Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
What is the simple rule to keep your home network safe?
Catch phrase that just so you know, like catch that phrase.
It's simple rule, right? I'm assuming just one rule.
Why is breaking that rule so common?
(00:21):
It sounds like this might be an easy rule to break, so I might be in trouble.
Okay, how do I know if my router is following the rule?
Honestly, outside of not having the internet access,
I'm not sure if I would know what my router was doing, to be frank.
Like we're just being real.
(00:44):
Yep.
That said, this is the question I was excited to get to.
What new tool are we building?
Kem, Makani, you rock.
We're getting a new tool. We're going to get layered up.
All right, man, this is going to be our show today.
(01:04):
Welcome back, and thanks for tuning in.
I'm Nick, and this is Super Simple Security Principles.
Listen each week and learn how to think, not what to think.
This episode, 52, don't answer the phone,
is our second episode in our series on home network security.
(01:25):
So, dude, I'm pretty pumped, man.
Hello, we got our master guardian with us.
Hello, Makani.
Hey, Nick, good to be here.
And it'll come as no surprise to you,
but we introduced home network attacks last week, right?
And I mentioned that we'd be talking about that today, right?
(01:54):
But it's going to take more than one episode with this.
I know. I know.
I'm not sure exactly how much, but we are.
So the focus for today is just one of the types of attacks.
Okay.
And that's the attacks that originate from the internet
that are attacking your router.
(02:18):
And if you remember, we talked about when that public website
that we got exposed and the kind of attacks like it happened within seconds.
Yeah.
It's that kind of the same, a similar type of attack.
Okay.
And the reason I referenced that is because
the important thing to understand from that is just that
(02:41):
your router is going to be attacked swiftly and constantly,
even though it's not necessarily obvious.
Great.
Yeah.
Well, there is good news.
Swiftly and frequently.
Like, wait a second.
Yeah.
Okay.
But there is good news and we'll get to that.
(03:04):
Because otherwise, I mean, all of our networks would be compromised all the time, right?
Right.
That's exactly what I thought.
I was like, ah, I wonder why technology fails us.
They're always under attack.
Yeah.
So we introduced, you know, this, you've been taught, you know, as technical router, right?
(03:26):
But we've got to know what our router is.
And one of its jobs is to help us make calls from the devices on our home network
to devices on the internet.
Right.
We talked about that.
Yeah.
And that's the job that we tend to think of mostly like on a daily basis.
Because it helps us do cool stuff on the internet.
(03:47):
Just like going to visit a website, right?
Right.
Right.
So the router basically is the funnel for all of our electronic devices
and its connection to the internet, if we could.
Yeah.
Yep, exactly.
Okay.
And, but, so the part that we're going to talk about a little more today
(04:09):
that we don't usually think about as much is the other direction.
Okay.
Right?
So calls are being sent to us.
When devices on the internet are trying to make calls to devices on your home network.
Ah, okay.
This would be like if we download something?
(04:30):
No.
No, this, the calls we're talking about here,
because that actually is initiated on our side.
No.
So the calls we're talking about is the attacks of hackers on the internet
that are trying to make unfriendly calls to your home network.
(04:51):
Right?
And the goal of those calls is to like take over your router, your laptop, your phone,
whatever device that they can get to.
Get access to.
Yep.
And it's the router's job though to protect you from those unfriendly calls.
(05:11):
Okay.
Okay.
So it's our funnel for going out.
Yep.
And our filter for coming in.
It's trying to block all that crap.
Yep.
And it can filter on the way out too.
That's less commonly done, but yeah.
And this is where the good news comes in because the router has total control.
(05:36):
Like no devices out there on the internet can't just make direct calls to devices on
your home network without the router knowing about it, approving it.
Okay.
That's good news.
Yeah, it's really good news.
So that kind of, you know, then that means the next question, I guess, is how do we know,
(06:01):
how does the router know which calls are friendly and which ones are malicious?
Right?
Right.
You took the words out of my mouth.
That's where I was going with it.
I was like, how does it filter this?
Yeah.
And that's part of the trickiness because there's no like just way to say, hey,
this is a friendly call or an unfriendly call.
(06:23):
Right.
