1 00:00:00,221 --> 00:00:04,151 You found the backup wrap up your go-to podcast for all things 2 00:00:04,151 --> 00:00:06,611 backup recovery and cyber recovery. 3 00:00:07,061 --> 00:00:08,411 In this episode we're talking about. 4 00:00:09,671 --> 00:00:11,411 Deep fake attacks. 5 00:00:11,801 --> 00:00:15,071 Trust me, it's way scarier than you think. 6 00:00:15,561 --> 00:00:22,751 Prasanna and I break down how attackers are using ai, uh, to clone voices and 7 00:00:22,751 --> 00:00:25,781 create fake videos of CEOs and CFOs. 8 00:00:26,836 --> 00:00:30,676 They only need 30 seconds by the way of a, of a voice to impersonate someone. 9 00:00:31,426 --> 00:00:36,316 We cover the different types of attacks from wire fraud to credential theft, and 10 00:00:36,316 --> 00:00:41,686 also give you practical steps that you can take right now to defend against this. 11 00:00:42,256 --> 00:00:46,276 We talk about also how to set up procedures that won't get overridden. 12 00:00:46,461 --> 00:00:50,781 When someone says they're having an emergency, nearly half of 13 00:00:50,781 --> 00:00:54,411 all businesses have already been hit by deep fake phone calls. 14 00:00:54,861 --> 00:00:57,081 Listen in before you become the next victim. 15 00:00:57,801 --> 00:01:00,771 By the way, if you don't know who I am, I'm w Curtis Preston, 16 00:01:00,771 --> 00:01:05,211 AKA, Mr. Backup, and I've been passionate about backup and recovery. 17 00:01:05,611 --> 00:01:11,701 Ever since I had to tell my boss that we had no backups of the production 18 00:01:11,701 --> 00:01:13,231 database that we had just lost. 19 00:01:13,591 --> 00:01:16,891 I don't want that to happen to you, and that's why I do this. 20 00:01:17,251 --> 00:01:21,901 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 21 00:01:22,261 --> 00:01:24,331 This is the backup wrap up pop. 22 00:01:39,504 --> 00:01:40,524 Welcome to the show. 23 00:01:40,884 --> 00:01:45,144 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have a guy with me who 24 00:01:45,144 --> 00:01:49,704 continues to allow me to change the design of a project that I have going on. 25 00:01:49,704 --> 00:01:50,904 And so it's all his fault. 26 00:01:51,244 --> 00:01:53,374 Prasanna Malaiyandi, How's it going, Prasanna 27 00:01:54,519 --> 00:01:59,289 I am good, but I just, just to make sure everyone 28 00:01:59,399 --> 00:01:59,749 Uhhuh. 29 00:02:00,639 --> 00:02:03,639 I had initially suggested this design to you. 30 00:02:04,749 --> 00:02:10,719 And you poo-pooed on the idea and now you're walking back after you've 31 00:02:10,719 --> 00:02:12,189 done additional investigation. 32 00:02:12,324 --> 00:02:13,524 well, you know, 33 00:02:13,569 --> 00:02:15,459 like your first design was solid 34 00:02:16,374 --> 00:02:16,884 yeah, 35 00:02:16,959 --> 00:02:19,179 because there's sort of the difference between like a 36 00:02:19,179 --> 00:02:21,639 design and what is practical. 37 00:02:22,104 --> 00:02:24,444 And what, and what doesn't cost a million dollars. 38 00:02:25,804 --> 00:02:27,224 $1 billion. 39 00:02:27,534 --> 00:02:30,534 uh, and I, I don't want to go into detail right now because it may 40 00:02:30,534 --> 00:02:35,694 be, it may just be insanity, and I may, you know, this, this idea, um. 41 00:02:36,204 --> 00:02:36,984 You know, and 42 00:02:37,284 --> 00:02:37,794 We'll see how it 43 00:02:37,914 --> 00:02:42,804 we'll see how it goes and, um, you know, but, uh, but yeah, I just keep, 44 00:02:42,894 --> 00:02:49,344 I keep, I haven't pulled the trigger on the design and I keep changing the gun. 45 00:02:50,304 --> 00:02:57,474 But, but at least it's not like you're swapping out a car for 46 00:02:57,474 --> 00:02:59,544 a boat or an airplane, right. 47 00:02:59,664 --> 00:03:00,294 No. 48 00:03:00,294 --> 00:03:04,164 like, oh, do I want a car versus do I want four door 49 00:03:04,399 --> 00:03:04,739 Do I? 50 00:03:05,204 --> 00:03:05,694 a coupe? 51 00:03:05,969 --> 00:03:06,259 Yeah. 52 00:03:06,384 --> 00:03:07,074 That's sort of the thing. 53 00:03:07,074 --> 00:03:07,314 You're at 54 00:03:07,399 --> 00:03:07,899 Or do. 55 00:03:08,514 --> 00:03:08,749 it down. 56 00:03:09,234 --> 00:03:11,694 Or do I want a pick up or do I want, or 57 00:03:13,264 --> 00:03:14,799 I don't know if it's quite at the pickup level. 58 00:03:14,799 --> 00:03:16,839 I think you're beyond the, like, is it an SUV? 59 00:03:16,839 --> 00:03:17,529 Is it a car, 60 00:03:17,544 --> 00:03:18,024 Yeah. 61 00:03:18,054 --> 00:03:18,414 Okay. 62 00:03:18,714 --> 00:03:19,104 Yeah. 63 00:03:19,329 --> 00:03:20,079 you're beyond that. 64 00:03:20,079 --> 00:03:20,649 I think you're now 65 00:03:20,844 --> 00:03:22,704 But I'm like, do I want 19 inch wheels? 66 00:03:22,704 --> 00:03:24,534 Do I want plastic wheels? 67 00:03:24,534 --> 00:03:25,134 Do we want 68 00:03:26,079 --> 00:03:26,379 Yeah. 69 00:03:26,694 --> 00:03:27,624 run flats? 70 00:03:27,624 --> 00:03:28,104 Yeah. 71 00:03:28,374 --> 00:03:28,794 Yeah. 72 00:03:29,364 --> 00:03:29,634 Yeah. 73 00:03:29,634 --> 00:03:30,444 Nice analogy. 74 00:03:30,444 --> 00:03:30,984 I like that. 75 00:03:31,959 --> 00:03:35,499 See, you're not as, it's not as, uh, bad as 76 00:03:35,574 --> 00:03:38,274 It's just that every time I think I've got it sorted out, I come up 77 00:03:38,274 --> 00:03:39,839 with a problem with my current design. 78 00:03:41,529 --> 00:03:44,469 Yes, and so all you have to do is just stop talking to me. 79 00:03:44,949 --> 00:03:47,979 Honestly, if you just stop talking to me, I bet you can 80 00:03:47,979 --> 00:03:49,869 like quickly narrow down your 81 00:03:50,154 --> 00:03:50,604 Yeah. 82 00:03:50,649 --> 00:03:53,289 should talk to me after it's done, after it's 83 00:03:53,364 --> 00:03:54,354 No, I can't do that. 84 00:03:54,534 --> 00:03:56,394 You're on my everything advisor, you know, that. 85 00:03:57,564 --> 00:04:01,194 Um, I just wanna say, I just wanna say to the audience, we've often mentioned 86 00:04:01,194 --> 00:04:08,034 that Prasanna has this like, uh, this ridiculous level of random knowledge. 87 00:04:08,274 --> 00:04:08,994 Today. 88 00:04:09,114 --> 00:04:11,814 I'm talking to Prasanna and he's like, so yeah. 89 00:04:11,814 --> 00:04:16,314 So I think the, the flow rate of a garden hose is like one to one 90 00:04:16,314 --> 00:04:17,964 and a half gallons an hour, and. 91 00:04:20,499 --> 00:04:23,649 And I was just like, like, why do you know that? 92 00:04:25,624 --> 00:04:26,914 Also, I was significantly 93 00:04:27,219 --> 00:04:28,599 Oh, were you, were you? 94 00:04:28,794 --> 00:04:34,854 So it depends on the size of a pipe, they say it could be between five and eight. 95 00:04:35,499 --> 00:04:35,829 Yeah. 96 00:04:35,829 --> 00:04:36,099 Okay. 97 00:04:36,099 --> 00:04:38,619 So, okay, so in this case you thought you knew something, 98 00:04:39,594 --> 00:04:40,014 Yes. 99 00:04:40,479 --> 00:04:40,899 right? 100 00:04:41,304 --> 00:04:44,724 But I did clarify and say I think that might be low just given that 101 00:04:46,674 --> 00:04:49,854 bathroom faucets are like one to one and a half gallon per minute. 102 00:04:49,929 --> 00:04:50,319 Yeah. 103 00:04:50,439 --> 00:04:50,739 Yeah. 104 00:04:52,389 --> 00:04:52,899 All right. 105 00:04:53,079 --> 00:04:56,109 Well, uh, we're not gonna talk about that stuff at all. 106 00:04:58,089 --> 00:04:59,199 We're gonna talk about 107 00:04:59,349 --> 00:05:01,059 deep fake attacks. 108 00:05:01,659 --> 00:05:04,299 Um, and this is a real problem. 