're talking about January 28, you should be starting to see some emails from me on a daily basis here for the next week or two where I have kind of a little bit of background what I've been doing and going beyond just my background, then starting to give away way more information. So keep an eye on your mailbox email box. Thanks everybody over the weekend, who reached out to say hello and and thanks. And thanks to you for letting me know. And you know it, it's great to hear people who are grateful for all of the work that you do. This is really quite the labor of love.

So this morning, I was on with our friend Jack Heath. And we talked about two different things. One really was, I think, frankly, very disturbing. And that is some software sold by an Israeli firm that may have been used to track Khashoggi the, you know, that quote, journalist, unquote. And, of course, there's all kinds of articles one way or the other on that, but CNN wires, and it was also repeated another places in the news, Fox had this story as well. But I've got this up on my website. The story from CNN wires is saying that this software is called Pegasus, and it's dangerous. And it's being used by some of the worst regimes in the world to track people. And then in this case, maybe even killed people. Of course, they're denying it. We talked a little bit too, about the impact of the government shutdown. And there was, I think, a very big impact. I've been reading articles about what's been happening with some of the contractors who are never going to get paid for this government shutdown, who are handling security for various federal government agencies. So we talked a little bit about that. And of course, I mentioned the surveillance state and surveillance by government. But there's a whole new concept and you might find this interesting. It's an article that was in The Guardian, I have it up on my website at http://CraigPeterson.com. But welcome to the age of surveillance capitalism. Now, I'm not fond of the term capitalism here because it's really not a capitalistic thing, per se. But the everybody from your phone company on out is selling your personal data. So what does that mean to you? I think you might find that interesting up on my website. So here we go with Mr. Heath

Jack Heath 3:44
Right now. We bring in our tech talk guy Craig Peterson. His show Tech Talk airs on iHeart news talk station. He joins us on the Auto Fair listener lines. Craig, is there a tech talk angle or connection to the government shutdown? I mean, did we learn anything about you know, how we're doing in terms of efficiencies and all that, When, when, when there are fewer government workers? Or, or is that something you didn't look at?

Craig 4:08
Hey, good morning Jack, that the shutdown have had a number of impact. And when it comes to some of the technology side, and one of the biggest ones that people have been worried about is the impact to our cybersecurity. And of course, that's something I pay close attention to. And with the government shutdown in place, there were a number of different agencies that did not have all of this cybersecurity people that they would normally have available. Remember that we're talking about a number of different types of people impacted, you've got the employees who will be paid, apparently, within the next week or so. But you also have the contractors, many of whom will never be paid. And many of the people who are handling security for various federal government and state government agencies. But in this case, of course, certainly concerned about the Fed, many of those people are actually contractors, and with more than 1 million unfilled security jobs nationwide, I'm afraid what might well have happened here is that many of these contractors who are good security, they can find a job in the private sector and our setup with this whole government mass have left the via employee, basically, at the federal government are now going over to the private industry. And we may have seen some serious, unforeseen circumstances here where the best people who can easily get another job did get another job and the cyber security specialist. So the ones that I'm very, very worried about,

Jack 5:50
Well, again, then other people would say, unless they had a household where they had a federal worker, in some cases, couples are married, they both work for the federal government unless you were directly impact. And a lot of people said, Well, you know, I didn't really didn't affect my life that much. 

Craig 6:02
Well, if you get outside those contractors who are doing security, and I've read a few articles about some, but if you get outside of those contractors, frankly, there doesn't seem to have been a ton of impact on the technology front, you know, some things have slowed down, the IRS has multiple attempts at trying to put a new computer system in place, and they continue to fail, of course, that was put aside and, and various other things. So we, from a technology standpoint, I think the biggest impact is going to be on some of the contractors who were not paid and will never be paid, and frankly, may never be able to recover that money. So you're right, Jack. I think that the impact is is a little bit overblown in the media. But I do know some people who were directly impacted in the security realm.

Jack 6:53
Interesting right, what else is catching your eyes we begin this week?

Craig 6:57
Well, we of course know about to show be a little bit here and what ended up happening with his stats and the, you know, alleged murder at this point, there is an Israeli based cyber company called the NFL group. And so and they were condemned as the worst of the worst by Edward Snowden. Remember him the NSA whistleblower? Well, apparently they have been selling software to governments, including Saudi Arabia, and other governments who are very repressive. And these tools that they have are set up for spying on people for burglary. And in fact, their software which is called Pegasus, you can look it up and find out a lot about it is malware that is used by governments to to send a message to someone on their smartphone or on their computer, but in this case, into Shelby with Khashoggi it's the smartphone and all they have to do is click on the link in that text message comes in, and now the phones compromise they have access to the microphone and camera and depending on the phone, which is why again, I keep advising people don't use Android, but apparently they may have had some involvement with a showpiece das although they're denying that they did anything wrong because the Saudis had access to Pegasus or something similar, and it was used to track him find out where he was at what he was doing. He was monitored. And this is alarming, frankly, in this age of surveillance. where companies are severely miss our government surveillance and more. We've got to be very, very careful because the bad guys are doing it as well.

Jack 8:49
Interesting. All right. Craig. Check it out. Craig Peterson, O-N. http://CraigPeterson.com. Thanks, Craig.

Craig 8:54
Hey, thanks, Jack. 

Craig 9:00
Hey, over the weekend, by the way, my weekend radio show somebody pointed out that there is a bed of music that kind of gets a little bit loud during one part of the audio so. Hey, thanks for pointing that out. If you do have things like that, that you notice we're always trying to improve but sometimes they sneak past right you can always email [email protected] with questions or comments. That's [email protected]. Take care. Have a great day. We'll be back tomorrow.

 ---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

This morning, Craig was on with Jack Heath discussing two things: One was the software sold by an Israeli used to track Khashoggi, and the impact of the current government shutdown.

