Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Unknown (00:00):
All right, all right,
here we go. Episode number 15 of
(00:18):
the global Show Globalbob Show.
We are the crossroads oftechnology, and politics.
This week's episode is titled,improving your digital hygiene.
Yeah, we've talked a lot abouthackers and exploitation. But
(00:40):
what I want to talk to you abouttoday is is how all that starts.
And most of the time that startsby a person not having good
digital hygiene. I appreciateeverybody that tunes in. Can we
even say that these days tunesin? I know that whenever I was a
kid, I'd ride around with my dadand his truck. And he would
(01:03):
always listen to news talkradio, on the am dial. And there
was a DJ on their news talkanchor that would say, tune in,
in tuning in and tear off theknob. Do you think that kids
these days would even understandwhat that means that tune it in.
Now, I know each week, I thankeverybody for tuning in. But
(01:25):
maybe I should say for jackingin or something to that, to that
effect, because you don't reallytune me in you more like click
me. And I guess. However, I'dlike to thank everybody that
does tune in, because we'restill going to say that, and
those that share the podcast.
And I really appreciate all ofthose that continued to give me
(01:47):
ideas for these podcast. Andthis one here is no exception.
So if you'd like to hear me talkabout something of interest, and
you can reach out to me at GmailGlobalbob show@gmail.com. You
can find me out on Twitter atglobal Bob Show. Or you can go
(02:07):
to Facebook and go to the globalBob Show. And contact me there.
I'm usually pretty quick onMessenger if you got a question
and we'll go over it. Alright,so let's just dive right on in.
So whenever I talk to you aboutdigital hygiene, this is the
(02:28):
same thing like your mom or yourdad taught you, when you were
growing up, you kind of gottawash behind the ears, wash your
armpits, make sure that yourhair squeaky clean. I know if
you put shampoo in your hair, mymom would come in and make me
rub it. And if it was squeaky onmy hair, then it was squeaky
(02:50):
clean. So what we got to do isget everybody squeaky clean when
it comes to their digitalhygiene. Now it's no secret, we
know that there's a cyber warthat's currently raging. I mean,
it's happening every day, andthe stuff that you hear about in
the news. And on other sourcesthat you get your information
(03:14):
from. I mean, that's just alittle tip of what's really
going on. There's a shadow warthat's being fought constantly.
And we've already talked a lotabout that in depth. But what
people don't realize is, is thatthey say, Oh, well, why would I
be a target? What value would Ihave? Why would anybody want to
hack me? Well, I'm going to giveyou a couple professions here
(03:38):
and tell why I would want tohack them if I was an operative
working for a foreigngovernment. So let's start right
off the top. My family's in theelectrical business, and why
would someone want to hack theirtheir business? Well, they got
sensitive information. They dovarious jobs for some major
(04:01):
chains, which I don't want totalk about, you know, their
clients, but many of you shop atthose places. And they do
schools, and they do hospitals,some medical facilities more
like and so I could see whereforeign adversaries would want
(04:21):
to have access to the plans thatthey have. They get copies of
these plans, and it has lots ofdetails in there. What kind of
switch gears in there and allkinds of stuff. So just like
with Stuxnet, where they werelooking desperately for plans
inside the Natanz nuclearfacility, then, you know,
hacking the electrical companyor electrical contractors or my
(04:44):
other family members that are inthe general contracting
business, they would become atarget Believe it or not, your
air conditioning repairman? Nowthis was out in the news one
time that major retail littlechain by the name of target had
a target on them. And theyactually compromised Target's
(05:05):
network by hacking through theHVAC or the air conditioning
system. So that's played out inthe news. What about your city
workers, those city workers,they
have access to the SCADA controlsystems that control water, and
sewer. And we've seen that inthe news where someone actually
(05:28):
hacked into a sewer plant andcause the sewage to overflow. So
your city workers are targets.
And the line that I meant, youknow, I do a lot of code
development. And that code getsran on various companies,
networks. And so someone couldslip something into the code.