109 00:05:04,299 --> 00:05:08,619 You sent me a great article that started this whole thing. 110 00:05:10,344 --> 00:05:15,084 Uh, yeah, from the register and the title, we'll put, we'll put the link in here. 111 00:05:15,594 --> 00:05:19,824 Uh, and the, the saying from Gartner, they're saying nearly 112 00:05:19,824 --> 00:05:25,134 half of businesses suffered deep fake phone calls against the staff. 113 00:05:25,734 --> 00:05:29,244 Um, so do you want to, you wanna just give an overview of 114 00:05:29,244 --> 00:05:30,414 what we're talking about here? 115 00:05:31,269 --> 00:05:31,889 Yeah, sure. 116 00:05:31,889 --> 00:05:37,349 So with the prevalence of AI and all these models being amazing and being 117 00:05:37,349 --> 00:05:42,929 able to generate video and photos, aspect is being able to generate audio. 118 00:05:43,949 --> 00:05:47,489 so now these AI models are really good at taking someone's voice. 119 00:05:48,689 --> 00:05:54,029 And being able to mimic it such that an attacker can make it sound 120 00:05:54,029 --> 00:05:57,989 like you are talking the same way as the person that they're trying to 121 00:05:58,364 --> 00:05:58,779 Right, right. 122 00:05:58,799 --> 00:05:59,249 imitate. 123 00:06:00,329 --> 00:06:07,349 And the quality has gotten so good that it's pretty difficult to differentiate 124 00:06:07,349 --> 00:06:10,319 between the real person and the deep fake. 125 00:06:10,524 --> 00:06:13,524 Especially if you don't know the real person. 126 00:06:14,064 --> 00:06:14,544 Right? 127 00:06:14,634 --> 00:06:18,324 So like if you, if you don't know them personally, I, I think I would 128 00:06:18,744 --> 00:06:22,764 like with you, I think I would pretty readily notice a deep fake, right. 129 00:06:23,034 --> 00:06:29,334 Well, first off, I would ask the deep fake, some random piece of information. 130 00:06:29,814 --> 00:06:30,444 I'd be like, 131 00:06:30,624 --> 00:06:31,254 probably may not 132 00:06:31,374 --> 00:06:32,124 you know. 133 00:06:32,334 --> 00:06:33,444 a deepfake probably has that 134 00:06:33,669 --> 00:06:34,509 Oh, that's true. 135 00:06:34,809 --> 00:06:39,759 I, I'd be like, I'd be like the, the classic line and, um, what, what's 136 00:06:39,759 --> 00:06:45,459 the, what's the ignition timing on a four barrel carburetor on a 1968? 137 00:06:45,759 --> 00:06:47,499 Yeah, my cousin, my cousin Vinny. 138 00:06:47,919 --> 00:06:50,739 Um, it's a trick question. 139 00:06:51,399 --> 00:06:51,999 Um, 140 00:06:54,189 --> 00:06:56,649 um, the, um, 141 00:06:57,564 --> 00:07:00,444 So, so there is so DeepFakes, right? 142 00:07:00,444 --> 00:07:04,674 We talked about use it also as pranks, right? 143 00:07:04,704 --> 00:07:08,394 And kids use it to be like, Hey, I am imitating someone else. 144 00:07:08,394 --> 00:07:13,464 Or, you call in sick from school and the school calls your parents 145 00:07:13,464 --> 00:07:14,364 and is like, where are you? 146 00:07:14,364 --> 00:07:17,514 And you can imitate your parents and be like, Hey, so-and-so's sick. 147 00:07:17,514 --> 00:07:18,354 He's not coming in today. 148 00:07:18,369 --> 00:07:19,094 Right, right, 149 00:07:19,524 --> 00:07:26,124 So there are sort of not so like critical reasons people use 150 00:07:26,124 --> 00:07:27,564 it, like for the fun aspects of 151 00:07:27,759 --> 00:07:28,089 right. 152 00:07:28,764 --> 00:07:32,544 but then there's also the malicious uses of this technology, which is 153 00:07:32,544 --> 00:07:33,894 kind of what this episode is about. 154 00:07:34,224 --> 00:07:38,334 And, and also there, so there's audio deep fakes and there's video deep fakes, right? 155 00:07:38,364 --> 00:07:45,234 Um, and it was interesting, again, that same article said that 36% of people, uh, 156 00:07:45,294 --> 00:07:50,844 had, had, had video deep fakes, and that 5%, uh, had, had caused a serious problem. 157 00:07:51,534 --> 00:07:51,594 So 158 00:07:51,624 --> 00:07:51,864 Yeah, 159 00:07:52,104 --> 00:07:52,524 go ahead. 160 00:07:53,099 --> 00:07:55,704 so, and just the point about that. 161 00:07:55,914 --> 00:07:58,974 Audio deep fakes are less costly today versus video 162 00:07:59,139 --> 00:07:59,489 Right. 163 00:07:59,544 --> 00:08:02,244 I think in one of the articles I read, I can't remember if it was the 164 00:08:02,244 --> 00:08:05,814 registrar article, but like a video Deep deepfake, a really convincing 165 00:08:05,814 --> 00:08:07,914 one might cost millions of dollars. 166 00:08:08,064 --> 00:08:08,364 Hmm. 167 00:08:09,624 --> 00:08:13,524 Um, that number has probably significantly gone down with a lot of the new AI 168 00:08:13,524 --> 00:08:17,184 models that have been announced, but doing it real time is a little 169 00:08:17,184 --> 00:08:21,234 bit more difficult than doing sort of a pre-process, but doing audio 170 00:08:21,234 --> 00:08:23,094 is significantly easier than video. 171 00:08:23,589 --> 00:08:24,069 Right. 172 00:08:24,129 --> 00:08:24,429 Right. 173 00:08:24,429 --> 00:08:29,559 And so and so it's, it's probably less, that makes it less likely to be there. 174 00:08:29,619 --> 00:08:30,099 Right. 175 00:08:30,219 --> 00:08:34,089 Uh, but, but it, we will talk about one particular type of attack that 176 00:08:34,089 --> 00:08:38,859 uses video deep fakes, where I think that it addresses that, the issue 177 00:08:38,859 --> 00:08:40,119 that you talked about right there. 178 00:08:40,209 --> 00:08:40,539 Right. 179 00:08:40,759 --> 00:08:41,049 Yeah. 180 00:08:41,079 --> 00:08:43,029 Um, and, uh. 181 00:08:43,869 --> 00:08:45,219 And, and why would they do this? 182 00:08:45,279 --> 00:08:48,549 Why, why would somebody, you know, what, what are they attempting to do here? 183 00:08:50,679 --> 00:08:55,659 So they are basically trying to trick the company employee, right, specifically 184 00:08:55,659 --> 00:08:57,279 the employee, to do something. 185 00:08:57,279 --> 00:09:02,499 It might be to gain access to the corporate network by doing password 186 00:09:02,499 --> 00:09:06,789 resets, which is what we see a lot of, uh, scattered Spider currently 187 00:09:06,789 --> 00:09:10,539 doing for their attacks, where they're calling in pretending to be someone. 188 00:09:10,779 --> 00:09:28,869 Mm-hmm. 189 00:09:29,264 --> 00:09:31,694 and being like, Hey, wire the money over to this 190 00:09:31,869 --> 00:09:32,289 Right, 191 00:09:32,504 --> 00:09:33,164 rather than the one 192 00:09:33,219 --> 00:09:33,609 right. 193 00:09:33,734 --> 00:09:34,004 you. 194 00:09:34,334 --> 00:09:37,304 And now they just siphoned all your money and it's really hard to get it back 195 00:09:37,539 --> 00:09:40,899 I'd say that, that, that's sort of two broad categories. 196 00:09:40,899 --> 00:09:45,069 So I mean, the one giant category is basically get the employee to do something 197 00:09:45,069 --> 00:09:46,299 that they wouldn't have otherwise done. 198 00:09:46,299 --> 00:09:46,569 Right. 199 00:09:46,569 --> 00:09:50,529 And that the, the two big categories would be at one grant, somebody 200 00:09:50,529 --> 00:09:54,699 access to something, and two, grant them access to some money. 201 00:09:55,929 --> 00:09:56,019 Right? 202 00:09:56,379 --> 00:09:57,249 Send some money over. 203 00:09:57,309 --> 00:10:00,609 And by the way, wire fraud is very real. 204 00:10:01,584 --> 00:10:04,074 Wire fraud is very real. 205 00:10:04,464 --> 00:10:08,484 And once it's done, it's kind of done right. 