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Related Articles 

How A Hacked Phone May Have Led Killers To Khashoggi
---

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/28/2019

Impact Of Government Shutdown - Hacked Phone May Have Led Killers To Khashoggi

Craig Peterson 0:00
Hey, good morning, everybody. Craig Peterson here. We had a great webinar session on Friday for all of those who signed up to find out more about their credit and keeping it locked up for free. So thanks everybody for attending. And also, of course, for all of your questions. And if you did sign up, that replay will be available probably a little bit later on this week, we're going to do a little bit of cleanup, because of course, the tech guys webinar recording didn't work quite the way we wanted it to. But anyway, so we'll have that out a little bit later on this week, we got more stuff coming out, I have really kind of turned a new leaf this year, you know how I've been trying to help people for ever, and particularly small businesses, because they're the hardest hit right now with the most to lose of everybody when it comes to the hackers. So I am starting a whole new series this year of webinars and all kinds of information, informational products, etc, etc. So that's all this year. And it starts this week. So as of Monday, and we're talking about January 28, you should be starting to see some emails from me on a daily basis here for the next week or two where I have kind of a little bit of background what I've been doing and going beyond just my background, then starting to give away way more information. So keep an eye on your mailbox email box. Thanks everybody over the weekend, who reached out to say hello and and thanks. And thanks to you for letting me know. And you know it, it's great to hear people who are grateful for all of the work that you do. This is really quite the labor of love.

So this morning, I was on with our friend Jack Heath. And we talked about two different things. One really was, I think, frankly, very disturbing. And that is some software sold by an Israeli firm that may have been used to track Khashoggi the, you know, that quote, journalist, unquote. And, of course, there's all kinds of articles one way or the other on that, but CNN wires, and it was also repeated another places in the news, Fox had this story as well. But I've got this up on my website. The story from CNN wires is saying that this software is called Pegasus, and it's dangerous. And it's being used by some of the worst regimes in the world to track people. And then in this case, maybe even killed people. Of course, they're denying it. We talked a little bit too, about the impact of the government shutdown. And there was, I think, a very big impact. I've been reading articles about what's been happening with some of the contractors who are never going to get paid for this government shutdown, who are handling security for various federal government agencies. So we talked a little bit about that. And of course, I mentioned the surveillance state and surveillance by government. But there's a whole new concept and you might find this interesting. It's an article that was in The Guardian, I have it up on my website at http://CraigPeterson.com. But welcome to the age of surveillance capitalism. Now, I'm not fond of the term capitalism here because it's really not a capitalistic thing, per se. But the everybody from your phone company on out is selling your personal data. So what does that mean to you? I think you might find that interesting up on my website. So here we go with Mr. Heath

Jack Heath 3:44
Right now. We bring in our tech talk guy Craig Peterson. His show Tech Talk airs on iHeart news talk station. He joins us on the Auto Fair listener lines. Craig, is there a tech talk angle or connection to the government shutdown? I mean, did we learn anything about you know, how we're doing in terms of efficiencies and all that, When, when, when there are fewer government workers? Or, or is that something you didn't look at?

Craig 4:08
Hey, good morning Jack, that the shutdown have had a number of impact. And when it comes to some of the technology side, and one of the biggest ones that people have been worried about is the impact to our cybersecurity. And of course, that's something I pay close attention to. And with the government shutdown in place, there were a number of different agencies that did not have all of this cybersecurity people that they would normally have available. Remember that we're talking about a number of different types of people impacted, you've got the employees who will be paid, apparently, within the next week or so. But you also have the contractors, many of whom will never be paid. And many of the people who are handling security for various federal government and state government agencies. But in this case, of course, certainly concerned about the Fed, many of those people are actually contractors, and with more than 1 million unfilled security jobs nationwide, I'm afraid what might well have happened here is that many of these contractors who are good security, they can find a job in the private sector and our setup with this whole government mass have left the via employee, basically, at the federal government are now going over to the private industry. And we may have seen some serious, unforeseen circumstances here where the best people who can easily get another job did get another job and the cyber security specialist. So the ones that I'm very, very worried about,

Jack 5:50
Well, again, then other people would say, unless they had a household where they had a federal worker, in some cases, couples are married, they both work for the federal government unless you were directly impact. And a lot of people said, Well, you know, I didn't really didn't affect my life that much. 

Craig 6:02
Well, if you get outside those contractors who are doing security, and I've read a few articles about some, but if you get outside of those contractors, frankly, there doesn't seem to have been a ton of impact on the technology front, you know, some things have slowed down, the IRS has multiple attempts at trying to put a new computer system in place, and they continue to fail, of course, that was put aside and, and various other things. So we, from a technology standpoint, I think the biggest impact is going to be on some of the contractors who were not paid and will never be paid, and frankly, may never be able to recover that money. So you're right, Jack. I think that the impact is is a little bit overblown in the media. But I do know some people who were directly impacted in the security realm.

Jack 6:53
Interesting right, what else is catching your eyes we begin this week?

Craig 6:57
Well, we of course know about to show be a little bit here and what ended up happening with his stats and the, you know, alleged murder at this point, there is an Israeli based cyber company called the NFL group. And so and they were condemned as the worst of the worst by Edward Snowden. Remember him the NSA whistleblower? Well, apparently they have been selling software to governments, including Saudi Arabia, and other governments who are very repressive. And these tools that they have are set up for spying on people for burglary. And in fact, their software which is called Pegasus, you can look it up and find out a lot about it is malware that is used by governments to to send a message to someone on their smartphone or on their computer, but in this case, into Shelby with Khashoggi it's the smartphone and all they have to do is click on the link in that text message comes in, and now the phones compromise they have access to the microphone and camera and depending on the phone, which is why again, I keep advising people don't use Android, but apparently they may have had some involvement with a showpiece das although they're denying that they did anything wrong because the Saudis had access to Pegasus or something similar, and it was used to track him find out where he was at what he was doing. He was monitored. And this is alarming, frankly, in this age of surveillance. where companies are severely miss our government surveillance and more. We've got to be very, very careful because the bad guys are doing it as well.

Jack 8:49
Interesting. All right. Craig. Check it out. Craig Peterson, O-N. http://CraigPeterson.com. Thanks, Craig.

Craig 8:54
Hey, thanks, Jack. 

Craig 9:00
Hey, over the weekend, by the way, my weekend radio show somebody pointed out that there is a bed of music that kind of gets a little bit loud during one part of the audio so. Hey, thanks for pointing that out. If you do have things like that, that you notice we're always trying to improve but sometimes they sneak past right you can always email [email protected] with questions or comments. That's [email protected]. Take care. Have a great day. We'll be back tomorrow.

 ---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Message Input:

Message #techtalk

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

I know you have heard of SpearPhishing - but it has nothing to do with how fishing is done in the South Pacific.  It is a targeted attack and you need to understand how it happens and why it is so effective - Listen in as I discuss this in detail.

There is a lot of cover-up going on for the malfeasance in DC these days.  Who better to blame than the Big Bad Russians.  With the DNC who can't seem to protect their systems, whenever something happens they immediately blame the Russians.  Well, not so fast.  Listen in today and I will tell you that it is not always the Russians especially when it comes to the DNC.

