>> This episode of the Modern Rogue,
produced in partnership with our friends
over at LastPass.
>> LastPass.com
Goddamn it.
[laughs]
>> I can say a website.
>> I know, it's just like, LastPass.
[laughs]
>> Website.
>> Thank you, LastPass.
[laughs]
>> Where did the name phishing come from?
>> Okay, so you're fishing for information,
trying to lure it, right.
But the phone phreaks.
>> P-H-R-E-A-K, so there already was phreaking
which was using the telecommunications network
for things that wasn't intended to do
like, draw power, get free phone calls
and that kind of stuff.
>> Yes, and so when fishing started to become a thing
in the mid '90s, the early to mid '90s,
they just put the P on there.
[laughs]
It's not the best explanation.
I didn't, yeah.
>> It's a coronation.
And now, let's put the P on it.
>> We grant you with these consonants.
>> ROBOTIC VOICE: The boys go phishing.
>> All right, Murphy, what is phishing?
>> Okay, phishing is when someone uses
some sort of electronic communication
to scam you out of sensitive information,
like money, or access or something like that, passwords.
Or they're trying to get you to install malware.
>> So, we previously talked about 419 scams.
And that's a case where you start with a blank slate
and you establish a relationship with someone.
And then you use that to make money off of them.
Phishing is the reverse.
You take the trust that somebody has,
whether it's with a bank, with another person,
with any other entity,
and you act as though you are party of that.
It's essentially, I guess what hackers would call,
a man in the middle attack, right.
You are acting as an agent of Wells Fargo,
even though you're not them.
>> Exactly, you are pretending to be
something that you're not.
Or you've mocked up an email.
Or you've made that email look like
it came from a trusted source.
>> So, I would imagine that
there are versions of this,
I'm going to make all this up,
going back hundreds of years,
in the letter writing days, you know,
"Hey, I'm writing on behalf of King George."
>> Oh sure. >> That kind of thing.
But, of course, we know it as an email scam.
>> There are a lot of different variants on it.
It can show up as an email.
You can get a text that looks like it's from your bank.
Or from Amazon or UPS or something like that.
There are all sorts of different methods
for people to get this trap set for you.
Unlike the 419, this is someone saying,
"Hey, you need to do this."
And it's usually urgent.
"You need to do this really quickly,
"this is UPS and we need
"to verify your account information."
>> Yeah, you know, there's a weird stigma
associated with 419 scams,
where you feel like a big sucker,
because you trusted somebody
and then they ended up screwing you out of money.
Whereas, I don't know, I feel no guilt for the times
that I've almost fallen for a phishing scam.
>> Oh yeah, no, I actually had one
where it was my bank
and they sent me an email,
they said, "Hey, we've had a security breach,
"you need to do this, right now,
"and change all of this information."
>> By the way, classic hallmark of a con game,
is that moment you say, "And that's why
"I need your money, right now."
That sense of urgency is an important element to this.
>> In all of my research,
that was the flag that kept popping up,
was them waving the flag saying, "It's urgent,
"it's urgent, you have to do this now."
So, anytime there's a sense of urgency,
you got to slow it down
and start looking for the other signs.
>> So, that social pressure is so incredibly strong.
When somebody calls you and they're like,
"There's a problem, we have to fix it."
Your immediate thought is not usually,
"Hey, I don't know who you are,
"I don't trust you,
"I don't know why you're calling me,
"I'm going to hang up the phone
"and call my actual bank."
But spoiler alert, that's the answer.
That's what you should be doing.
Anytime, anybody reaches to you,
if you find yourself, about to say out loud,
your credit card number
or any kind of sensitive information,
think to yourself, did I call them
or did they call me.
If they called you, the answer is, "I'm glad you told me
"about this, I will handle it, goodbye."
And then that's it, whether it's on the phone,
whether it's on email.
>> They will send you something like,
"Okay, you need to update your password for your bank."
And they'll send you an email there.
You'll click on that and maybe you'll go to
a fake bank website,
that looks just like it.
>> And maybe they'll even use social cues like,
you type in your password
and it's like, "Oh, that's not your password,
"you want to try again?"
"Yeah, okay."
And they're like, "Oh, that's definitely it, 404."
Close up shop run away.
>> Exactly, 1.5 million
new phishing sites appear, every month.
>> Sites? >> Yeah.
>> So, these are like franchises,
popping up, left and right.
>> Yeah, essentially.
$1.6 million is the average damage done
to a mid size company.
>> Holy cow.
>> For a mid size company,
that can put you out of business.
>> Yeah, sure, especially for a small business
like, themodernrogue.com.
[laughs]
>> 30% of all phishing emails are opened.
>> By definition, a phishing email's going to be something
that looks like a regular correspondence that you have.
So, it makes sense that you would open it.
It seems like this would be a prime target for scammers.
>> Yeah, and 12% of those 30%,
opened the malicious links, inside.
So, these are very successful.
>> So, how do you know the difference
between a real link and a fake one?
>> A lot of times, you just look for misspellings.
>> V1agra.
>> Yeah, or bankofarnerica.com
>> Oh, yeah. >> If you see it written out.