And we saw just last week, wherethere was some code that was
(05:52):
compromised, that a lot ofdevelopers use that allowed to
have a backdoor into it. Now,this is one that I always am
very worried about, is mybrothers and sisters that are in
the real estate business. Imentioned this a little bit in
one of the podcasts that it'samazing how much information
your real estate agents or yourmortgage brokers have. I know
(06:17):
that when I was closing on myhouse, back in the day, I mean,
I was sending copies of mydriver's license and send in all
kinds of stuff through theemail, and you just email the
mortgage broker or you email thereal estate agent. Now, I will
say fast forward to today'stimes, I would not be doing
(06:39):
that. Because there's many, manyways that have been implemented.
But when I was buying my house,a lot of that wasn't
implemented. But now, you know,they're using things like
DocuSign and other platforms.
But to me, it's like, man, yourreal estate agents, they have
all the information. I mean, yougot to send them financials and
(07:02):
copy a bank records and even avoided check all of that. I'm
going to talk about little laterabout what you don't want to do.
Now, this is one profession. AndI do say it is a profession,
because it is a lot of work. AndI'm talking about your stay at
home house husbands and yourstay at home housewives. Now,
(07:24):
this is one that I think doesn'tget a lot of attention when it
comes to saying, Well, why wouldsomeone want to target my wife
or my husband, they don't workfor a company per se, they, you
know, they're the Commander inChief of the house. Well, we
have seen in the past where thissignificant other was targeted.
(07:46):
And they were targeted, becausethey knew that they probably
didn't have as much security ontheir laptop, and that the
adversary targeted thesignificant other to use that
laptop inside the home networkto then compromise the corporate
laptop of the husband or wifethat was on that network. And
(08:07):
the same thing goes for kids. Soyour kids can be targeted,
because that gives them afoothold at your house to then
try to target devices that comeon and off your network. So this
isn't a joke. This isn't justme.
Trying to tell folks that oh,you know, you got to get rid of
(08:28):
all your electronic equipment.
No, I'm just telling you thateverybody is a target when it
comes to this new cyber war.
Now, one of the questions I getquite a bit is I've been hacked
on Facebook, what can I do? So Iwant to use Facebook as an
(08:48):
example of walking through theprocess of improving your
digital hygiene. So everythingthat I tell you here, the other
platforms have it. You just gotto dig through the various
settings on there and find thesetting that is comparable. But
I get this all the time. I getfriends that send me a Facebook
(09:14):
messenger that says I've beenhacked, don't accept any friend
requests from me. And I see themposted on Facebook on their
channel saying I've been hackedand things and it's the same
conversation that I have all thetime. You have not been hacked,
you've been cloned. And there'ssome ways that we're going to
(09:36):
talk about of how to see ifyou've been hacked or if you've
been cloned. Now the differenceis is that when someone clones,
you what they do is try to finda public picture of you whether
it's on your Facebook profile,or out on the internet or
(09:57):
somewhere and they take an Tocreate a username, and they try
to make it close to your username. But you know, really, when
you get a friend request, youdon't see the actual user name,
what you're seeing is, is thename of the person which is
different. And what I can do, oryou can do, or anybody can do,
(10:20):
and this is what they do, theytake and create a username, like
Brian v 123. And you don'treally look at that, unless
you're looking at that URL fillbut then of the name, they'll
put Brian Varner in there. Andwhat they're trying to do is get
your friends to accept theirfriend request. And the next
(10:46):
thing that once I explainedthis, folks say, Well, why would
anybody want to clone me andbecome one of my friends? Well,
there's a couple of reasons whythis happens. One very real
reason this happens is is thatthey are trying to find out
information about your friends.
So if someone clones, myFacebook, they're not really too
(11:10):
interested in me, they'reinterested in one of my friends.
And the reason why is is becausejust because they clone my
information, then they don't getmy information, they're looking
for the information of one of myfriends. Now, if one of my
(11:31):
friends accept their friendrequests, then they can get some
of my information. But a lot oftimes, when these people clone
you, it could be privateinvestigators. Now, when you
think a private investigator,you think of the pie that's run
around with a rubber nose andsome, you know, dark trench coat
here and the 150 degree weatherit feels like in Florida. And
(11:55):
that's not it. There's privateinvestigators that
use Facebook to try to go afterworkman's comp fraud. And there
could be some spouses that arelooking to get information on
their significant other but alot of times this is or not a
(12:17):
lot of times, but most of thetime, it could be related to
someone with a workman's compcase. And so what they'll do is
they'll lock down their profile,because they know that they've
filed some workman's comp claimand they want to keep, you know,
people from seeing theirpictures because it could
contradict their workman's compclaim. And so they'll lock down
(12:38):
their profile, but they'll letfriends of friends see their
profile information. So if thisprivate investigator can start
looking around and finding outwho your friends are, and then
friend, one of them, then theycan start seeing your pictures.