Do you know what the Largest Data Breach Ever is? I will cover that in today's show!

The Global Data Privacy Regulation went into full effect in May last year and they have now snared their first big fine against a company who failed to comply. Listen in and I will tell you who it was and why they were caught. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/26/2019

What Is Spear Phishing Really - DNC Says Russians Attacking Them Again - Largest Data Breach Ever - GDPR Snares First Big Fine

Craig Peterson: 0:00

Hey, good morning, everybody. Craig Peterson here with our new bumper music. As I said last week, I'm gonna like this. It's kind of cool. It's a, it's called bound and determined and I got the licenses to use this. So, you probably hear it again, that's for sure. Hey, show number 991, almost 1000 weeks of shows. How's that for a long time. And of course, we've been podcasting now one of the longest podcasters out there, but I've never really done any the heavy promotion so, all of you who have found the show either on the radio or heard me as a guest or see me as a regular on TV, etc. and found this as a podcast. Welcome to you and everyone listening over the air. Hey, hi. Howdy everybody, of course, I am on every Saturday at this same time we're having to cut it back a bit. I had a three hour show for many, many years and that was kind of fun and I had a lot of different guests on and it just got to be all-consuming because it was taking us, my wife was helping out and of course I was doing a lot of work and I would say it probably was in the order of two to three full days a week to put together a three hour show on Saturday. Because you know me, right, I like to do the research like to have great guests when I do have guests and try and put everything in order so a whole lot of work and we cut it back in the stations had some paying customers that wanted the time I was on and a chance for them to make some more money from some other people really good thing so I'm not paid for this I do this out of love this is definitely a labor of love and I have had so many wonderful emails from everybody, not everybody, but from so many people out there it was everybody but so many people out there just thanking me for it because they realize the amount of effort I put in some you know some just been too kind. It's been phenomenal, so thanks, to everyone that's reached out and said hello. Everybody who has rated the podcast over on iTunes. We keep trying to follow up with Iheart to get it on their podcast platform and it just hasn't happened. It's just weird. So, I'm on a number of other platforms out there platforms and want me to pay to be on them hey I'm not there I do you have a content provider. I use Libsyn because I was hosting at myself for a lot of years and Libsyn has some better stats and statistical programs and things that are you know useful for us because that way we can see who's listening where they're listening and everything and I find that interesting and get to see trends in the shows and whether or not it really makes sense for me to keep it up so for now anyways it's making sense because there's just so many wonderful people saying wonderful things about it and we may go back to an hour I'm not sure depends on what happens on these radio stations that I'm on but I am on every week as well on iHeart. I am covering pretty much just didn't New Hampshire with Jack Heath every Monday morning at about 730 and of course we're discussing the latest in security and technology topics but I'm on with him at 730 on a whole bunch of stations in fact a few different chains of stations that I'm on. And I am on Tuesday mornings in Mass in Worcester and in Springfield but two second biggest and third biggest cities in the state of Mass. And I'm on with the Jim Polito show there. And on Wednesdays. I'm on in Maine up on WGAN and their affiliate stations throughout the state of Maine.

So I'm probably gonna keep doing those. I don't see why wouldn't do those. And I want to keep doing this radio show as well because it is helping a lot of people. And that's our goal. Yesterday afternoon, we had a special seminar you should have gotten and I'm not going to harp on you anymore. I've sent like three or four emails to everybody. You should have gotten my free special report on how to keep your information safe from hackers because they got it right. There's no two ways about it. You're right. You know, you've got to have been part of that one of these hacks. I'm going to talk today about another big hack that was uncovered just in the last week or so. So, if you have been hacked and you have had your accounts taken or credit card compromised, it's not your fault. Okay. It really isn't. It's a fault of these companies and government organizations because the feds have been hacked to who just have not cared enough about your security. And really, they don't care. They could hire someone like me, internally, to take care of their security. Heck, they could hire me, but they just don't care. They don't. Right, you are to them a bottom line figure you're expendable if your information was stolen, they look at it and say, Well, how much is it going to cost us if we have to go to court on this. And they figure, well, it's going to be cheaper because most people aren't going to sue and even if they do maybe we can turn it into a class action. And then that'll be cheaper for us, right on and on and on on who hasn't heard this stuff before. It just happens too much and has happened to all of us. And I think that's just a crying shame. So that's what that special report for not remind you to can about it. But if you didn't get it, make sure you check your email because there's no charge for any of this stuff. And yesterday afternoon, I had a walk through some people wanted me to spend some time with them. So we split them up into small groups and did walk and everything with them. So that happened yesterday as well. So shout out to everybody that was on yesterday. glad you were able to join us.

Now today, we have a lot to talk about looks like the DNC and the Russians, or again, this huge email breach. We're going to talk about some scams, it gets kind of technical. And I get into the very technical stuff when I do the webinars for the FBI in regard program. And I'm not going to get real technical with you guys. But I want you to understand a little bit about what's going on. So if you are a business person, you can talk security with your security people and make sure they are covering this very interesting backstory here on Khashoggi and how they may have been able to find him and where did that recording come from? And the surveillance capitalism, great article from The Guardian and the EU privacy law. You've heard me talk about GDPR, and we've helped a lot of companies with that summer concern. I gotta tell you, almost no companies are concerned about it. Well, it looks like Google might be concerned they just got nailed for violating that new law. So let's get going here. Let's talk about what's been happening with these Russian hackers.

You know, I've always wondered just what did the Russians do? Did they do much of anything, they seem to like to just kind of mess around just like we to frankly, you know, it's not as though we are not out there looking at trying to use technology as a first strike capability or defensive capability. We're continually probing other people's networks and monitoring what's going on. So, to hear that the Russians, for instance, are trying to break into something, It's not as though they are our mortal enemies, The fact that they're trying to get in, doesn't mean they are mortal enemies, it does mean that the very least they're trying to get our information and probe our infrastructure, right.   Can we agree on that? Now, when it comes to the political side of things, I think things get a little bit different because frankly, I think in those cases, the Russians are trying to do something different. I think in those cases, the Russians are trying to find information about our policies or politics, just like that might try and get into the State Department or get into the NSA or FBI or something else, just like they have forever, just like we have forever. Have you ever watched a spy movie, right? It's been going on forever. Ethan Hunt, right? What does he do the Tom Cruise character? He's trying to get into things. He's trying to influence things. He's trying to get information to protect informants and everything out. So what has changed isn't the desire of the various nations to get it our information or get it everybody else's information. But what has changed is just the way they're doing it. They don't have to have women trying to seduce like they used to have, they don't have to have so many of these things, because all they need to do is get someone to click on a link. We know about Podesta again, the DNC link where he went ahead, and he clicked on it, a phishing email. Well, was that aimed at him because of his tie to the Clinton campaign, the Obama government or just because he had an email address? The results the same, they got the information, the big question is, did they use it? And what did they use it for?