206 00:10:08,844 --> 00:10:12,144 Um, and, uh, you know, once it's discovered, if the 207 00:10:12,144 --> 00:10:13,374 money's gone, the money's gone. 208 00:10:13,404 --> 00:10:13,794 Right. 209 00:10:14,154 --> 00:10:14,424 Yep. 210 00:10:14,874 --> 00:10:18,894 And there was a huge issue, and I think it's still a huge issue, where 211 00:10:19,314 --> 00:10:23,754 people would basically get so-called signing instructions or last minute 212 00:10:23,754 --> 00:10:28,344 wiring instructions from the broker and be like, wire it to this account. 213 00:10:28,374 --> 00:10:31,224 They'd wire it, and then it turns out the broker had been compromised, 214 00:10:31,374 --> 00:10:31,734 Right, 215 00:10:31,854 --> 00:10:34,974 had imitated them, sent out all these emails, and now had a bunch 216 00:10:34,974 --> 00:10:36,174 of money that people thought. 217 00:10:36,654 --> 00:10:39,894 Was like their down payment going to the person and turned out it 218 00:10:39,894 --> 00:10:41,304 was going to a criminal actor. 219 00:10:41,814 --> 00:10:42,684 right, right. 220 00:10:42,984 --> 00:10:43,524 Not good. 221 00:10:43,584 --> 00:10:44,124 Not good. 222 00:10:44,784 --> 00:10:44,994 Yeah. 223 00:10:44,994 --> 00:10:46,284 Um, so. 224 00:10:47,289 --> 00:10:48,909 Uh, first off, 225 00:10:49,164 --> 00:10:49,554 on business. 226 00:10:49,869 --> 00:10:51,459 yeah, focusing on businesses. 227 00:10:51,459 --> 00:10:54,489 But first off, I think the number one goal of this call is to just, 228 00:10:54,879 --> 00:10:58,689 if you don't know how big of a deal this is, this is a big deal. 229 00:10:58,839 --> 00:10:59,679 It's a big deal. 230 00:10:59,739 --> 00:11:03,939 Literally today, uh, there was one statistic that suggested 231 00:11:03,939 --> 00:11:05,529 that they thought that 30%. 232 00:11:06,009 --> 00:11:11,409 Um, you know, of enterprise fraud will be deep fake based by next year. 233 00:11:11,619 --> 00:11:12,069 Okay. 234 00:11:12,489 --> 00:11:17,649 Um, and also realize that they only need 30 seconds of clear audio to 235 00:11:17,649 --> 00:11:19,119 be able to clone somebody's voice. 236 00:11:19,659 --> 00:11:21,159 Um, which is kind of a 237 00:11:21,459 --> 00:11:21,639 we're 238 00:11:21,819 --> 00:11:22,629 Yeah, we're screwed. 239 00:11:24,699 --> 00:11:25,719 Yeah, we're screwed. 240 00:11:25,969 --> 00:11:29,389 I guess one question is these people, they're cloning, 241 00:11:29,644 --> 00:11:29,934 Yeah. 242 00:11:30,019 --> 00:11:32,929 usually the people in power, right? 243 00:11:32,959 --> 00:11:36,049 Meaning the CFO, right? 244 00:11:36,259 --> 00:11:41,659 The CEO, trying to get the employees, say the person in accounting to 245 00:11:41,659 --> 00:11:43,189 sign a check or to send money 246 00:11:43,549 --> 00:11:43,939 Right, 247 00:11:43,939 --> 00:11:45,439 And so these people. 248 00:11:45,909 --> 00:11:48,699 Usually have like public spotlights. 249 00:11:48,699 --> 00:11:51,189 They're the ones who you find on LinkedIn with the social 250 00:11:51,349 --> 00:11:51,709 right. 251 00:11:51,849 --> 00:11:54,399 the videos the company. 252 00:11:54,459 --> 00:11:54,699 Right. 253 00:11:54,699 --> 00:11:55,779 Trying to promote the company. 254 00:11:55,779 --> 00:11:59,979 Or they're giving talks at conferences, so it's not like, oh, they're just 255 00:11:59,979 --> 00:12:03,069 locked away and someone somehow goes and like, records their audio. 256 00:12:03,549 --> 00:12:03,879 Right. 257 00:12:03,904 --> 00:12:04,354 right, 258 00:12:04,869 --> 00:12:07,569 uh, downloads their phone messages. 259 00:12:07,569 --> 00:12:08,799 Or their phone calls, right? 260 00:12:08,799 --> 00:12:11,169 It is, this data's already out there. 261 00:12:11,169 --> 00:12:12,879 It's not like it's hard to find. 262 00:12:13,444 --> 00:12:14,344 right, right. 263 00:12:14,454 --> 00:12:18,144 Let's talk about a couple of the different types of attacks. 264 00:12:18,594 --> 00:12:23,364 The, the, the worst one, I think and, and, and it's worst in terms of 265 00:12:23,364 --> 00:12:29,544 like the potential ramifications, but also in terms of, uh, it's so devious 266 00:12:30,114 --> 00:12:36,894 and that is that they create a very short video of the person in power. 267 00:12:36,894 --> 00:12:41,394 So this is like A-C-E-O-C-F-O, that type of person, someone with authority to. 268 00:12:42,459 --> 00:12:48,699 Authorize a wire transfer, and then they, uh, create a very short video 269 00:12:48,699 --> 00:12:55,629 that, that basically, um, mimics the thing that they want them to do. 270 00:12:57,084 --> 00:13:01,764 Then the video, as part of this video, it drops. 271 00:13:02,244 --> 00:13:02,664 Right? 272 00:13:02,904 --> 00:13:06,804 So they, they, so what that does is that, that addresses the problem that 273 00:13:06,804 --> 00:13:10,044 you were talking about, is it addresses the cost of making that video fake. 274 00:13:10,374 --> 00:13:15,174 It also completely removes the need to do real time video fake, 275 00:13:15,174 --> 00:13:17,394 which would be the thing that would be super, super expensive. 276 00:13:17,754 --> 00:13:21,234 So if they can get a video of the person and then, um, do that. 277 00:13:21,599 --> 00:13:25,499 And then, um, and then what they do is they're like, they drop the call 278 00:13:25,619 --> 00:13:30,059 and then they immediately switch to a alternate communication method, 279 00:13:30,299 --> 00:13:32,819 such as the easiest would be text. 280 00:13:32,939 --> 00:13:35,789 It's like, Hey, I was trying to call you and my internet dropped. 281 00:13:35,879 --> 00:13:37,409 And text now is the only thing. 282 00:13:37,619 --> 00:13:40,709 And because of, again, human nature, you felt you were just 283 00:13:40,709 --> 00:13:43,949 talking to the CEO and now you think you're still talking to the CEO. 284 00:13:44,489 --> 00:13:46,139 And here, here's a question. 285 00:13:46,199 --> 00:13:48,929 How easy is it to clone a phone number? 286 00:13:50,109 --> 00:13:51,129 Oh, super simple. 287 00:13:53,049 --> 00:13:53,859 Super simple. 288 00:13:54,099 --> 00:13:54,639 spoof. 289 00:13:54,699 --> 00:13:58,389 You can spoof a phone number and show, or it could, it 290 00:13:58,389 --> 00:13:59,889 doesn't even have to be the ceo. 291 00:13:59,949 --> 00:14:01,029 As an example. 292 00:14:01,299 --> 00:14:02,379 Say you were on a video 293 00:14:02,709 --> 00:14:03,159 Yeah. 294 00:14:03,399 --> 00:14:05,019 you claim that, oh, my video's poor. 295 00:14:05,019 --> 00:14:06,339 You drop back off, you hide your 296 00:14:06,424 --> 00:14:06,714 Yeah, 297 00:14:06,999 --> 00:14:08,319 You could still be doing the audio, 298 00:14:08,649 --> 00:14:09,039 you could. 299 00:14:09,039 --> 00:14:09,399 Yeah. 300 00:14:09,459 --> 00:14:09,789 Yeah. 301 00:14:09,819 --> 00:14:11,889 even have to go to text messages 302 00:14:12,039 --> 00:14:12,459 Right, 303 00:14:12,639 --> 00:14:13,539 voice call or other 304 00:14:13,659 --> 00:14:13,989 right. 305 00:14:14,169 --> 00:14:15,159 You just leverage the same 306 00:14:15,369 --> 00:14:19,614 Yeah, so you could use the same channel, but just drop the, drop the video, right? 307 00:14:19,874 --> 00:14:20,934 Um, yeah, go ahead. 308 00:14:21,039 --> 00:14:26,259 And I think that's what happened in the first time I heard about this attack 309 00:14:26,259 --> 00:14:32,919 was I think a company, the CEO joined and said, send out, uh, this vendor. 310 00:14:32,919 --> 00:14:35,169 I think it was like $25 million or something. 