So let's say you were outdancing one night, and you
twisted your leg and you go towork on Monday, and you follow
(13:02):
workman's comp claim? Well,depending on the price, they may
hire a private investigator. Andso when you're out in public,
you're limping with yourcrutches and all of that. And
then on your Facebook profile,you start uploading pictures of
you out snowboarding, well, Imean, that's a perfect example.
The other people that clone,what they're trying to do is
(13:24):
find as much information aspossible about the other people.
And I'm going to tell you how tolook and see what information
your friends can see and whatinformation is public. But what
the scammers are trying to do islook through your friends as
profiles that may be open waytoo much that has your
(13:44):
birthdate, and it has your phonenumber, and all kinds of
information that you may notexactly want your friends to
know. And so these scammers,they'll get your phone number,
they'll start looking for yourpets. And they'll say, look
through and find a picture ofyou holding your dog, your dog's
(14:04):
names fluffy, well, now theyknow your dog's names, fluffy,
they know your birthdate. Theyhave your phone number. And then
they'll look at yourrelationships. And some people
put this is my mom, this is mydad, and side their profile or
other information and whathappens when you log into your
(14:25):
bank account, you forget yourphone number, I mean, you forget
your password. And you got totell them your mom's maiden
name, your date of birth. Well,though it could have that
information. So that's usuallywhy people get cloned is is that
there's someone that'sinterested either in your
friends information or they aretrying to get information to
(14:51):
scam someone.
So what have you been hacked?
Now that's completely different.
When you're hacked, that meansthat No one has your username
and password, or without gettinginto all the technical details,
that they are able to clone asession. So that's completely
(15:11):
different. And the way the bestand easiest way to figure this
out is people will start callingyou maybe on your phone saying,
Hey, what is why are you postingthis advertisement? Or why are
you sending me information frommessenger. So the main
difference to tell if you'recloned or hacked cloning, they
(15:34):
use a picture, they start friendrequesting because they've
hacked your account, they don'tneed to send a friend request to
somebody, they're alreadyfriends with you. And so that's
the easy way to look at that alot of this spreads through
messenger, they'll hack anaccount by guessing your
password. And then they'll startsending all these messages from
(15:56):
you. And if they're really good,they would have looked at some
of your communications thatyou've had in the past and try
to kind of send the message. Andwhen they do this via text
messaging, we actually call itsmishing, right SMS phishing,
but this is through Facebook.
And it's basically the sameconcept. Now whenever I talk
(16:17):
about, you've been hacked, andbeing used as part of a cyber
war campaign. Now, these actors,if they hack you, they want to
kind of lay dormant, they reallydon't want to cause any ruckus,
because what they're moreinterested in, is say, if
they're trying to target you,and you work in one of these
(16:37):
industries that they'reinterested in, what they do is
kind of lay in wait and see ifthere's a pattern of life. Like
if you're out of town, maybethen they want to try to run
into you while you're out oftown. Maybe you've had a couple
too many beers. And maybe youtalk a little too much about
what's going on. Now, this allvaries depending on how bad they
(16:59):
want the information. So the wayto detect to see if your
Facebook has been compromised byone of these adversaries, it's
not sending any messages,they're not talking, they're
just basically bruisin yourFacebook information to try to
create a target package. Now,not just foreign adversaries do
(17:22):
this. If it's a privateinvestigator, this is illegal
for them to do and they're notsupposed to do this. And I would
say that most of your privateinvestigators are aboveboard,
and they're not going to go sofar as to actually hack your
Facebook account, they may cloneyour Facebook picture, which is
not illegal. It's against theTerms of Services of Facebook,
(17:45):
but not illegal, but the peoplethat are land and waiting and
trying to collect information.