So now we have a story that came out this last week from the Democratic National Committee. And apparently, they're there, according to this article, and seen it written by Edward Moyer trying to come back and hack them some more. Now. I don't know what's going on. I'm sure the Russians are trying to infiltrate I look at now look at my firewalls right at my home, I look at the firewalls at our office, I look at the firewalls. We are maintaining, you know, managing for businesses all over the world — some of the huge businesses, some of them very small businesses. And I asked myself, what's going on here because I'm seeing attacks, I don't have a server that I can think of that isn't being at least probed almost every second and some of them multiple times a second. So they're being probed. Is that an attack? They're trying to log into these servers. Is that the attack? They may? In my case, they haven't been able to get in, at least not that I've been able to tell, but they try and go to the next level. Is that an attack? Where is the attack? What is the attack vector? When is it an attack? So when the Democratic National Committee says that, following the midterm elections last year, Russian hackers again started going after them. What does that mean? So here's the quote from them. In November 2018, dozens of DNC email addresses were targeted at a spear phishing campaign. Although there is no evidence the attack was successful. The DNC said in court documents filed Thursday What does that mean?

That's the big question, and when you hear about these sorts of attacks from in the political realm you've got to step back and think about a little bit let's talk about the terms, they're using their let's try to make a little bit of sense about it. Because this is a security thing fishing campaigns are where someone sends out an email trying to get you clicked on it. And typically phishing on this case it's about PH is a giant G, but it's the same concept of throwing a fishing line in and see what bite now you might use a lower that you know is good for carp or lower. That's great for rainbow trout of your up in the Pacific Northwest. But that doesn't mean that you're necessarily going to hook one of those and the same things true. You go off the coast of Boston, you're doing deep sea fishing, and you're hoping to catch what may be, hey, I made man catch up to now. Or maybe I can catch a swordfish or you know, the list goes on and on. So you use a lure to get the fish that you want. And hopefully, you'll catch it. The same thing with a phishing attack online; you write a letter, you write an email that looks attractive to the types of fish the types of people you want to catch. So if you want to catch people who are political activists on the left, maybe you send out an email saying, you know this, that this is about to explode underground and credible information about President Trump, and I can't believe it and got to click here. Contrarywise, on the left, you can't believe what Chuck and Nancy just did, right. And they try and get people to click on it. So that's kind of a still a general fishing campaign. But what's this spearfishing campaign, a spear phishing campaign is where again, think about how the South Pacific where you've got an Islander Pacific Islander out there, and they've got a spear maybe it's one of those Trident Spears, you know, the one that has the three tips on it. Have you seen those before, and you can make those yourself probably seen them on survivor, and they're watching in the water. And they see in the water I just under the surface of fish they want to get. So they stab it, they grab that fish, now they've got it, and life is good. They captured that fish. So they were aiming for that fish. And they caught that fish that spearfishing. And in the in the security business when we say spearfishing. We typically mean the going after an individual.

Now there are regular phishing attacks that some educated people might call spear phishing, for instance, they might have your name and email address from a vulnerability. So let's say they got all your information from our friends over at the credit reporting agency last year. So now they've got your name and your email address, and they send out 200 million emails. And each one of them, of course, is going to an individual email address, and it includes the name of the person. And it's including the name of the person that was in the breached record, so is that spearfishing. It's aimed at one person, but a lot of people will call it spearfishing. But security professionals are not going to call that a spear phishing attack. That is a phishing attack. That's like casting a net or dropping a line in and hoping you're going to get them, but it's a little more personal. So instead of the net that you might have had five years ago with phishing attacks, where it's just a generic Nigerian prince type scheme, it moves on to we're going to use a specific type of lower that might work. That's still a phishing attack to now where we're going to make that lower very attractive because we're going to include your name, we're going to make it look legit.

So they might send it out as though it's from Bank of America. And it's got your name in it. And it's got a number in it looks like an account number. It looks like a Bank of America. So you click that is technically not a spear phishing attack. Now, I fought these types of battles forever. Yeah, you know, for instance, what's a hacker versus a cracker. I was a hacker as a kid, that didn't mean I was trying to break into anything. I just hacked it programming because I wasn't a professional. I hadn't been trained; I didn't have enough experience. A hacker was not a bad guy. A hacker was just somebody who was semi-professional. And frankly, in today's world, I would say 90%, maybe 95% of all programmers are hackers. They're not professionals. They don't understand the whole system. They're just taking a drag and drop the component from a Microsoft Visual Basic or C sharp or Java; they're using the just this generic component that they don't understand anything about other than if I feed it this. Hopefully, I'll get that out. That's called hacking. That's the classical definition of hacking. So you try it does it work on doesn't work. Okay, so let's try something else. Let's try and figure this out. That's a hacker.

A cracker is someone who goes in. No, I'm not a cracker. Okay, I'm a white guy. But in crackers. Somebody goes in and tries to break into something tries to crack in just like a Safecracker. So you have programmers that are crackers. And I've been fighting this for 20, 30 years, trying to help people understand there is a difference. And the majority of people out there that call themselves programmers are actually hackers. They're not professionals. They don't have enough experience. They don't understand the whole flow, and all of the implications and side effects of everything they're doing, and you don't want in most cases, that's fine. In most cases, that's all you need your small business, you're trying to build a little database, who cares if you're a professional programmer, doesn't matter. It matters when course is now live, start getting involved, Monday starts getting involved. But even at that, you know, the, there's a lot of hackers working for companies that are taking their our lives into their hands. Anyways, now I'm fighting this next door, I don't know, maybe I should give up on it. Maybe it's a lost cause for me.

But this next world war is phishing campaigns, I look at it and say there's a number of different types of fishing you've got the guys cast and big nets, little catch anything, hopefully, you got the guys that are are using a lower to try and catch up a specific type of person, and then you got the guys that are going after one person and that's spearfishing, and based on this article, I would say that the democrats are misleading people or the whoever is the spokesperson doesn't know what spearfishing is, which is probably the most most likely option here. You know, I try not to put too malice what can easily be attributed to stupidity or ignorance, right.