311 00:14:35,949 --> 00:14:39,939 it was, I think on a video call they were on where they got deep 312 00:14:39,939 --> 00:14:44,529 faked and then they basically sent it to these fraudulent people. 313 00:14:44,769 --> 00:14:45,849 Right, right. 314 00:14:47,079 --> 00:14:47,499 Yeah. 315 00:14:47,559 --> 00:14:51,549 I, and, and, and again, you know, go back to once that happens, 316 00:14:51,549 --> 00:14:52,899 you're kind of screwed, right? 317 00:14:53,214 --> 00:14:53,484 Yep. 318 00:14:54,549 --> 00:14:57,309 and it's not like, uh, it's not like with a credit card where 319 00:14:57,309 --> 00:14:58,719 you can, uh, do a chargeback. 320 00:14:59,574 --> 00:15:03,624 Yeah, and the other thing to also mention here is. 321 00:15:04,179 --> 00:15:07,539 It's not like they're just going and saying, oh, I'm just 322 00:15:07,539 --> 00:15:08,709 gonna randomly target you. 323 00:15:08,949 --> 00:15:11,229 They might have already gained access into your systems. 324 00:15:11,499 --> 00:15:13,869 They might have already wandered around looking at, okay, 325 00:15:13,869 --> 00:15:14,919 who's the important people? 326 00:15:14,919 --> 00:15:15,909 Who's in accounting? 327 00:15:16,179 --> 00:15:17,499 What meetings are there? 328 00:15:17,679 --> 00:15:20,829 So they are already snooping, listening in on your conversations, 329 00:15:20,829 --> 00:15:25,749 looking at your emails, and so they know exactly where to attack, who 330 00:15:25,749 --> 00:15:27,839 to attack, and who to imPrasannate. 331 00:15:27,909 --> 00:15:28,299 Right. 332 00:15:30,054 --> 00:15:32,754 So, uh, that, so that's the one, that's one type. 333 00:15:32,754 --> 00:15:35,454 That's where they're trying to get, like, to authorize like some sort 334 00:15:35,454 --> 00:15:36,894 of invoice, some sort of payment. 335 00:15:37,314 --> 00:15:42,144 Uh, the other is the, basically trying to gain access to an account. 336 00:15:42,414 --> 00:15:50,874 So this is either reset a password or um, um, you know, resetting A MFA tokens. 337 00:15:50,889 --> 00:15:51,129 Yeah. 338 00:15:51,264 --> 00:15:53,934 Um, can you think of anything else that they would try there? 339 00:15:55,809 --> 00:15:57,099 I think those are the main 340 00:15:57,174 --> 00:15:57,534 Yeah. 341 00:15:57,579 --> 00:16:02,469 But even there, I do wonder how much is really around the 342 00:16:02,469 --> 00:16:04,629 voice aspects and the deep 343 00:16:04,644 --> 00:16:05,064 Mm-hmm. 344 00:16:05,409 --> 00:16:07,059 versus just the social engineering. 345 00:16:07,059 --> 00:16:09,819 Because I think in those scenarios, social engineering 346 00:16:09,819 --> 00:16:13,749 becomes more critical ex right? 347 00:16:13,779 --> 00:16:17,349 Uh, in terms of understanding all the things needed in order 348 00:16:17,349 --> 00:16:18,999 to be able to reset an account. 349 00:16:18,999 --> 00:16:22,299 It's not necessarily that the help desk person or the person on the other 350 00:16:22,299 --> 00:16:24,579 side knows your voice in particular. 351 00:16:25,149 --> 00:16:28,779 Well, yeah, again, again, you're not necessarily, that's why I was saying 352 00:16:28,779 --> 00:16:32,619 earlier in the call, it's not necessarily a voice that's known to the person, 353 00:16:32,619 --> 00:16:34,149 but they're calling into a help desk. 354 00:16:34,509 --> 00:16:39,459 But what you are doing is you're using a deep fake, uh, thing to you're, you're 355 00:16:39,669 --> 00:16:42,819 trying to sound generally like somebody. 356 00:16:43,139 --> 00:16:43,429 Yeah. 357 00:16:43,704 --> 00:16:47,694 But, uh, again, it kind of relies on you not knowing that person really 358 00:16:47,694 --> 00:16:51,834 well, because I think the, the, the nuances of how that person talks 359 00:16:51,864 --> 00:16:56,574 is they're going to be, I think, relatively obvious to someone. 360 00:16:56,734 --> 00:17:00,034 The point there again, is to reset something to reset 361 00:17:00,034 --> 00:17:01,384 MFA so that then you could. 362 00:17:01,954 --> 00:17:04,594 You know, do the MFA with with some other channel. 363 00:17:04,689 --> 00:17:04,979 Yeah. 364 00:17:05,824 --> 00:17:09,904 The other thing to also think about is there are still companies that 365 00:17:09,904 --> 00:17:12,154 use voice as an authentication, 366 00:17:12,874 --> 00:17:13,384 Yes. 367 00:17:14,644 --> 00:17:15,064 right? 368 00:17:15,064 --> 00:17:19,534 And so now becomes a question, okay, if my voice is my password, 369 00:17:20,074 --> 00:17:20,494 Passport. 370 00:17:20,494 --> 00:17:21,154 Passport. 371 00:17:21,624 --> 00:17:24,924 If you're gonna quote the line, my voice is my passport. 372 00:17:24,986 --> 00:17:26,366 Verify me. 373 00:17:27,191 --> 00:17:27,641 Yep. 374 00:17:28,811 --> 00:17:30,701 so now that becomes an attack vector, 375 00:17:30,746 --> 00:17:30,986 Yeah. 376 00:17:31,151 --> 00:17:35,621 It's now someone can mimic you and unlock the other person doesn't know 377 00:17:35,621 --> 00:17:39,071 what you are supposed to sound like, but you've unlocked the account 378 00:17:39,071 --> 00:17:40,511 because you've made a deep fake. 379 00:17:40,716 --> 00:17:44,196 That quote of course is from sneakers, one of my favorite movies ever. 380 00:17:44,286 --> 00:17:45,486 I need to go watch that again. 381 00:17:45,946 --> 00:17:50,206 I do wanna talk just a little bit about personal stuff and then jump 382 00:17:50,206 --> 00:17:51,316 into the company stuff, right? 383 00:17:51,316 --> 00:17:53,686 There are a couple things that you could do that, and they're, 384 00:17:53,686 --> 00:17:55,126 they're actually kind of similar. 385 00:17:55,576 --> 00:17:59,261 One is to, to create some sort of code word within the family. 386 00:18:00,091 --> 00:18:00,511 Right. 387 00:18:00,691 --> 00:18:04,741 Some sort of shared secret that only you and the other person knows and say, 388 00:18:04,741 --> 00:18:08,641 Hey, if I ever actually do call you and I say I'm on the roadside and I need you 389 00:18:08,641 --> 00:18:13,411 to wire me 500 bucks for a tow truck or whatever, I'm gonna say this code word. 390 00:18:13,681 --> 00:18:14,041 Right? 391 00:18:14,461 --> 00:18:20,131 Um, and you can also, if you don't have a shared code word, you can, you can 392 00:18:20,131 --> 00:18:26,011 reference like in you and I I, if, if this was happening right now, I would say, Hey. 393 00:18:26,716 --> 00:18:30,016 You know that thing that we were talking about earlier today, you know, and you 394 00:18:30,016 --> 00:18:33,406 can reference something that both, that only you and that person would know. 395 00:18:33,796 --> 00:18:38,536 But, but yes, and I think that becomes the key, is something that only you 396 00:18:38,536 --> 00:18:45,316 and that other person knows that hasn't been shared over a video, over text, 397 00:18:45,586 --> 00:18:47,686 over some other communication method 398 00:18:47,791 --> 00:18:48,631 It needs to be. 399 00:18:48,631 --> 00:18:49,471 Yeah, very much. 400 00:18:49,501 --> 00:18:53,611 Uh, that, and then also, and we're gonna get this to the company as well, is verify 401 00:18:53,611 --> 00:18:55,771 through an alternate channel, right? 402 00:18:56,071 --> 00:19:02,221 Um, is, is something other than, um, you know, call them back on 403 00:19:02,281 --> 00:19:03,901 the number that you know them on. 404 00:19:03,901 --> 00:19:07,621 Now, there are ways to get around that too, but in general, they're 405 00:19:07,621 --> 00:19:09,091 gonna be faking the number. 