And this is where we're getting now finally to the title for this episode and the simple
rule, and we're going to repeat it a whole bunch.
And that is don't answer the phone.
Okay.
So the idea is the router doesn't make a determination of friendly or unfriendly calls.
(06:45):
It just says, I'm not taking any calls.
Right, right.
Okay, that's my recommendation.
That's a common advice.
This isn't unique to me.
Very commonly prescribed that you just don't have your router allow any calls from any
devices on the internet to any devices on your home network ever.
(07:07):
I like that rule.
Yeah.
You know me.
You know that I left my phone on do not disturb for years, not knowing it.
Yes, this is true.
I would never have believed if I had not witnessed it and experienced it with you or myself.
But yes.
(07:29):
Yeah.
Look, don't answer the calls, man.
Especially in this case, it sounds like.
Yeah.
Well, you know, but see, most people couldn't really get away with that, right?
Because, you know, they want to get calls.
And this is kind of the same problem with the router.
There are things that people want to do.
Right.
(07:49):
They want to accept some of these calls, right?
They're like, oh, well, yeah, sure.
You know, and I mean, it's the classic battle between security and the ultimate is, you
know, a lot of people are like, don't install apps, don't do anything.
It's like, okay, well, yeah, the safest thing is just not to ever connect to the internet.
Right.
That's not feasible, though.
No.
But in this case, for most people, I think it is actually pretty feasible for most scenarios
(08:18):
anyway.
And so anyway, we're going to get into some of the temptations, though.
You know, some of the cool tech, the reasons why people want to a little bit.
We'll talk about it more in future episodes.
Okay, because that is absolutely a question that is percolating in my mind right now.
(08:39):
Why do we want to answer these calls?
Are there reasons to answer these?
Yeah.
Well, and you remember your IT guy?
Yeah.
Now, I don't remember if it's been too long now if he did this, but it wouldn't surprise
me.
Was he able to help you on some of your issues from afar?
(09:02):
Oh, yeah.
Oh, yeah.
And depending on the kind of issue, whatever, anyway, one of the most common mistakes, one
of the most common features that we're talking about is allowing remote administration of
your network.
Right?
(09:22):
Right.
And so, you know, somebody like an IT guy or like me, and this is something I value,
like I want to be able to help my friends and family, you know, on the other side of
the country with their network issues.
Now, they're separate.
There's network issues, computer issues, but specifically network issues.
(09:45):
Anyway, it's a big topic.
But this is one of the things, is being able to help people from afar.
Yeah, okay.
That makes sense.
And very specifically, though, for this, we're talking about remote administration of the
router itself.
Because if the bad guys can get control of your router, and your router is the thing
(10:08):
that does all the protecting of your home network.
You're shafted.
Right.
That's obviously the big win for them, right?
Right.
That's what they want.
They want to gain control of that router.
Yeah.
And so, it used to be, for example, as simple as, you know, if you went and, you know,
checked the little box in your router and said, you know, allow remote administration,
(10:30):
routers, and this is long since not true, thankfully.
But it used to be that there was a default username and password for your router administration.
You know, a lot of times it was admin, admin.
Admin was the username.
Admin was the password.
Admin was the password.
Things like that, you know.
Okay.
You can go look up old routers and the default username and password that they have for old
(10:55):
routers.
Oh, I recall this.
I recall when Comcast would come hook up the internet and they'd bring in their little
box and their little box would have a sticker right there on it of the router's username
and password, or whatever it was.
Yeah.
Well, and they do that now, but usually, like if you buy a new router, they're going to
(11:17):
have a sticker on there, but it'll be a randomly generated password instead of the same one.
So, we have made some progress, thankfully.
But, because before, if all you had to do is you check that box and you're basically
instantly compromised because they knew your username, or they could guess anyway, easy
(11:38):
username and password.
So, the one other thing I want to mention on this point is there are some modern routers
that have built this concept of remote administration into them.
Because it's such a useful feature, they've built it, but using an entirely different
(11:58):
approach than the legacy one that we were just talking about of the little checkbox,
like it's more built into it.
And I don't have time to get into how that works, but I won't exactly call it safe, but
it's definitely world's safer, at the very least, than the legacy approach.