And in this case, it's probably ignorant. Because if you look at this article on seeing that it says spear phishing is sending bogus emails disguises legitimate ones to full recipients. Well, no, not true. That's only a part very small part of it. Because it also has to do with who you are going after.

Now, I mentioned this a little bit earlier. Let's get into a couple of details on it. I don't know if this was the biggest, biggest breach ever. Obviously, we don't know everything about every breach that's occurred. We know there's been huge breaches of the IRS and huge ones over at the Federal Department of what do they call it, the where all the employees federal employees go through, including background check information, everything, there's just been huge ones out there. And we know about Equifax. We know about so many of these others. This is being called collection number one, because it's thought to be a collection made from multiple hacks that have occurred over who knows how long

So, Troy Hunt, he's a researcher, security researcher down in Australia. And he goes around, and he cruises the dark web. And he's got friends on it. And he kind of comes up with some, I think, some good data, some good information that people should be aware of. And that's why I'm bringing it up right now. And it's kind of a security thing, right? He's a total security geek. And he is he's in love with this stuff. And he makes some money from it, too, which is good. I think he supports himself from that very thing. Well, this collection is one that he found. And they're thinking that it may contain data from as many as 2000 sources, 87 gigabytes of data in all and it has information on some 773 million accounts. So that's three quarters of a billion email addresses and passwords. While it's got about 21 million passwords. As part of this, it's been for sale amongst hackers could be used for credential stuffing. This is a technique where the bad guys are trying multiple email addresses and passwords on as many different apps and services they possibly can. So people are taking lists like this that have email addresses have a password and trying to figure out, figure out where else they might work. And again, this goes back to you are hacked. Okay, that's got to be one of my new solo pins, right? It isn't a security thing anymore. It's an everybody thing you have been having, don't worry about it, you've been hacked, okay, you have to worry about your data and how it's going to be used. But this just reinforces that, frankly, European privacy law, the GDPR French regulators have now fined Google 50 million euros. That was on Monday for via violating the European Union GDPR. Now that's not a lot when you look at Google and how much money that they made, which was like, I think alphabet was about $33 billion in revenue in its most recent quarter, okay, but a lot like the US $2.7 billion fine against Google for anti trust in 2017, which was a record the fine maybe less important than the changes that Google is going to have to make to its privacy and not just for people who are clearly in the European Union but people world why the so there may be some some dramatic actions here against a number of us tech giants. And I think that's going to be good for all of us. Frankly, these GDPR date which is the general data protection regulation, those rules went into effect a few years ago they gain teeth in May of 2018 to almost a year now and this is big this is really big we're seeing GDPR equivalent legislation being worked on in mass in California federal in fact the GDPR had some basis on some guidelines that mass was publishing so this is just one country France and they ruled the Google violated it because they hadn't properly gained consent from users to use their personal data for online advertising now if you signed up for my email list basically anytime in the last few years but it's been very obvious for about six years you've probably noticed so if you go to http://CraigPeterson.com/subscribe meaning by the way, if you do that go to slash subscribe on my website you will get all of my show notes every week and you'll also get information about hacks that are occurring occurring in real time you'll get information also about the free master classes I have and everything else okay so if you haven't already you should do it. http://CraigPeterson.com/subscribe.

But if you do that, you'll notice now that there's two checkboxes on there that you have to click that acknowledge that I can send you an e-mail. So you're consenting to that and that I can promote to you because I might send you an email where I say hey, this is the best thing since sliced bread you got to get this software and whether I make a dime off it or not. That's considered a marketing email even if I'm trying to help you out so you have to click both those boxes before I will allow you to subscribe and then on top of it you hit subscribe and you're not subscribed yet I will send you an email right away saying hey thanks for signing up but you got to click here because I got to confirm you are who you are so that you know some guy that doesn't like you and wants to subscribe to every email list known to man can't just go to my site and the thousand other sites and sign you up so you're not going to get any emails from me unless you double opt in and you also confirm that you really want them on that page now this is something as well that you should be doing if you have a business and you have a website you have to be doing this. And if you want more tips on this let me know just email [email protected]. That might be a great topic for one of our master classes what you need to do in order to comply with these new privacy laws. But let me know know right, I don't know unless you tell me you can either text me back if you're on the SMS list or you can respond to my email if you're on my email list and just let me know that you want to know more about your business website what you should do to comply with GDPR to be glad to let you know okay, I don't charge for this stuff. This really is something I want you guys to know about. You need to know about. So we're going to run through really quickly a few little flashes one looks like a hacked phone may have led the killers to Khashoggi very, very big deal. And apparently, it was software from this company called Pegasus and Israeli based cyber company that makes acting tools that are sold to evil governments worldwide as well as to lessee for governments worldwide. The goal is to automate us welcome to the age of surveillance capitalism you're going to want to read this again it's up on my website http://CraigPeterson.com This is from the guardian and the notes by the way, listen to a podcast all of this is in my show notes as well on popular WordPress plugin was hacked by an angry former employee. I've got that up on there. If you're using multi lingual WordPress, you've got to check that out again on my website. It's all right there and who is checks keep an eye on your domain if you own your own domain as a business because there are scams going on. All right all of that to http://CraigPeterson.com. Make sure you subscribe. http://CraigPeterson.com/subscribe, you'll see it all there. Have a great week and keep an eye on your email box because I got a phenomenal thing coming up here. And I'm going to be starting to send out some emails about it this week. Little bit of training is going on. Have a great week. Take care and we'll chat again next week. And I'll have my next podcast out on Monday. Bye Bye. Thanks for joining us.

---

Related articles:

Biggest Data Breach Yet Has Leaked 773 Million Emails. Here’s What You Need To Do Now

DNC Says Russian Hackers Hit It Again With Phishing Effort After Midterms

How A Hacked Phone May Have Led Killers To Khashoggi

‘The Goal Is To Automate Us’: Welcome To The Age Of Surveillance Capitalism

EU Privacy Law Snares Its First Tech Giant: Google

Popular WordPress Plugin Hacked By Angry Former Employee

How A Who Is Check Could Have Halted A Scam
---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553

I know you have heard of SpearPhishing - but it has nothing to do with how fishing is done in the South Pacific.  It is a targeted attack and you need to understand how it happens and why it is so effective - Listen in as I discuss this in detail.

There is a lot of cover-up going on for the malfeasance in DC these days.  Who better to blame than the Big Bad Russians.  With the DNC who can't seem to protect their systems, whenever something happens they immediately blame the Russians.  Well, not so fast.  Listen in today and I will tell you that it is not always the Russians especially when it comes to the DNC.