406 00:19:09,451 --> 00:19:13,021 And when you call the other person's actual number back, uh, it's not gonna, 407 00:19:13,021 --> 00:19:14,246 it's not gonna be the scam, right. 408 00:19:14,806 --> 00:19:18,526 And, and it's interesting that we are talking about this episode today. 409 00:19:18,526 --> 00:19:20,596 So this morning I sent an article to my 410 00:19:20,711 --> 00:19:21,131 Mm-hmm. 411 00:19:21,406 --> 00:19:24,136 and, uh, for some reason the link was broken. 412 00:19:24,136 --> 00:19:28,276 It didn't show up properly in text, and it just showed up as an empty bubble. 413 00:19:28,276 --> 00:19:31,666 And she immediately calls me, she's like, did someone hack your phone? 414 00:19:32,596 --> 00:19:34,191 Because normally I don't send things like that. 415 00:19:34,336 --> 00:19:34,666 Right. 416 00:19:34,726 --> 00:19:35,656 looked very weird. 417 00:19:35,661 --> 00:19:35,951 She was. 418 00:19:36,331 --> 00:19:40,021 Wanted to verify using a different channel to be like, 419 00:19:40,021 --> 00:19:42,301 Hey, is that really you or not? 420 00:19:42,616 --> 00:19:43,036 Yeah. 421 00:19:43,276 --> 00:19:43,606 Yeah. 422 00:19:44,176 --> 00:19:48,106 So let's talk, let's talk about, uh, to go to the companies now, right? 423 00:19:48,106 --> 00:19:50,626 And because the first suggestion. 424 00:19:51,026 --> 00:19:55,886 Is the same as the, as The suggestion that we just made, right, is, uh, is 425 00:19:55,886 --> 00:19:57,806 to have multi-channel verification. 426 00:19:58,136 --> 00:20:03,566 So the, the, the real key here is they're calling you in over one channel, or 427 00:20:03,566 --> 00:20:05,696 they're contacting you via one channel. 428 00:20:05,696 --> 00:20:07,856 In this case, what we're talking about is audio deep fake. 429 00:20:07,856 --> 00:20:11,876 So they are calling you and they've called you over this one channel, and 430 00:20:11,876 --> 00:20:13,526 then they want you to do the thing. 431 00:20:13,826 --> 00:20:17,636 So the question is, you need to contact them back over another channel. 432 00:20:18,211 --> 00:20:21,361 Um, now I can think of like an attack against that. 433 00:20:21,361 --> 00:20:22,471 Do you know what that might be? 434 00:20:23,761 --> 00:20:26,581 Well, it's basically they've compromised all your channels, 435 00:20:26,881 --> 00:20:29,971 Well, that wa that wasn't the, yeah, that wasn't the attack I was thinking 436 00:20:29,971 --> 00:20:31,891 about, although I, I do know, you know, 437 00:20:32,101 --> 00:20:32,281 Yeah. 438 00:20:32,581 --> 00:20:35,071 am aware of a situation where there was a company that. 439 00:20:35,611 --> 00:20:36,751 Had had that happen, right? 440 00:20:36,751 --> 00:20:39,001 They had, they had compromised all of the things. 441 00:20:39,271 --> 00:20:41,191 That's not gonna fix that. 442 00:20:41,221 --> 00:20:43,531 But in general, that's not the case. 443 00:20:43,891 --> 00:20:49,201 But, uh, what I was thinking was the usual case or the usual hacker, what 444 00:20:49,201 --> 00:20:51,691 they're gonna do is they're gonna try to create a sense of urgency. 445 00:20:52,371 --> 00:20:54,951 They're gonna say, oh, you, you know, I, I need to call you back on 446 00:20:54,951 --> 00:20:56,181 your, your phone number of record. 447 00:20:56,211 --> 00:20:58,491 Oh, well I had my phone's dead, whatever. 448 00:20:58,551 --> 00:21:01,401 You know, I can't, you know, I'm, I'm calling in on my friend's phone. 449 00:21:01,731 --> 00:21:04,161 Uh, I'm trying to, you know, I'm trying to do the thing. 450 00:21:04,221 --> 00:21:08,901 They, they come up, I'm sure that they're well trained on how to, um, 451 00:21:09,291 --> 00:21:13,701 create that sense of urgency and, and that sense of exception of, here's why 452 00:21:13,701 --> 00:21:15,201 I'm doing it in this really weird way. 453 00:21:16,531 --> 00:21:20,911 So, a hundred percent agree and I have a story around this. 454 00:21:20,911 --> 00:21:21,961 I actually have a story for 455 00:21:22,066 --> 00:21:22,546 Okay. 456 00:21:23,256 --> 00:21:23,476 so, 457 00:21:24,796 --> 00:21:27,436 The way you say that, it's like you think that's all I am is just a 458 00:21:27,436 --> 00:21:29,236 bunch of stories, but that's okay. 459 00:21:29,401 --> 00:21:30,031 you always have 460 00:21:30,031 --> 00:21:30,901 so many amazing 461 00:21:30,901 --> 00:21:31,891 stories from all your 462 00:21:31,891 --> 00:21:33,751 experience of being in the field. 463 00:21:34,651 --> 00:21:35,191 But I do have a 464 00:21:35,416 --> 00:21:35,716 Yep. 465 00:21:36,171 --> 00:21:36,591 Mm-hmm. 466 00:21:36,781 --> 00:21:39,751 other day I was looking to switch my, uh. 467 00:21:40,156 --> 00:21:44,716 Internet plan and, uh, my contract was expiring, so I called in and 468 00:21:44,716 --> 00:21:49,636 placed an order online and I get a call back like a couple hours later. 469 00:21:50,446 --> 00:21:51,166 recognize the number. 470 00:21:51,166 --> 00:21:55,366 The person leaves a message and is like, Hey, this is Xfinity calling, 471 00:21:55,396 --> 00:21:56,806 uh, we're calling about your plan. 472 00:21:56,806 --> 00:21:57,766 We had an issue. 473 00:21:57,976 --> 00:21:59,116 Can you please call us back? 474 00:21:59,116 --> 00:22:00,736 We can't do this right now. 475 00:22:00,736 --> 00:22:01,546 You have to call in. 476 00:22:01,966 --> 00:22:02,306 They leave a number. 477 00:22:03,946 --> 00:22:06,826 Then they call like three or four other times, like in the next couple days. 478 00:22:06,826 --> 00:22:10,846 And then, uh, three days later they call in and I pick up the 479 00:22:10,846 --> 00:22:12,736 phone and I talk to the person. 480 00:22:12,736 --> 00:22:14,416 They're like, hi, this is Xfinity. 481 00:22:14,716 --> 00:22:17,626 Uh, we had an issue with your order and they had my name 482 00:22:17,696 --> 00:22:18,116 Mm-hmm. 483 00:22:18,586 --> 00:22:19,606 I'm like, oh, that's great. 484 00:22:19,846 --> 00:22:23,446 And I was like, uh, and then it dawned on me, I'm like, I don't 485 00:22:23,446 --> 00:22:24,556 even know if this is Xfinity. 486 00:22:24,556 --> 00:22:24,946 'cause there's a 487 00:22:25,126 --> 00:22:25,476 Right. 488 00:22:26,026 --> 00:22:26,746 Garbage calls out 489 00:22:26,851 --> 00:22:27,211 Yeah. 490 00:22:27,316 --> 00:22:27,646 right? 491 00:22:27,646 --> 00:22:30,766 So I was like, can you please give me your number so I can call back and verify? 492 00:22:30,826 --> 00:22:32,176 And they've gotten really professional. 493 00:22:32,176 --> 00:22:33,826 They're like, oh yeah, we totally understand. 494 00:22:33,826 --> 00:22:35,296 This happens to a lot of people. 495 00:22:35,506 --> 00:22:37,186 Here's our one 800 number. 496 00:22:37,186 --> 00:22:37,666 Call us 497 00:22:37,716 --> 00:22:37,936 Uh, 498 00:22:38,806 --> 00:22:41,206 And then I looked at the number, I Google searched it, I couldn't find it. 499 00:22:41,206 --> 00:22:42,466 And Xfinity's normal list. 500 00:22:42,946 --> 00:22:46,456 And Xfinity has a customer security assurance 501 00:22:46,716 --> 00:22:47,066 Uhhuh. 502 00:22:48,076 --> 00:22:50,746 So I called 'em and I gave them the number, and they're like, 503 00:22:50,746 --> 00:22:52,036 yeah, that's not an Xfinity number. 504 00:22:52,561 --> 00:22:52,981 Yeah. 505 00:22:54,136 --> 00:22:57,406 Right, but the person had a, the exact same script that Xfinity 506 00:22:57,406 --> 00:22:58,606 would say whenever they call 507 00:22:58,756 --> 00:22:59,086 Yeah. 508 00:22:59,356 --> 00:23:05,086 They had the exact same accent, everything else, calling from a local number. 