So, depending on the type of router you have, how recently it is, if you have remote administration,
(12:25):
it was built in from the ground up and you didn't have to enable things, it's possible
you're safe.
But anyway, if you have a question on that, happy to have you come to the forum and I'll
look it up and figure out if this is a problem for you, if that makes sense.
Yeah, yeah, totally.
So, because for most people, though, I don't feel like it's a feature that you need.
(12:52):
Yeah, yeah, makes sense.
But if you want to help your old grandparents that don't know how to administer their network,
you know, that's kind of the biggest case that I think of that can be worthwhile.
Yeah, that's right up my alley.
Grandma, Grandpa, let me help you out.
Yeah, but with the trusted professional, I get it.
(13:17):
I totally get it.
Yeah, yeah.
So, the next kind of category of temptation is what's called these days the Internet of
Things.
That have any association for you?
Internet has all sorts of things on it.
I don't know if I know about the Internet of Things.
(13:39):
Yeah, well, so it's, they call it that because, so it used to be you'd think like our computers
connect to the Internet, right?
Right, right, right.
But as time has gone on, everything connects to the Internet.
You've got a smart TV that connects to the Internet.
You know, you've got the voice assistance.
Your front door, you know, camera, doorbell, for heaven's sake, might connect to the Internet.
(14:05):
My lights that cast some bright light on me are connected to the Internet.
They were a pain in my butt today.
Right, yeah.
So, all these things, all these things, that's where the name comes from.
That aren't really like, they're not computers.
They're just other things.
Devices, other things that require Internet.
(14:27):
Yep, exactly.
And a lot of times they're even called, you know, smart devices.
I put that one especially in quotes because the irony.
I've heard smart devices.
I think we all have.
Yeah, and smart device typically just means that they connect to the Internet so they can
do all these, you know, smart things.
(14:49):
But for me, at least as security, mostly when I hear the word smart device, that translates
to security risk.
Smart device, security risk.
Yeah, so that's, and that's kind of my rule of thumb is the smarter your home is, the
more at risk your home network probably is.
(15:12):
Because of each of those devices can connect to the Internet, can be compromised, can have
a vulnerability that, you know, the hackers find in it to get into that device and then
they worm their way into your other devices through it.
And we'll be talking a little bit more about that, but that's the that's the short version.
(15:34):
Yeah, I have a lot of smart devices.
Not that I'm super tech savvy.
But I've got a lot of smart devices that kind of makes me scary because you're opening
up security risk for each one of those.
Yeah, and there are some good protections that we can do to help quite a bit with that.
But okay.
(15:54):
Yeah, well, the sad reality is that just like in pretty much every area of security, the
smart device, they tend to, features tend to run ahead of security.
You know, there's lots of cool tech and they're not always built with like rock solid security
from ground up in mind, you know.
(16:15):
Yeah, so.
So the last temptations I'll mention, and we're not going to get into these, again,
just interest of time, we are going to be talking about them in future episodes.
But if you hear the words universal plug and play and port forwarding, if either of those
(16:35):
features are like active on your network, then that you're basically violating the
don't answer the phone rule.
Okay, okay, I'm not uber familiar with either one of those two.
Yeah, you'll see, you'll see universal plug and play, especially on boxes.
(16:56):
Sometimes it's to like help printers connect easier.
Like, you know, whole idea of plug and play, right?
It's super easy to connect something in anyway.
Okay, yeah, yeah.
So, but the thing is, as I've been thinking about this, and I'm guessing this question
might be percolating in your head right now too, Nick, is I kept thinking like, it would
(17:20):
really be nice if our listeners could definitively answer the question, is my router following
the don't answer the phone rule?
Right, right, absolutely.
Like, yeah, something I wonder, because I'm sitting here thinking, oh, crap, I've got
lots of smart devices.
(17:42):
Like, we're opening up some vulnerabilities.
Like, am I answering bad calls?
Yeah, well, and you know, and it's hard, right?
Like, we talked about different things to check and whatever, but that, you know, and
that helps.
That's why we've talked about it, we'll talk about it some more.
But still, it's just not quite the same as a warm and fuzzy of just being able to answer
(18:02):
a blanket, no, it's not, you know, answering any calls.