Do you know what the Largest Data Breach Ever is? I will cover that in today's show!

The Global Data Privacy Regulation went into full effect in May last year and they have now snared their first big fine against a company who failed to comply. Listen in and I will tell you who it was and why they were caught. 

These and more tech tips, news, and updates visit - CraigPeterson.com

---

Transcript:

Below is a rush transcript of this segment, it might contain errors.

Airing date: 01/26/2019

What Is Spear Phishing Really - DNC Says Russians Attacking Them Again - Largest Data Breach Ever - GDPR Snares First Big Fine

Craig Peterson: 0:00

Hey, good morning, everybody. Craig Peterson here with our new bumper music. As I said last week, I'm gonna like this. It's kind of cool. It's a, it's called bound and determined and I got the licenses to use this. So, you probably hear it again, that's for sure. Hey, show number 991, almost 1000 weeks of shows. How's that for a long time. And of course, we've been podcasting now one of the longest podcasters out there, but I've never really done any the heavy promotion so, all of you who have found the show either on the radio or heard me as a guest or see me as a regular on TV, etc. and found this as a podcast. Welcome to you and everyone listening over the air. Hey, hi. Howdy everybody, of course, I am on every Saturday at this same time we're having to cut it back a bit. I had a three hour show for many, many years and that was kind of fun and I had a lot of different guests on and it just got to be all-consuming because it was taking us, my wife was helping out and of course I was doing a lot of work and I would say it probably was in the order of two to three full days a week to put together a three hour show on Saturday. Because you know me, right, I like to do the research like to have great guests when I do have guests and try and put everything in order so a whole lot of work and we cut it back in the stations had some paying customers that wanted the time I was on and a chance for them to make some more money from some other people really good thing so I'm not paid for this I do this out of love this is definitely a labor of love and I have had so many wonderful emails from everybody, not everybody, but from so many people out there it was everybody but so many people out there just thanking me for it because they realize the amount of effort I put in some you know some just been too kind. It's been phenomenal, so thanks, to everyone that's reached out and said hello. Everybody who has rated the podcast over on iTunes. We keep trying to follow up with Iheart to get it on their podcast platform and it just hasn't happened. It's just weird. So, I'm on a number of other platforms out there platforms and want me to pay to be on them hey I'm not there I do you have a content provider. I use Libsyn because I was hosting at myself for a lot of years and Libsyn has some better stats and statistical programs and things that are you know useful for us because that way we can see who's listening where they're listening and everything and I find that interesting and get to see trends in the shows and whether or not it really makes sense for me to keep it up so for now anyways it's making sense because there's just so many wonderful people saying wonderful things about it and we may go back to an hour I'm not sure depends on what happens on these radio stations that I'm on but I am on every week as well on iHeart. I am covering pretty much just didn't New Hampshire with Jack Heath every Monday morning at about 730 and of course we're discussing the latest in security and technology topics but I'm on with him at 730 on a whole bunch of stations in fact a few different chains of stations that I'm on. And I am on Tuesday mornings in Mass in Worcester and in Springfield but two second biggest and third biggest cities in the state of Mass. And I'm on with the Jim Polito show there. And on Wednesdays. I'm on in Maine up on WGAN and their affiliate stations throughout the state of Maine.

So I'm probably gonna keep doing those. I don't see why wouldn't do those. And I want to keep doing this radio show as well because it is helping a lot of people. And that's our goal. Yesterday afternoon, we had a special seminar you should have gotten and I'm not going to harp on you anymore. I've sent like three or four emails to everybody. You should have gotten my free special report on how to keep your information safe from hackers because they got it right. There's no two ways about it. You're right. You know, you've got to have been part of that one of these hacks. I'm going to talk today about another big hack that was uncovered just in the last week or so. So, if you have been hacked and you have had your accounts taken or credit card compromised, it's not your fault. Okay. It really isn't. It's a fault of these companies and government organizations because the feds have been hacked to who just have not cared enough about your security. And really, they don't care. They could hire someone like me, internally, to take care of their security. Heck, they could hire me, but they just don't care. They don't. Right, you are to them a bottom line figure you're expendable if your information was stolen, they look at it and say, Well, how much is it going to cost us if we have to go to court on this. And they figure, well, it's going to be cheaper because most people aren't going to sue and even if they do maybe we can turn it into a class action. And then that'll be cheaper for us, right on and on and on on who hasn't heard this stuff before. It just happens too much and has happened to all of us. And I think that's just a crying shame. So that's what that special report for not remind you to can about it. But if you didn't get it, make sure you check your email because there's no charge for any of this stuff. And yesterday afternoon, I had a walk through some people wanted me to spend some time with them. So we split them up into small groups and did walk and everything with them. So that happened yesterday as well. So shout out to everybody that was on yesterday. glad you were able to join us.

Now today, we have a lot to talk about looks like the DNC and the Russians, or again, this huge email breach. We're going to talk about some scams, it gets kind of technical. And I get into the very technical stuff when I do the webinars for the FBI in regard program. And I'm not going to get real technical with you guys. But I want you to understand a little bit about what's going on. So if you are a business person, you can talk security with your security people and make sure they are covering this very interesting backstory here on Khashoggi and how they may have been able to find him and where did that recording come from? And the surveillance capitalism, great article from The Guardian and the EU privacy law. You've heard me talk about GDPR, and we've helped a lot of companies with that summer concern. I gotta tell you, almost no companies are concerned about it. Well, it looks like Google might be concerned they just got nailed for violating that new law. So let's get going here. Let's talk about what's been happening with these Russian hackers.

You know, I've always wondered just what did the Russians do? Did they do much of anything, they seem to like to just kind of mess around just like we to frankly, you know, it's not as though we are not out there looking at trying to use technology as a first strike capability or defensive capability. We're continually probing other people's networks and monitoring what's going on. So, to hear that the Russians, for instance, are trying to break into something, It's not as though they are our mortal enemies, The fact that they're trying to get in, doesn't mean they are mortal enemies, it does mean that the very least they're trying to get our information and probe our infrastructure, right.   Can we agree on that? Now, when it comes to the political side of things, I think things get a little bit different because frankly, I think in those cases, the Russians are trying to do something different. I think in those cases, the Russians are trying to find information about our policies or politics, just like that might try and get into the State Department or get into the NSA or FBI or something else, just like they have forever, just like we have forever. Have you ever watched a spy movie, right? It's been going on forever. Ethan Hunt, right? What does he do the Tom Cruise character? He's trying to get into things. He's trying to influence things. He's trying to get information to protect informants and everything out. So what has changed isn't the desire of the various nations to get it our information or get it everybody else's information. But what has changed is just the way they're doing it. They don't have to have women trying to seduce like they used to have, they don't have to have so many of these things, because all they need to do is get someone to click on a link. We know about Podesta again, the DNC link where he went ahead, and he clicked on it, a phishing email. Well, was that aimed at him because of his tie to the Clinton campaign, the Obama government or just because he had an email address? The results the same, they got the information, the big question is, did they use it? And what did they use it for?