509 00:23:06,946 --> 00:23:07,366 Yeah. 510 00:23:08,056 --> 00:23:08,506 Right? 511 00:23:08,506 --> 00:23:09,556 But it's 512 00:23:09,676 --> 00:23:10,636 You did the right thing. 513 00:23:10,636 --> 00:23:13,876 You, you did the, basically what we're talking about here, the multi-channel 514 00:23:13,876 --> 00:23:18,106 verification, calling back to a, I mean, in that case it's technically 515 00:23:18,106 --> 00:23:21,316 the same channel, but you're, you're calling back on a different phone number. 516 00:23:21,466 --> 00:23:21,826 Right? 517 00:23:22,396 --> 00:23:27,316 Um, and that's what you're doing here is the whole point of the, uh, the different 518 00:23:27,316 --> 00:23:29,356 ways that log in and secure those login. 519 00:23:29,356 --> 00:23:31,276 The whole point of that is to maintain that security. 520 00:23:31,576 --> 00:23:35,296 If they're then trying to circumvent that security, there could be a real reason. 521 00:23:35,296 --> 00:23:40,581 There could be a. Real person with a real scenario that's really down. 522 00:23:41,061 --> 00:23:44,091 If, if that, you know, and they're, and they're, and so they can't use 523 00:23:44,091 --> 00:23:48,531 the normal methods, that's where you really need to slow things down. 524 00:23:49,311 --> 00:23:52,731 That person on the other end, they may be, they may be having the worst day of their 525 00:23:52,731 --> 00:23:58,431 lives, but you need to slow things down and verify in every way that is possible. 526 00:23:58,761 --> 00:24:02,541 Uh, and that may indeed be very inconvenient for the 527 00:24:02,541 --> 00:24:04,281 person in question, right. 528 00:24:04,851 --> 00:24:05,141 Yeah. 529 00:24:05,386 --> 00:24:09,181 The other thing too is hopefully this is part of your processes. 530 00:24:09,521 --> 00:24:09,931 Yes. 531 00:24:10,486 --> 00:24:14,866 You have a process in place when something like this has to happen 532 00:24:15,286 --> 00:24:17,326 and someone's asking for this, right? 533 00:24:17,326 --> 00:24:19,246 There is, Hey, I need this approval. 534 00:24:19,396 --> 00:24:24,466 We have these alternate mechanisms that we do to verify so everyone's on the same 535 00:24:24,781 --> 00:24:25,111 Right. 536 00:24:25,336 --> 00:24:27,556 rather than it being like, oh, I don't know what to do, 537 00:24:27,556 --> 00:24:28,876 and everyone's frank, frantic. 538 00:24:29,221 --> 00:24:29,581 right. 539 00:24:30,481 --> 00:24:37,051 And, uh, so speaking of multi-channel, uh, the other thing is to ban personal 540 00:24:37,051 --> 00:24:38,971 messaging apps for official business. 541 00:24:39,151 --> 00:24:44,221 You, you're never gonna ban, you know, let's say signal forever. 542 00:24:44,281 --> 00:24:49,111 I, I, I don't know if you can ban signal, like, like technologically you think you 543 00:24:49,111 --> 00:24:52,981 can and like, like using a firewall rules. 544 00:24:54,751 --> 00:24:54,961 It's 545 00:24:55,561 --> 00:24:56,041 Yeah. 546 00:24:56,101 --> 00:24:56,521 Yeah. 547 00:24:56,641 --> 00:24:57,541 I don't think you can. 548 00:24:57,661 --> 00:25:01,081 Well, also it's, especially if it's going out over cell phone signals. 549 00:25:01,081 --> 00:25:01,351 Right. 550 00:25:01,396 --> 00:25:01,686 Yeah. 551 00:25:01,921 --> 00:25:05,271 Um, but you can ban them for business use. 552 00:25:05,781 --> 00:25:10,071 And again, this goes back to a lot of this, you mentioned it just a minute ago. 553 00:25:10,251 --> 00:25:12,741 This is about policy and procedure. 554 00:25:13,036 --> 00:25:13,456 Mm-hmm. 555 00:25:13,491 --> 00:25:15,741 there's, there's a certain amount that you can do. 556 00:25:16,161 --> 00:25:21,961 Technologically, but in the end, what you need is regular training and policy 557 00:25:21,961 --> 00:25:25,801 and procedure that says we don't use personal messaging apps for business. 558 00:25:25,801 --> 00:25:29,311 And then when suddenly somebody is somehow contacting you via, you 559 00:25:29,311 --> 00:25:33,991 know, let, let's say, let's say they found out that you use signal. 560 00:25:34,891 --> 00:25:38,461 Like on your phone or something, and so suddenly someone is contacting 561 00:25:38,461 --> 00:25:39,901 you via signal on your phone. 562 00:25:40,201 --> 00:25:42,091 Well, that's a giant red flag right there. 563 00:25:42,091 --> 00:25:45,121 It's like, Hey, this is not, we don't use it for official business. 564 00:25:45,121 --> 00:25:45,721 Right, right. 565 00:25:45,946 --> 00:25:46,546 Exactly. 566 00:25:46,651 --> 00:25:46,981 Yeah. 567 00:25:47,821 --> 00:25:48,511 Um, 568 00:25:48,526 --> 00:25:50,776 And so establishing these mechanisms is good. 569 00:25:50,776 --> 00:25:54,796 Now, you probably also need to have sort of a break class scenario, 570 00:25:55,051 --> 00:25:55,681 you do. 571 00:25:55,741 --> 00:25:56,221 Yeah. 572 00:25:56,416 --> 00:25:56,626 right? 573 00:25:56,686 --> 00:26:01,546 Uh, I could imagine the case, remember the derecho and how everything went down, 574 00:26:01,681 --> 00:26:01,861 Mm-hmm. 575 00:26:01,862 --> 00:26:01,872 Mm-hmm. 576 00:26:02,746 --> 00:26:03,076 right? 577 00:26:03,076 --> 00:26:06,076 Scenarios like that, that you couldn't have think, thought about, right? 578 00:26:06,106 --> 00:26:09,436 There needs to be, okay, this is a documented procedure when we have 579 00:26:09,436 --> 00:26:10,381 to go outside the normal scope. 580 00:26:10,786 --> 00:26:11,326 Yes. 581 00:26:11,356 --> 00:26:13,306 And that person should be well. 582 00:26:13,311 --> 00:26:15,586 You, you should regularly train on that procedure. 583 00:26:16,006 --> 00:26:20,896 And, uh, and that procedure, the more remote a person is, 584 00:26:21,376 --> 00:26:25,846 the more that procedure needs to be kind of ironclad, right? 585 00:26:25,846 --> 00:26:27,256 And, and you need to have. 586 00:26:27,781 --> 00:26:31,111 Scenarios for those scenarios, right? 587 00:26:31,156 --> 00:26:31,276 Yeah. 588 00:26:31,411 --> 00:26:31,801 Right. 589 00:26:32,011 --> 00:26:34,951 Of like, okay, you know, a derecho hit. 590 00:26:34,951 --> 00:26:38,341 You know, if you get hurricanes all the time, you need to have a syn. 591 00:26:38,371 --> 00:26:43,696 You need to have a. A procedure that says, here's what we do in this scenario, 592 00:26:44,176 --> 00:26:47,956 and then whoever that is, that, that, that what, 'cause you don't know, you 593 00:26:47,956 --> 00:26:50,056 don't know if it's a, a deep fake or not. 594 00:26:50,791 --> 00:26:51,011 Yep. 595 00:26:51,166 --> 00:26:51,856 Whoever it is. 596 00:26:51,856 --> 00:26:55,156 Well, you need to follow our special procedure and maybe that special 597 00:26:55,156 --> 00:26:59,446 procedure is we have this other phone number that you should have in your 598 00:26:59,446 --> 00:27:01,786 phone or you should have in your, you know, like you said, your break 599 00:27:01,786 --> 00:27:06,016 glass, you got your special, uh, thing that we gave you that you're 600 00:27:06,016 --> 00:27:08,146 supposed to store in your right front. 601 00:27:08,476 --> 00:27:09,376 Breast pocket. 602 00:27:09,406 --> 00:27:09,826 I don't know. 603 00:27:09,826 --> 00:27:11,656 I'm just making stuff up, but 604 00:27:11,791 --> 00:27:12,691 like embedded into your 605 00:27:13,096 --> 00:27:13,606 it's not, 606 00:27:13,626 --> 00:27:13,846 it. 607 00:27:14,716 --> 00:27:17,356 you need to, you need to embed the little chip on your arm. 608 00:27:17,386 --> 00:27:17,686 Yeah. 609 00:27:18,106 --> 00:27:20,656 Uh, but yeah, you have that break glass procedure. 