And like I said before, thisalso applies for your Gmail,
this applies for your Instagram,you can go in and dig in. But
what you want to do with regardsto Facebook, to see if you've
(18:05):
been hacked, you want to loginto Facebook, so www
facebook.com and actually log inwith a browser. And once you get
into there, you want to clickand check your activity. So
you're gonna log into Facebookvia the web, and then click on
the settings and privacy. Andfrom there, you're going to
(18:28):
click on activity log. And fromthe activity log, you're going
to click on Log actions andother activity. And then you're
gonna have to click one moretime because it's Facebook, you
got to do a lot of clicking. Andyou're going to click on logins
and log out. Now, if anybodycan't find this, give me a shout
(18:51):
on Messenger. And I'll send youthe you know, the quick, that's
funny. Here, we are talkingabout hacking and people doing
stuff through Messenger, and I'msaying send me a messenger. But
anyways, it's pretty simple, youbasically want to dig down to
where you find logins and logouts. Now, some of the
information you see listedthere, it'll tell you where you
(19:12):
are logged in at. So some of theinformation may be a few days
old or a few weeks old. So ifyou haven't entered in your
username and password, it'sgoing to basically show the last
time you entered in thatusername and password. So some
of it may be a little bit old.
But what you want to look at isthat IP address where you last
logged in with your password,and I think it also shows it to
(19:36):
with your face ID. And if youlook at it, you can't say well,
I'm sitting here in centralFlorida and there's a login from
Tampa and I've never been toTampa. The way that the IP
address geolocation happens isis that it may show
(19:56):
you know a city that's kind offar away but really what you're
looking for Isn't, say, a cityin Florida saying, Whoa, I had a
login from Miami, that's totallynormal, especially if you're
logging in on cellular, oryou're logging in on these big
ISP, some of them will show, youknow, major cities, but you're
looking for that login IPaddress from overseas, right? I
(20:20):
mean, that would be a deadgiveaway, unless you're using
some kind of VPN technology. Butanyway, so that's what you're
looking for. And if you seelogins there, you really want to
take note, and probably just goahead and change your username
and password, which we'll talkabout here in a second about
what the best practices is. Butwhile you're there, let's go
(20:44):
ahead and click on activesessions. Now active sessions
will tell you the computers thatare current or devices that are
currently logged in that if thatdevice was unlocked, so if you
got like a screensaver, passwordlock on your computer, if
someone was to get through that,then they would have access to
your Facebook, because these arethe active sessions. Now, once
(21:05):
you're in this particularscreen, what's really nice is,
is that you can log out any ofyour devices. So you haven't
necessarily done anything thatwould harm you know, you haven't
changed your password oranything. But you can simply log
those sessions out. Now, this iswhere this becomes important.
And I know that people have donethis in the past. So you have a
(21:30):
significant other that wants tomonitor your Facebook activity.
And they may know your passwordbecause you share your password
with each other. And that's a nono, and, or you're using a
password and don't know thatthey know that password. And
you'll be able to log thatdevice out because what they do
(21:52):
is they'll get another iOSdevice. And they'll log in that
iOS device or Android deviceinto your Facebook account. And
that way, they can just keeptabs on you. So you can actually
log those sessions out. Andanytime you log out of any of
these sessions, you definitelywant to change your password at
(22:13):
that point in time. So that'sreally the way that you can tell
if someone's hacked you whetherit's your significant other, or
if it's a foreign adversary,that you can log those sessions
out and change your password.
Now, while you're there, this isreally cool. I love this about
Facebook, they have launched asection of Facebook called
(22:37):
privacy checkup. And the way youget there, and this is very
simple, by the way, I mean, it'svery, very intuitive is very
straightforward. And it showsyou exactly what you're sharing
with everybody. And you can makechanges right there. And it has
say this is what you're sharingpublicly, this is what you're
(22:59):
sharing with your friends. Thisis what you're sharing with
advertisers. And this is areally good so if you don't do
all this other stuff, I know theother stuffs pretty technical,
but every now and again, youshould click on privacy checkup
on Facebook. And the way you getthere is you click on your
profile picture. And then youclick on privacy checkup. And
then you can click on each boxand review and make changes as
(23:21):
you see fit. And there's ahandful of boxes there. But they
all got kind of a theme to them.