So now we have a story that came out this last week from the Democratic National Committee. And apparently, they're there, according to this article, and seen it written by Edward Moyer trying to come back and hack them some more. Now. I don't know what's going on. I'm sure the Russians are trying to infiltrate I look at now look at my firewalls right at my home, I look at the firewalls at our office, I look at the firewalls. We are maintaining, you know, managing for businesses all over the world — some of the huge businesses, some of them very small businesses. And I asked myself, what's going on here because I'm seeing attacks, I don't have a server that I can think of that isn't being at least probed almost every second and some of them multiple times a second. So they're being probed. Is that an attack? They're trying to log into these servers. Is that the attack? They may? In my case, they haven't been able to get in, at least not that I've been able to tell, but they try and go to the next level. Is that an attack? Where is the attack? What is the attack vector? When is it an attack? So when the Democratic National Committee says that, following the midterm elections last year, Russian hackers again started going after them. What does that mean? So here's the quote from them. In November 2018, dozens of DNC email addresses were targeted at a spear phishing campaign. Although there is no evidence the attack was successful. The DNC said in court documents filed Thursday What does that mean?

That's the big question, and when you hear about these sorts of attacks from in the political realm you've got to step back and think about a little bit let's talk about the terms, they're using their let's try to make a little bit of sense about it. Because this is a security thing fishing campaigns are where someone sends out an email trying to get you clicked on it. And typically phishing on this case it's about PH is a giant G, but it's the same concept of throwing a fishing line in and see what bite now you might use a lower that you know is good for carp or lower. That's great for rainbow trout of your up in the Pacific Northwest. But that doesn't mean that you're necessarily going to hook one of those and the same things true. You go off the coast of Boston, you're doing deep sea fishing, and you're hoping to catch what may be, hey, I made man catch up to now. Or maybe I can catch a swordfish or you know, the list goes on and on. So you use a lure to get the fish that you want. And hopefully, you'll catch it. The same thing with a phishing attack online; you write a letter, you write an email that looks attractive to the types of fish the types of people you want to catch. So if you want to catch people who are political activists on the left, maybe you send out an email saying, you know this, that this is about to explode underground and credible information about President Trump, and I can't believe it and got to click here. Contrarywise, on the left, you can't believe what Chuck and Nancy just did, right. And they try and get people to click on it. So that's kind of a still a general fishing campaign. But what's this spearfishing campaign, a spear phishing campaign is where again, think about how the South Pacific where you've got an Islander Pacific Islander out there, and they've got a spear maybe it's one of those Trident Spears, you know, the one that has the three tips on it. Have you seen those before, and you can make those yourself probably seen them on survivor, and they're watching in the water. And they see in the water I just under the surface of fish they want to get. So they stab it, they grab that fish, now they've got it, and life is good. They captured that fish. So they were aiming for that fish. And they caught that fish that spearfishing. And in the in the security business when we say spearfishing. We typically mean the going after an individual.

Now there are regular phishing attacks that some educated people might call spear phishing, for instance, they might have your name and email address from a vulnerability. So let's say they got all your information from our friends over at the credit reporting agency last year. So now they've got your name and your email address, and they send out 200 million emails. And each one of them, of course, is going to an individual email address, and it includes the name of the person. And it's including the name of the person that was in the breached record, so is that spearfishing. It's aimed at one person, but a lot of people will call it spearfishing. But security professionals are not going to call that a spear phishing attack. That is a phishing attack. That's like casting a net or dropping a line in and hoping you're going to get them, but it's a little more personal. So instead of the net that you might have had five years ago with phishing attacks, where it's just a generic Nigerian prince type scheme, it moves on to we're going to use a specific type of lower that might work. That's still a phishing attack to now where we're going to make that lower very attractive because we're going to include your name, we're going to make it look legit.

So they might send it out as though it's from Bank of America. And it's got your name in it. And it's got a number in it looks like an account number. It looks like a Bank of America. So you click that is technically not a spear phishing attack. Now, I fought these types of battles forever. Yeah, you know, for instance, what's a hacker versus a cracker. I was a hacker as a kid, that didn't mean I was trying to break into anything. I just hacked it programming because I wasn't a professional. I hadn't been trained; I didn't have enough experience. A hacker was not a bad guy. A hacker was just somebody who was semi-professional. And frankly, in today's world, I would say 90%, maybe 95% of all programmers are hackers. They're not professionals. They don't understand the whole system. They're just taking a drag and drop the component from a Microsoft Visual Basic or C sharp or Java; they're using the just this generic component that they don't understand anything about other than if I feed it this. Hopefully, I'll get that out. That's called hacking. That's the classical definition of hacking. So you try it does it work on doesn't work. Okay, so let's try something else. Let's try and figure this out. That's a hacker.

A cracker is someone who goes in. No, I'm not a cracker. Okay, I'm a white guy. But in crackers. Somebody goes in and tries to break into something tries to crack in just like a Safecracker. So you have programmers that are crackers. And I've been fighting this for 20, 30 years, trying to help people understand there is a difference. And the majority of people out there that call themselves programmers are actually hackers. They're not professionals. They don't have enough experience. They don't understand the whole flow, and all of the implications and side effects of everything they're doing, and you don't want in most cases, that's fine. In most cases, that's all you need your small business, you're trying to build a little database, who cares if you're a professional programmer, doesn't matter. It matters when course is now live, start getting involved, Monday starts getting involved. But even at that, you know, the, there's a lot of hackers working for companies that are taking their our lives into their hands. Anyways, now I'm fighting this next door, I don't know, maybe I should give up on it. Maybe it's a lost cause for me.

But this next world war is phishing campaigns, I look at it and say there's a number of different types of fishing you've got the guys cast and big nets, little catch anything, hopefully, you got the guys that are are using a lower to try and catch up a specific type of person, and then you got the guys that are going after one person and that's spearfishing, and based on this article, I would say that the democrats are misleading people or the whoever is the spokesperson doesn't know what spearfishing is, which is probably the most most likely option here. You know, I try not to put too malice what can easily be attributed to stupidity or ignorance, right.