And here's the thing, for computer geeks, we have easy ways to check this.
But-
Why am I not surprised?
Right, well, it's part of what hackers do too, right?
Like, they want to see if you're answering any calls.
(18:22):
And so it's, there's very much a, like an overlap between those things.
There's a similar idea that we'll talk about more in the next episode.
But anyway, this is what I was like, you know, I looked for a while and I mean, I found some
that kind of fit the bill, but none that I was like, yes, this looks super reputable.
(18:42):
It's super, you know, it's going to work really well for our listeners.
It's super simple.
It's going to give you the advice on how to fix it.
If it does find any issues, any of those kind of things, like it just wasn't happy with
anything I found.
So I just, I talked to Kem and I said, hey, well, what if we build, what if we build it,
you know?
(19:04):
And so, you know, we don't, this is, you know, we don't know how soon we'll, we'll get to
it, but it's not like a super complex tool for given like the narrow focus that we want
to use it for, for our listeners.
Okay.
Because the tools that like I would use as a computer geek to do it, you know, it's going
(19:27):
to have more features and do things than we necessarily need to have.
It's, I think it's doable in a reasonable amount of time.
I don't know exactly, but anyway, it's going to be awesome.
Yes.
So, and we'll spend next episode talking about that.
Tune in for next episode.
(19:47):
Yeah.
Because I feel like one of the things I've found a lot in talking to people about tools
is, you know, they'll, they'll pay for a software tool, but unlike physical tools, you can kind
of experiment with easy, a lot easier to tell what it does for you and how it works.
Yeah.
Like software tools are much harder.
(20:07):
So it's like, what is this tool even doing?
And I feel that's one of the things I really feel strongly in is if any software tool that
you're using, you at least need to understand kind of, you know, a little bit, you know,
it doesn't have to go like this deep, but you know, this deep understanding.
And so that's kind of what our goal will be with that, with that episode.
(20:31):
Excellent.
We're going to keep it super simple.
Yep.
Yep, exactly.
So this is one of those times, Nick, I was, so I think I've, I have all my things covered.
Is there any questions, unanswered questions that have come up for you?
That, oh man, you know, or anything else you want to, yeah, bring up?
(20:58):
You know, I, for me personally, I really wish there was a switch that I could just flip
and say, no more calls coming in.
No calls for you.
You know, like I really want that switch.
So, so I'm super excited to hear obviously a little more about the tools that we're going
(21:19):
to be able to put in place that will help keep our routers a little bit safer.
Um, obviously for me, there's a ton of questions that come up.
Like, dude, like, holy crap.
My router's under attack.
Of course they want to attack your router.
Because like you said, if they get control of it, think of how many devices you're literally
(21:41):
on, on your network, you know, like the days of you just connecting via the internet from
one computer are way gone.
You know, like, I don't even know if I can count how many devices my son has connected.
Right.
You know, and so for me, obviously I do.
(22:05):
I want to, I want some call screening.
I don't want those calls coming in.
That's the biggest thing that my mind is right now, like stewing on.
Yeah.
Well, and, and like I said, the good news is that the more time goes on, the more router
(22:26):
manufacturers are figuring that it's out and having defaults that make sense, um, that
are more secure out of the box for the most part, really, like it's, it's made worlds
of progress.
So, um, that's, that's the really good news.
Uh, but you know, then people tinker and anyway, I, it's, it's something, it's a tool I'm
(22:50):
excited about to help because the thing is, even with the progress, I still haven't seen
any, you know, like I said, right.
What you really want viscerally is like a switch on your, you know, physical switch
on your router where you can check it.
You know, you can just like toggle it and it says, okay, now I know that all is well.
Right.
Yup.
Yup.
(23:10):
Exactly.
And so that's the closest equivalent we can get is, you know, is, is this tool and it
won't flip the switch, but it will at least be like a, a red light green light kind of
idea, right?
Nice.
Basically in the end it can, that's the idea.
And so, um, at least for the foreseeable future, I think that's the closest we can get.
(23:33):
And so that's what we're going to, that's what we're going to shoot for.
Awesome.
So.
Awesome.
So we reached that point in time on our show.
Like we reached a call to action.
Yup.