So you got one box that says whocan see what you share, you
click on there and you can seelike, oh, wait a second, I don't
want the public to see that. Letme make that adjustment. So you
got, who can see what you share,how to keep your account secure,
(23:46):
how to how people find you onFacebook, your data settings on
Facebook, right. And you alsohave your ad preferences on
Facebook. So you can clickthrough all of those and see how
you want to make those settings.
And what you're really trying todo is keep the scammers and
(24:07):
hackers from getting informationnow. They don't have to hack
your Facebook to use yourFacebook information like I gave
the example of your mom's maidenname and your dog's name and
your birthdate you know, I meanthat's all stuff they can do for
a target package. And those ofus that are in the industry we
call this ozen or Ahsan which isopen source intelligence and we
(24:31):
use it to create a targetpackage.
Now, if you want to be supersecure, I would say a hacker
yourself. What I recommend withFacebook and like I said all
your platforms have it yourGmail account has your Microsoft
Office 365 Has it. Instagram I'msure has it but you want to turn
(24:55):
on two factor authentication.
It's really important I know itcan be up pain in the butt. But
what two factor authenticationdoes, and a lot of the companies
have made it really easy. Whenyou log in, you log in with your
username and password. And oncelogged in, you'll get a second
prompt. And that prompt saysEnter the text message password
(25:18):
that we sent you. And they'llsend you a string of numbers.
Now the text message, what theycall two factor authentication
via text message. That's not themost secure. The most secure one
is using a token, a hardwaretoken or using an app on your
phone. For the average person, Idon't recommend that. Because if
(25:41):
that app was to go away, or youwere to lose that token, you can
have a real hard time gettingback in if your phone gets
broken, where you can get backin because you're gonna go get
another phone, and they can textyou the one time password. So if
you want to be a super hacker,and combat these adversaries,
(26:01):
then I would recommend turningtwo factor authentication on now
it's pretty simple, you justclick on your profile picture,
click on settings and privacy,and then go down to where it
says settings security andlogin. I know it's Facebook, we
got a lot of clicking to do,scroll down and click on the
Edit button in the box that saysget alerts about unrecognized
(26:25):
logins. And when you click onthat, you can turn on either the
app two factor authentication,or the text messaging, I would
start with the text messagingfirst. And it's really simple.
And what's really nice is isthat, you know, it's going to do
it for mostly devices, or aftera certain time definitely for
(26:47):
all devices it hasn't seenbefore, but it may have you
reenter your password every 30days. And that's just a good
checkup to have. Now, make surewe've talked about passwords and
two factor authentication andstuff like that. I just want to
give you some quick quick tipson when you create passwords.
(27:08):
I've seen this way too manytimes, I get certain people that
have asked me for help with someof their stuff and already know
the password before they give itto me because they haven't
changed their password andprobably 20 years. So not good.
So anyways, best practices foryour passwords. Guys make them
(27:29):
at least 14 characters long. Youwant to use uppercase, lowercase
numbers, which we all know. Butwe're going to add some more to
it, we want to use specialcharacters. And for God's sakes,
don't use the pound. I mean,using the pound is a special
character. Everybody tries poundHow about some special
(27:50):
characters that people normallydon't use. So you want to throw
some special characters inthere. And also, we call it a
pass word. But think of apassphrase. And what I tell
people to do is, is think abouttheir favorite activity, and
take the first letter of thatactivity. Now this is not my
password from my passphrase. ButI love amateur radio. So I can
(28:15):
maybe put a variation of thetype of radio I use, and the
hobby that I'm in. And myfavorite part of that hobby. So
you basically write like somewords down and then take the
first letter, but you can comeup with your own. And whatever
you do, whatever you do, don'tsay, Well, I'm just going to use
(28:39):
the site name with a slug at theend, right? So don't use Gmail
193844 pound and then for yourFacebook account, use Facebook
119934 lb that I even rememberthat anyways. And you know a lot
of y'all do this. I mean, don'tuse the site name and say, Well,
(29:00):
I got a different password forevery site. I mean, come on, we
can show and demonstrate veryquickly that once someone has
your password, which they dohave your password by the way, I
mean, you can go have I beenponed.com poned, spelt, paw N,
Ed. So just just google searchit, have I been poned and you
(29:24):
can put in your email addressand it'll tell you where all
your email address and if yourpassword was also compromised. I
mean, the other day I waschecking that out. And I found
that my face not my Facebook, myMySpace, man talk about a blast
from the past. I mean, my emailhad ended up in a MySpace
compromise and so you can seethat if my password was my space
(29:49):
with those numbers behind it,and then they found out that my
last fm which there was anotherbreach about Last fm and they
get that password and my paypassword is Last fm with the
same slug at the end. What whatdo you think my facebook
password is. So make sure thatyou really use unique passwords
for each site and make it not ahuman intelligible word, but
(30:12):
basically letters that representwhatever you want it to be.
