Hacking Humans

Please enjoy this encore episode of Word Notes. A broad OWASP Top 10 software development category representing missing, ineffective, or unforeseen security measures.CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-insecure-designAudio reference link: “Oceans Eleven Problem Constraints Assumptions.” by Steve Jones, YouTube, 4 November 2015.

This week, a heartfelt discussion unfolds as one host reflects on the emotional impact of losing a loved one. The chaos surrounding Trump’s tariff policies is linked to a surge in phishing scams, showcasing how scammers exploit confusion. The 'blessing scam' targets vulnerable elderly women, leading to financial disaster. Meanwhile, new FTC rules promise easier subscription cancellations. Plus, Montclair University warns about a deceitful free travel trailer offer, highlighting the clever tactics of cybercriminals.

Please enjoy this encore of Word Notes.A broad class of attack vectors, where an attacker supplies input to an applications command interpreter that results in unanticipated functionality. CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-injectionAudio reference link: “APPSEC Cali 2018 - Taking on the King: Killing Injection Vulnerabilities” YouTube Video. YouTube, March 19, 2018.

This week, the hosts dive into the murky waters of social engineering scams and phishing schemes. They discuss a staggering $8.2 million seizure from a romance scam linked to cryptocurrency and explore the alarming 'pig butchering' scheme that has left a Maryland woman devastated. Personal anecdotes reveal troubling toll payment issues and how scammers exploit innocent targets. Plus, a humorous breakdown of a fake message from Elon Musk sheds light on celebrity scams, blending caution with entertainment.

Please enjoy this encore of Word Notes.Code that fails to protect sensitive information. CyberWire Glossary link: https://thecyberwire.com/glossary/owasp-cryptographic-failureAudio reference link: Vandana Verma. “OWASP Spotlight - Project 10 - Top10.” YouTube Video. YouTube, January 4, 2021.

This week our hosts, Dave Bittner, Joe Carrigan, and Maria Varmazis (also host of N2K's daily space podcast, T-Minus), are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. First, we start off with some more follow-up on EZ passes, along with the newest iteration, as Kailey Cornick shares that scammers target phone numbers rather than actual toll users, sending her SUN pass scam texts tied to her old Florida number. Dave shares the story of Palo Alto's Unit 42 researchers uncovering a massive campaign distributing thousands of fraudulent cryptocurrency investment platforms via websites and mobile apps, using brand impersonation, Ponzi-like schemes, and domain fronting to deceive victims, primarily in East Africa and Asia. Maria follows the story of a Queens man arraigned for allegedly scamming a 72-year-old Newton woman out of over $480,000 by posing as a DEA agent and coercing her into transferring her assets under the threat of arrest. Joe came across a Facebook video featuring an AI-generated ad falsely claiming Kelly Clarkson endorsed a weight loss product. These deceptive ads use AI to create convincing deepfakes, making it appear as if celebrities are promoting products they’ve never actually supported. Our catch of the day comes from listener Connor, who flagged a phishing email pretending to be from the Social Security Administration. The email urges the recipient to click a link to view an "important update," but the repetition of the message and a suspicious logo placeholder suggest it's a phishing attempt designed to steal personal info. Resources and links to stories: Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims Man Arraigned After Posing as Government Agent to Scam Senior out of Over $480,000 'I have terminal cancer and lost my life savings to whisky barrel scammers' Casks and Kegs Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.

Enjoy this encore of Word Notes. The prevention of the first part of an intrusion kill chain model exploitation technique, where the hacker steals valid logging credentials from a targeted victim. CyberWire Glossary link: https://thecyberwire.com/glossary/account-takeover-prevention

Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is Selena Larson, Proofpoint intelligence analyst and host of their podcast DISCARDED. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by N2K Networks Dave Bittner —and our newest totally unbiased co-host, Archy, a highly sophisticated AI robot who swears they have no ulterior motives (but we’re keeping an eye on them just in case).Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss Telephone-Oriented Attack Delivery (TOAD), also known as callback phishing. In this type of attack, an attacker sends a seemingly benign email, often containing an invoice or payment notification, along with a phone number. When the victim calls, they speak with the attacker, who convinces them to install remote access tools, leading to malware installation, phishing, and financial theft. Tune in as we explore how this deceptive tactic works and ways to protect yourself from falling victim to it.

This week our hosts, Dave Bittner, Joe Carrigan, and Maria Varmazis (also host of N2K's daily space podcast, T-Minus), are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up on E-ZPass scams—a listener suggests that scammers may be exploiting exposed license plate reader data, as demonstrated by YouTuber Mike Brown, to link plate numbers with breached phone records and send scam texts in real time. Dave's story is on how scammers may use conditioning techniques in romance scams—Ben Tasker observed that refusing to provide a phone number led to fewer photos being sent early on, suggesting scammers use rewards like photos to encourage compliance. Joe's got the story of Google's lawsuit against scammers who created and sold thousands of fake business listings on Google Maps, exploiting urgent services like locksmiths and towing to deceive customers and charge inflated fees. Maria's got the story of the FTC suing Click Profit for allegedly scamming consumers out of millions with a fake “passive income” scheme, falsely promising high returns through AI-driven e-commerce stores on Amazon, Walmart, and TikTok while most investors ended up losing money. Our catch of the day comes from Reddit after a user posted a conversation with a scammer after messing with them about a potential job opportunity. Resources and links to stories: Who is sending those scammy text messages about unpaid tolls? My Scammer Girlfriend: Baiting A Romance Fraudster Google finds 10,000 fake listings on Google Maps, sues alleged network of scammers AI scammers on Amazon duped investors out of millions with ‘passive income’ scheme, FTC alleges Can I work from jail? Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@n2k.com.

Please enjoy this encore of Word Notes. The process of proactively searching through networks to detect and isolate security threats, rather than relying on security solutions or services to detect those threats. CyberWire Glossary link: https://thecyberwire.com/glossary/threat-huntingAudio reference link: “My ‘Aha!" Moment - Methods, Tips, & Lessons Learned in Threat Hunting - sans Thir Summit 2019.” YouTube, YouTube, 25 Feb. 2020.