610 00:27:20,956 --> 00:27:28,336 Uh, I remember, um, when I was, when I ran it for a small organization, 611 00:27:28,546 --> 00:27:32,926 the volunteer, it was a volunteer position and, uh, the, the. 612 00:27:34,291 --> 00:27:38,276 Main person there really did not like the fact that they did not have root. 613 00:27:39,046 --> 00:27:42,646 And I was like, I will not do this if you have root. 614 00:27:42,886 --> 00:27:43,366 Like I will. 615 00:27:43,366 --> 00:27:44,386 I'm, I'm not here. 616 00:27:44,416 --> 00:27:46,036 Like, I'm just not interested in that. 617 00:27:46,336 --> 00:27:50,656 But what they did was we created a break glass procedure for that, which 618 00:27:50,656 --> 00:27:54,916 was, we had it in a special envelope that was sealed, that was in the safe. 619 00:27:55,366 --> 00:27:58,996 And if I was ever incapacitated, they could break that. 620 00:27:59,356 --> 00:28:02,806 But, uh, if that was ever the case, then obviously I had to change 621 00:28:02,806 --> 00:28:03,796 the root password and everything. 622 00:28:03,886 --> 00:28:04,216 Right? 623 00:28:04,261 --> 00:28:04,621 Yep. 624 00:28:04,636 --> 00:28:04,936 Yeah. 625 00:28:05,176 --> 00:28:05,446 Yeah. 626 00:28:06,246 --> 00:28:10,356 Going back to sort of the multi-channel verification, right? 627 00:28:10,356 --> 00:28:13,091 One thing is that you should also think about. 628 00:28:14,196 --> 00:28:20,196 For some sensitive procedures or processes, right? 629 00:28:20,436 --> 00:28:25,776 Sort of having a callback protocol that says, okay, when this happens, this 630 00:28:25,776 --> 00:28:27,306 is the mechanism we're going to do. 631 00:28:27,666 --> 00:28:31,416 As an example, if someone's like, Hey, I need to wire a hundred 632 00:28:31,416 --> 00:28:34,896 thousand dollars to someone, it's like, okay, that is a special case. 633 00:28:34,926 --> 00:28:35,016 Right, 634 00:28:35,316 --> 00:28:35,616 Right. 635 00:28:35,616 --> 00:28:36,816 Kind of like how we talked about break 636 00:28:36,911 --> 00:28:37,261 right. 637 00:28:37,476 --> 00:28:37,866 right? 638 00:28:38,016 --> 00:28:39,456 This is a special case. 639 00:28:39,516 --> 00:28:43,506 Here are the exact steps that are required, and here are the people you need 640 00:28:43,506 --> 00:28:47,916 to contact using this type of protocol to make sure that yes, this is legitimate. 641 00:28:47,916 --> 00:28:48,276 Right. 642 00:28:48,276 --> 00:28:54,126 And, and one of the big ones would be a big payment to a new vendor, right? 643 00:28:54,126 --> 00:28:58,596 That should set all sorts of, uh, set off all sorts of red flags, right? 644 00:28:58,626 --> 00:29:00,906 You're sending a hundred thousand dollars to a vendor that you've 645 00:29:00,906 --> 00:29:02,766 never done any business with before. 646 00:29:03,306 --> 00:29:07,866 Uh, and then, and for some reason the, the CFO is calling you about this payment. 647 00:29:07,866 --> 00:29:11,346 That should be like, that should, you know, even if it sounds so much like a 648 00:29:11,346 --> 00:29:14,466 CFO, that should set off, uh, you know. 649 00:29:14,721 --> 00:29:17,991 Or, or it should be like, Hey, you should talk to procurement to figure 650 00:29:17,991 --> 00:29:19,431 out, okay, when did the vendor get added? 651 00:29:19,436 --> 00:29:19,726 Yeah. 652 00:29:20,451 --> 00:29:20,751 Right? 653 00:29:20,751 --> 00:29:21,921 And are they even aware of them? 654 00:29:22,196 --> 00:29:22,486 Yeah. 655 00:29:22,506 --> 00:29:25,281 And, and I just wanna speak to something here. 656 00:29:25,821 --> 00:29:30,801 You need to have a conversation with these people who are, uh, you know, 657 00:29:31,191 --> 00:29:35,181 your, in your management chain, and you need to have a conversation in advance. 658 00:29:35,331 --> 00:29:40,281 Say, Hey, if you ever have a situation where it's triggering my, 659 00:29:40,671 --> 00:29:42,951 you know, um, what do you call it? 660 00:29:42,951 --> 00:29:43,281 Um. 661 00:29:44,031 --> 00:29:45,081 Uh, red flag. 662 00:29:45,291 --> 00:29:45,771 It's, yeah. 663 00:29:45,771 --> 00:29:45,921 Yeah. 664 00:29:45,921 --> 00:29:48,291 It's triggering off my spidey sense, whatever you want to call it. 665 00:29:49,191 --> 00:29:53,031 And I then put the kibosh on the thing you're asking for. 666 00:29:53,691 --> 00:29:55,821 You need to not like yell at me. 667 00:29:56,241 --> 00:29:56,571 Right. 668 00:29:56,571 --> 00:30:01,341 We need to agree in advance that if I put a stop to a large transaction or 669 00:30:01,341 --> 00:30:07,101 something like that, or I don't reset your MFA because you're trying to log 670 00:30:07,101 --> 00:30:10,881 in and then you, you know, you cannot. 671 00:30:11,556 --> 00:30:13,896 Then just use your position to say, just do it. 672 00:30:14,046 --> 00:30:14,466 Right. 673 00:30:14,916 --> 00:30:20,196 Um, because that, that's exactly what a, a threat actor would do, you know? 674 00:30:20,586 --> 00:30:20,796 Yeah. 675 00:30:20,796 --> 00:30:22,866 And you've established these processes ahead 676 00:30:22,926 --> 00:30:23,706 Right, right, 677 00:30:23,856 --> 00:30:26,796 and so you should be following it as a company. 678 00:30:26,886 --> 00:30:27,186 right. 679 00:30:28,386 --> 00:30:28,626 Yeah. 680 00:30:29,046 --> 00:30:33,726 And kind of along that line of sort of the processes, procedures, callback protocol, 681 00:30:34,596 --> 00:30:36,726 It's really important that employees get 682 00:30:37,061 --> 00:30:37,351 Yeah. 683 00:30:37,731 --> 00:30:41,301 Right and periodic training because this landscape is changing. 684 00:30:41,421 --> 00:30:45,021 How people are attacking with DeepFakes is constantly evolving. 685 00:30:45,021 --> 00:30:50,541 What are the new attacks is also changing on literally a day by day basis. 686 00:30:51,021 --> 00:30:55,971 And it's interesting 'cause Curtis, I don't, I know in the past, like we both 687 00:30:55,971 --> 00:30:57,741 have done sort of security training. 688 00:30:58,851 --> 00:31:02,901 I don't think I've ever run across deep fake training in those lessons. 689 00:31:05,241 --> 00:31:05,661 Right. 690 00:31:05,991 --> 00:31:06,411 No. 691 00:31:07,266 --> 00:31:07,956 Yeah, and 692 00:31:08,286 --> 00:31:12,246 Well, I mean, if you think about it was the last time, well, at least for me, 693 00:31:12,276 --> 00:31:15,156 the last time I was working for a company that was doing that kind of training. 694 00:31:15,156 --> 00:31:19,086 It was before Deepak was a thing, but yeah, 695 00:31:20,016 --> 00:31:24,241 but hopefully companies are now updating their trainings to include 696 00:31:24,271 --> 00:31:29,076 DeepFakes, maybe you should just periodically do a deepfake training or 697 00:31:29,076 --> 00:31:33,366 just have someone pretend to be a deep fake, join a video conferencing call 698 00:31:33,576 --> 00:31:34,566 yeah, yeah. 699 00:31:34,776 --> 00:31:35,256 I like that. 700 00:31:35,406 --> 00:31:36,426 see how people react. 701 00:31:36,531 --> 00:31:37,761 wonder, uh, like, no. 702 00:31:37,761 --> 00:31:41,841 Before, I wonder if, uh, if they've updated their stuff to a clay, 703 00:31:41,901 --> 00:31:43,041 they've got to at this point. 704 00:31:43,401 --> 00:31:43,641 yeah. 705 00:31:43,941 --> 00:31:48,081 And along with those employee trainings is also, include this 706 00:31:48,081 --> 00:31:49,581 in your tabletop exercises, 707 00:31:49,816 --> 00:31:50,236 Mm-hmm. 708 00:31:50,541 --> 00:31:50,781 right? 