So you got to get that emailsecured. I mean, that is the
number one target, usually whensomeone's trying to compromise a
system, because what they can dois once they have your email,
then we email even work stuff,which we should not be doing
(30:37):
that. But a lot of times, peopledo send their personal email
work related stuff. Butmoreover, they check that
personal email at work, even ifthey don't have the client
installed. I guarantee youdollars to donuts that people at
work, check their Gmail. And soif an adversary was to put
(30:57):
something inside the email, yourpersonal email and you check it
at work, now, they could, ineffect, you know, maybe get that
exploit on that work computer.
And it all goes back to theseindustries are under attack. And
it's the same for your kidsemail, it's the same for, you
know, everybody related to you.
(31:22):
I'm saying related as far asyour connections that they're
after, because they're trying tocompromise you, because they
know that you have access tocorporate information. And all
this played out in my otherpodcast, I talked about STUXnet,
it's exactly the way they gotinto the super secret Natanz
(31:42):
nuclear facility. So just makesure on your email, I'm sure
we're all guilty of it. Someoneneeds your driver's license. So
you snap a picture and you emailit, well, that's in your Sent
Items in email, maybe you emailit to yourself, credit card
numbers, pictures of creditcards, all kinds of stuff. And
(32:04):
for God's sakes, whatever youdo, don't use your work email
for personal business, I telleverybody that and it should be
a company policy. Because whatyou're doing is you're putting
your company at risk. If you'reusing your company email for
personal business, let's say yougot your pay pal tied to it. You
(32:24):
got all these discount clubs,you sign up for Sam's Club, you
know, whatever. And what you'redoing is you're putting your
company at risk. And if yourcompany ever gets compromised,
they're going to call in an IRteam, if they're big enough,
which is an incident responseteam, and they're going to find
out where that came from,they're going to trace it back
(32:46):
to ground zero. And when theyfind that, and it comes out to
be that someone sent an emailthat you should never have even
been receiving at your corporatemail, then you're probably going
to have some explaining to do.
So I know that was a lot ofinformation. And like I said,
this is just like having theconversation with your parents.
(33:07):
When you learn about yourpersonal hygiene, you need to
take due care with your digitalhygiene. And everything I
described with protecting yourFacebook account, you can find
those same settings, you'relooking for two factor
authentication, you're lookingat last logins, you're looking
(33:28):
at that information to see ifanything is outside the norm.
And if something is outside thenorm, then you need to change
your password and make it acomplex password because you got
to remember their to get yourpassword once. There's no
telling how they get thatpassword. And if you're reusing
(33:48):
passwords and reusing portionsof passwords for other sites,
then all you're doing is settingyourself up to be compromised.
And everything I tell you isn'tsomething that is far fetched.
All of this has happened all theway down to a friend of mine who
had their email compromised, andthe person was able to transfer
(34:12):
north of 40 to $50,000 with awire transfer out of their bank
account. And then they frozetheir personal bank account the
bank did then they froze theirbusiness account because they
don't know if this waslegitimate or not. Or they don't
know that maybe the person isjust reporting this. So
(34:33):
everybody this happens, this isreal stuff. And I figured now
was the time to have the talkabout digital hygiene. So with
that, I will see everybody nextweek. I really appreciate
everybody that shares thepodcast. I'm just so excited
that I have a backlog of stuffto talk about because every week
(34:56):
someone gives me an idea. And Itell him, let me think about it.
And nextweek, I promise we'll be in for
a neat surprise. We're going tokick it back old school and talk
about maybe some cold war stuff.
So there you go. There's alittle hint. We're going to be
(35:18):
talking about some technologythat's been around since the
Cold War, and that is alive andwell today. So everybody, stay
safe as you prove the highwaysand byways of cyberspace. And I
will see you next week. Untilnext time,