Let's have it.
Yup.
So this is another kind of interim one.
Um, last time we had them find, uh, their routers brand name.
(24:00):
Uh, no, well not quite right.
That's actually for today.
Last time we did had him find the brand and model, right?
Yeah.
Yeah.
Right.
So that's, so the next natural step is right to find the manual.
Um, you know, physical or digital.
I know these days physical is going to be pretty rare.
(24:22):
That's, and most people are going to be searching online for a digital copy.
Yeah.
Um, which is, which is totally great, but the one word of warning, cause I've searched
for a lot of router manuals over the years, helping people go to their house.
I need to help them, you know, pull up their manual.
Um, my, the, the method I suggest is not just to, you know, do a Google search for the manual
(24:48):
for that, uh, router is to actually identify the brand.
Like we talked about and search for the official website for that brand, because there's going
to be a lot of websites and websites that like you don't want to visit that are going
to come up when you're searching for manuals of any sort.
(25:09):
But router manuals included, um, there's all sorts of sites that like will complain
to have compilations of manuals and stuff.
You just don't, you don't want to mess with that for a variety of reasons.
They range from sketchy to nefarious.
So go directly to the manufacturer's website.
Exactly.
And they're, you know, using the model number, then you can find the specific model, uh,
(25:33):
on their website and then go download the manual from, from there.
Okay.
Um, and again, like always, if you, if you have any trouble finding your router manual,
happy to help.
So just come to the, come to the forum.
So it should be pretty easy.
You're looking for two things on your router.
Once you have those two things, you're going to run.
(25:56):
Yeah.
Well, the thing I find, I think I've seen people run into the most is, you know, on
the router, there's a serial number.
There's a model number.
Like there's a Mac address, like there's all sorts of things and it's not always obvious
like what the model number is.
Right.
(26:16):
So I'm glad you brought that up actually, because so, you know, I mean, think of, I
mean, you obviously you're a car guy, you know, you know, Ford is the brand, right.
And then, you know, they have a F-150.
I don't even know the names of the other ones, but those are the models, right.
Those are the types of cars and vehicles.
(26:38):
And so that's kind of what we're looking for is it's not going to be crazy long and
unique.
And usually it's going to be a lot more prominent and big anyway.
It's going to be on, you know, on the boxing.
I don't know.
I'm not sure how else exactly to describe the model number compared to all the other
things.
Usually it'll be labeled model number too.
(26:59):
But anyway, that's the biggest stumbling block that I see people running into is
just there's so many numbers on there.
Which one am I looking at to know?
And well, and with a model number, it's not necessarily a number either.
Like it could be a number, could be some letters.
But it's usually not anywhere near as long as a serial number, for example,
(27:23):
or a MAC address.
Okay.
Anyway, there you go.
If you have questions, reach out.
We can help you find it, right?
Yep, exactly.
Love to hear from you on our forum.
Dude.
So where do I start?
You ready to roll into our next episode to get these guys listening to our next episode?
(27:47):
Yeah.
Well, we're going to be, yeah, that's exactly right.
We'll be talking about the new tool in the next episode.
Thanks for stealing my thunder, man.
Sorry.
I was confused.
Dude, our next episode, we're going to be talking about our new tool, right?
(28:09):
Like we're building a tool that will help you with your router and calls.
You know, I'm excited about this.
So you really want to tune in.
So don't miss it.
Come hear what our tool's about.
We're going to take care of you.
(28:30):
By the way, Makani has an idea about this tool that I'm going to tell you about in our
next episode.
Like you might be giving away a little too much, Makani.
Ah, yes.
I know what you're talking about.
Yeah.
(28:51):
So tune in to the next episode and hear what Makani's given out because you don't want
to miss it.
Super excited about this.
Thanks, Nick.
Appreciate that.
You betcha.
Dude, that's our show.
That was a good show.
(29:12):
Are you ready to take action and wondering where to start?
Get my Bulletproof MyIdentity Starter Kit for free.
The seven most vital layers of protection everyone needs.
I'll send you one step at a time and help you if you get stuck.
Just go to bulletproofmyid.com and enter your name and email and I will send you the
(29:36):
first step.
Again, that's bulletproofmyid.com.