709 00:31:50,781 --> 00:31:52,881 Just like we've talked about ransomware preparation. 710 00:31:53,721 --> 00:31:59,391 I think that you must include deep, fake exercises to figure out, and 711 00:31:59,391 --> 00:32:03,291 especially with people from finance and accounting who maybe normally 712 00:32:03,291 --> 00:32:05,361 are not part of your tabletop 713 00:32:05,496 --> 00:32:05,916 Mm-hmm. 714 00:32:07,206 --> 00:32:10,386 It's important that they now have this focus training to 715 00:32:10,386 --> 00:32:12,696 make sure they understand the scenarios and the situations. 716 00:32:13,671 --> 00:32:21,441 Um, and there are, so I think policy and procedure is the big tool here, right? 717 00:32:22,641 --> 00:32:28,251 Having said that, there is also starting to be detection tools right now. 718 00:32:28,251 --> 00:32:30,621 This will be for the rest of our lives. 719 00:32:30,621 --> 00:32:35,691 This will be an arms race, right, where we will have tools that detect ai. 720 00:32:35,901 --> 00:32:39,231 Right now, it's relatively easy if you know what to look for to 721 00:32:39,231 --> 00:32:41,721 detect an AI video or an AI audio. 722 00:32:41,721 --> 00:32:42,981 If you know what to look for 723 00:32:43,066 --> 00:32:43,286 ai? 724 00:32:45,021 --> 00:32:45,261 you. 725 00:32:45,981 --> 00:32:49,551 I don't think anybody could really do you as ai, but um. 726 00:32:50,241 --> 00:32:53,661 But there are tools right there, there is software that could do real 727 00:32:53,661 --> 00:32:58,041 time AI detection, and they look at things like how the voice sounds, 728 00:32:58,041 --> 00:33:00,411 they look at the cadence of the voice. 729 00:33:00,411 --> 00:33:05,001 They look at, uh, if it's video, they're looking at eye movement and you know, and 730 00:33:05,001 --> 00:33:07,611 also like, uh, biometric watermarking. 731 00:33:07,611 --> 00:33:10,731 There, there's all sorts of things, especially for high risk 732 00:33:10,731 --> 00:33:12,411 people or high risk industries. 733 00:33:12,831 --> 00:33:17,631 Um, and uh, and then also there, there's enhanced. 734 00:33:18,426 --> 00:33:22,986 Things, you know, enhanced security measures like liveness detection 735 00:33:22,986 --> 00:33:24,636 on multifactor authentication. 736 00:33:24,726 --> 00:33:25,116 Right? 737 00:33:25,446 --> 00:33:27,486 Voice, voice biometric systems. 738 00:33:27,486 --> 00:33:27,786 Right? 739 00:33:27,786 --> 00:33:31,956 That, that can actually detect that the, the voice that they're 740 00:33:31,956 --> 00:33:33,336 listening to is synthetic. 741 00:33:33,396 --> 00:33:33,756 Right. 742 00:33:34,056 --> 00:33:34,296 Yeah, 743 00:33:34,386 --> 00:33:34,806 Um. 744 00:33:35,316 --> 00:33:40,836 also along those lines, there are now regulations coming out trying to 745 00:33:40,836 --> 00:33:43,326 target sort of AI generated content. 746 00:33:43,326 --> 00:33:47,976 So if you look at things like Facebook videos, if they are generated using 747 00:33:47,976 --> 00:33:49,511 ai, I believe it now has to be tagged. 748 00:33:50,086 --> 00:33:50,506 Mm-hmm. 749 00:33:51,801 --> 00:33:56,331 And so there is sort of that awareness that AI is getting so good that 750 00:33:56,331 --> 00:34:01,521 it's hard to differentiate, so it requires this additional tagging and 751 00:34:01,521 --> 00:34:06,051 information to be able to help users discern AI versus a real person. 752 00:34:06,436 --> 00:34:07,606 So there is technology. 753 00:34:07,606 --> 00:34:10,776 So just, just search and, and keep yourself up to date on 754 00:34:10,776 --> 00:34:12,816 deepfake detection technology. 755 00:34:12,816 --> 00:34:14,136 It's going to be an arms race. 756 00:34:14,436 --> 00:34:16,296 This is gonna be fun, right? 757 00:34:16,566 --> 00:34:20,256 Um, so let, let's talk about some things not to rely on. 758 00:34:20,576 --> 00:34:21,356 Caller id. 759 00:34:22,461 --> 00:34:22,681 Yep. 760 00:34:23,066 --> 00:34:25,706 Caller Id don't mean jack squat, right? 761 00:34:25,901 --> 00:34:26,121 Yep. 762 00:34:26,306 --> 00:34:31,586 Um, and also, uh, if you have voice recognition systems, if you don't 763 00:34:31,586 --> 00:34:34,286 have additional authentication on top of that voice recognition. 764 00:34:34,706 --> 00:34:36,656 Um, same thing with video calls. 765 00:34:36,866 --> 00:34:41,126 And again, this, this urgent when, when it's like super urgent. 766 00:34:41,126 --> 00:34:43,301 This is why you've got to, you've got to agree upfront. 767 00:34:44,691 --> 00:34:49,461 Even when it's urgent, you know, um, you, you, you follow the 768 00:34:49,461 --> 00:34:51,171 policy and procedure, right? 769 00:34:51,676 --> 00:34:57,861 but I do wonder if people are of away from urgent. 770 00:34:58,881 --> 00:35:02,481 As an example, if they start to understand, because like you said, it's 771 00:35:02,506 --> 00:35:02,926 Mm-hmm. 772 00:35:03,891 --> 00:35:10,461 If bad actors start to realize, hey, people are not well to the urgency 773 00:35:10,671 --> 00:35:13,881 and we don't necessarily need to be urgent in order to be able to. 774 00:35:14,616 --> 00:35:18,996 Do this sort of attacks, maybe that starts to drop away. 775 00:35:18,996 --> 00:35:24,906 So I just wanna caution people to not rely on urgent as the only flag. 776 00:35:24,906 --> 00:35:25,866 It is one of the 777 00:35:26,026 --> 00:35:26,376 Yeah. 778 00:35:26,946 --> 00:35:28,566 but it should not be the signal 779 00:35:28,626 --> 00:35:29,166 Agreed. 780 00:35:29,346 --> 00:35:29,856 Yeah. 781 00:35:30,006 --> 00:35:32,976 It's, it's not the only flag, but it's definitely a big flag. 782 00:35:33,126 --> 00:35:33,516 Right. 783 00:35:33,726 --> 00:35:34,026 Yeah. 784 00:35:34,086 --> 00:35:37,536 Uh, and of course, you know, I mean, this should go without saying, but things like, 785 00:35:37,716 --> 00:35:39,216 oh, I know, I know this person's voice. 786 00:35:40,026 --> 00:35:42,486 And, and also they knew, just like you mentioned earlier, they 787 00:35:42,486 --> 00:35:44,466 knew details about me, dude. 788 00:35:44,466 --> 00:35:46,086 They, they got all kinds of stuff, right. 789 00:35:46,086 --> 00:35:49,236 And, and how real the video looks, uh, because it's, it's 790 00:35:49,266 --> 00:35:52,686 pretty amazing, uh, especially if the video is very short, right. 791 00:35:52,981 --> 00:35:53,271 Yeah. 792 00:35:53,346 --> 00:36:00,126 Um, so I, I, I guess the, the summary is that, you know, the human element 793 00:36:00,126 --> 00:36:05,046 is still, it's both our strongest defense and our weakest link, right? 794 00:36:05,136 --> 00:36:11,916 Um, we, we can't, we can't, we can't solve our way out of this with technology alone. 795 00:36:11,946 --> 00:36:16,266 It's got to be a combination of, uh, people, process and technology. 796 00:36:16,541 --> 00:36:16,831 Yeah. 797 00:36:17,001 --> 00:36:19,161 Yep, a hundred percent agree. 798 00:36:19,311 --> 00:36:19,671 Yeah. 799 00:36:19,881 --> 00:36:20,331 All right. 800 00:36:21,111 --> 00:36:22,461 Well, it's been fun. 801 00:36:22,461 --> 00:36:25,801 Prasanna. 802 00:36:26,741 --> 00:36:28,021 Deep fake Prasanna. 803 00:36:28,311 --> 00:36:28,851 Who knows? 804 00:36:28,851 --> 00:36:29,421 Who knows? 805 00:36:29,961 --> 00:36:35,211 All right, well, uh, thanks for listening folks, and, um, you know, um, be sure 806 00:36:35,211 --> 00:36:37,551 to subscribe wherever you see us. 807 00:36:37,611 --> 00:36:40,266 And, um, um, that's a wrap.