And in this case, it's probably ignorant. Because if you look at this article on seeing that it says spear phishing is sending bogus emails disguises legitimate ones to full recipients. Well, no, not true. That's only a part very small part of it. Because it also has to do with who you are going after.

Now, I mentioned this a little bit earlier. Let's get into a couple of details on it. I don't know if this was the biggest, biggest breach ever. Obviously, we don't know everything about every breach that's occurred. We know there's been huge breaches of the IRS and huge ones over at the Federal Department of what do they call it, the where all the employees federal employees go through, including background check information, everything, there's just been huge ones out there. And we know about Equifax. We know about so many of these others. This is being called collection number one, because it's thought to be a collection made from multiple hacks that have occurred over who knows how long

So, Troy Hunt, he's a researcher, security researcher down in Australia. And he goes around, and he cruises the dark web. And he's got friends on it. And he kind of comes up with some, I think, some good data, some good information that people should be aware of. And that's why I'm bringing it up right now. And it's kind of a security thing, right? He's a total security geek. And he is he's in love with this stuff. And he makes some money from it, too, which is good. I think he supports himself from that very thing. Well, this collection is one that he found. And they're thinking that it may contain data from as many as 2000 sources, 87 gigabytes of data in all and it has information on some 773 million accounts. So that's three quarters of a billion email addresses and passwords. While it's got about 21 million passwords. As part of this, it's been for sale amongst hackers could be used for credential stuffing. This is a technique where the bad guys are trying multiple email addresses and passwords on as many different apps and services they possibly can. So people are taking lists like this that have email addresses have a password and trying to figure out, figure out where else they might work. And again, this goes back to you are hacked. Okay, that's got to be one of my new solo pins, right? It isn't a security thing anymore. It's an everybody thing you have been having, don't worry about it, you've been hacked, okay, you have to worry about your data and how it's going to be used. But this just reinforces that, frankly, European privacy law, the GDPR French regulators have now fined Google 50 million euros. That was on Monday for via violating the European Union GDPR. Now that's not a lot when you look at Google and how much money that they made, which was like, I think alphabet was about $33 billion in revenue in its most recent quarter, okay, but a lot like the US $2.7 billion fine against Google for anti trust in 2017, which was a record the fine maybe less important than the changes that Google is going to have to make to its privacy and not just for people who are clearly in the European Union but people world why the so there may be some some dramatic actions here against a number of us tech giants. And I think that's going to be good for all of us. Frankly, these GDPR date which is the general data protection regulation, those rules went into effect a few years ago they gain teeth in May of 2018 to almost a year now and this is big this is really big we're seeing GDPR equivalent legislation being worked on in mass in California federal in fact the GDPR had some basis on some guidelines that mass was publishing so this is just one country France and they ruled the Google violated it because they hadn't properly gained consent from users to use their personal data for online advertising now if you signed up for my email list basically anytime in the last few years but it's been very obvious for about six years you've probably noticed so if you go to http://CraigPeterson.com/subscribe meaning by the way, if you do that go to slash subscribe on my website you will get all of my show notes every week and you'll also get information about hacks that are occurring occurring in real time you'll get information also about the free master classes I have and everything else okay so if you haven't already you should do it. http://CraigPeterson.com/subscribe.

But if you do that, you'll notice now that there's two checkboxes on there that you have to click that acknowledge that I can send you an e-mail. So you're consenting to that and that I can promote to you because I might send you an email where I say hey, this is the best thing since sliced bread you got to get this software and whether I make a dime off it or not. That's considered a marketing email even if I'm trying to help you out so you have to click both those boxes before I will allow you to subscribe and then on top of it you hit subscribe and you're not subscribed yet I will send you an email right away saying hey thanks for signing up but you got to click here because I got to confirm you are who you are so that you know some guy that doesn't like you and wants to subscribe to every email list known to man can't just go to my site and the thousand other sites and sign you up so you're not going to get any emails from me unless you double opt in and you also confirm that you really want them on that page now this is something as well that you should be doing if you have a business and you have a website you have to be doing this. And if you want more tips on this let me know just email [email protected]. That might be a great topic for one of our master classes what you need to do in order to comply with these new privacy laws. But let me know know right, I don't know unless you tell me you can either text me back if you're on the SMS list or you can respond to my email if you're on my email list and just let me know that you want to know more about your business website what you should do to comply with GDPR to be glad to let you know okay, I don't charge for this stuff. This really is something I want you guys to know about. You need to know about. So we're going to run through really quickly a few little flashes one looks like a hacked phone may have led the killers to Khashoggi very, very big deal. And apparently, it was software from this company called Pegasus and Israeli based cyber company that makes acting tools that are sold to evil governments worldwide as well as to lessee for governments worldwide. The goal is to automate us welcome to the age of surveillance capitalism you're going to want to read this again it's up on my website http://CraigPeterson.com This is from the guardian and the notes by the way, listen to a podcast all of this is in my show notes as well on popular WordPress plugin was hacked by an angry former employee. I've got that up on there. If you're using multi lingual WordPress, you've got to check that out again on my website. It's all right there and who is checks keep an eye on your domain if you own your own domain as a business because there are scams going on. All right all of that to http://CraigPeterson.com. Make sure you subscribe. http://CraigPeterson.com/subscribe, you'll see it all there. Have a great week and keep an eye on your email box because I got a phenomenal thing coming up here. And I'm going to be starting to send out some emails about it this week. Little bit of training is going on. Have a great week. Take care and we'll chat again next week. And I'll have my next podcast out on Monday. Bye Bye. Thanks for joining us.

---

Related articles:

Biggest Data Breach Yet Has Leaked 773 Million Emails. Here’s What You Need To Do Now

DNC Says Russian Hackers Hit It Again With Phishing Effort After Midterms

How A Hacked Phone May Have Led Killers To Khashoggi

‘The Goal Is To Automate Us’: Welcome To The Age Of Surveillance Capitalism

EU Privacy Law Snares Its First Tech Giant: Google

Popular WordPress Plugin Hacked By Angry Former Employee

How A Who Is Check Could Have Halted A Scam
---

More stories and tech updates at:

www.craigpeterson.com

Don't miss an episode from Craig. Subscribe and give us a rating:

www.craigpeterson.com/itunes

Follow me on Twitter for the latest in tech at:

www.twitter.com/craigpeterson

For questions, call or text:

855-385-5553