But if you're not paying attention,
you think, "Sure, this is my banks website,
"I'm going to log in."
And once you put in your information, you're screwed.
>> So, one of the most diabolical phishing attacks,
I'd read of, recently,
was somebody who was at a bar,
got a phone call about a problem
from his bank, Wells Fargo, at the time,
"Hey, we got to verify that it's you,
"I'm going to send you a link."
Sent a verification code, over text.
>> Over text. >> Over text.
And the guys like, "Yeah, yeah, yeah, okay."
Reports it, and they keep on going.
They're like, "All right, we're fixing the problem."
And they're like, "Oh, let me send you
"another verification code."
He was like, "Sure, whatever, whatever."
And he goes back to drinking,
has a great time.
He was only after he got home
that he saw the emails that say,
"Thank you for signing up for Zelle,
"Zelle's a easy way to transfer money,
"you just transferred $1000.00,
"to person who's not authorized to have that money."
The fusion of it being over the phone,
taking advantage of an established relationship
and it's seeming like a low stakes affair.
Often times people who fall for phishing scams,
are just busy, they don't want to deal with the nonsense.
>> He was out drinking
and he just thought,
"Oh, I got to resolve this really quickly."
>> "I got to do the thing so I can get back to the beer."
>> "It's important because
"they're telling me it's important."
"And it's my bank, so, why wouldn't it be important?"
Phishing attacks have been behind some of
the biggest security breaches in recent history.
>> The democratic emails, that was one.
>> Yeah, they convinced John Podesta,
who worked under Hillary Clinton,
to, passwords. >> To reveal
his Gmail password, yeah.
>> And he did, that's how all the DNC emails
got leaked out into the world.
Also, TheFappening, all of these people's nude pics.
At first, everyone thought that it was a vulnerability
in Apples iCloud security, but I wasn't,
they were all successful phishing attacks.
>> Yeah, so this is a case where,
they basically said, "I forgot my password,
"do the reset thing,
"I'm definitely this person."
We think of phishing attacks, usually in terms of,
the consumer being the sucker,
who's on the hook,
but in this case it was Apple,
that was the sucker that was on the hook.
>> Oh, right, right.
>> "No, no, no, I'm definitely this famous person."
And, "Let's reset my password."
>> That was probably a great smoke screen
that bought them some more time.
So, there's some variations in phishing.
There's your regular phishing,
where they send out just a bunch of emails.
>> Essentially you're thinking spam, right.
Send out a billion emails,
all of them say Bank of America,
somebody's going to click on it,
you're just playing the odds.
>> And apparently 30% of them get opened.
But there's also spear phishing.
>> If I remember correctly,
spear phishing is a highly targeted thing,
where you are not just casting a wide net,
you are, I guess, spear fishing,
you're very specifically,
"I'm going to write an email as this individual person,
"taking advantage of exactly this relationship,
"in order to get the info I need."
>> Precisely.
With spear phishing, the bad agent
has used open source intelligence,
available on the internet,
to get everything they can
about someone in a company.
>> So, this will be stuff like, Instagram accounts,
Facebook, social media.
>> Everything you can find.
Or like, let's say that they're going to find out
everything they can,
about the CEO of a company
and find all of the email addresses
associated with that company's domain,
so they can cast a wide net for them
and they'll spoof an email
that looks like it's from the CEO
that says, "Hey, come to this meeting,
"enter your Gmail information."
>> So an example might be like,
Elon Musk probably has emailed Mark Zuckerberg
at some point.
So, basically, like, that's a known connection
and then I'll just pretend to be one or the other
and casually set up a thing
to get them to reveal something
or set up a financial boondoggle.
>> Exactly, you have used open source intelligence
to find out everything about your target that you can.
>> So, what is this laser phishing
because that sounds awesome, for the record.
That is my favorite Steam Vive game.
[laughs]
>> It's good, it's good.
I'm waiting for Couch Co-op though.
[laughs]
Laser phishing is where an AI
takes all of that information
and impersonates someone you know.
>> So, we live in an age
where AI bots are able to take,
for example, in pornography,
this whole deep fakes thing,
where it paints a face
based on publicly available photos of prominent figures.
That's essentially, that in email form,
with the intent to defraud.
>> Or a chat bot.
>> Oh my god, so, it can have a whole conversation.
I've got, what, 90000 tweets out there.
So, a bot could figure out,
"This is the way Brian Brushwood tends to talk,
"lots of exclamation points, always shouting,
"I'll just try talking like that
"and see who I can convince to be Brian."
>> We're going to have to develop a void comp test,
like Blade Runner. >> A secret safe word.
So, it occurs to me,
that's why Twitter started their Verified program.
Is because there were people
pretending to be other famous people.
That's a form of phishing, right.
And, in fact, the way I got verified,
was by telling all the fans,
I was like, do me a favor guys,
I want all of you to make fake Brian Brushwood accounts,
and just post whatever,
and then I will loudly complain about, "All these fakes,
"if only I was verified."
>> That's funny, I actually got a,
hey, verify your Twitter account,
email from Twitter.
But I thought it was a phishing email
so I deleted it.
>> Oh my god,
that's why you're not verified.
[laughs]
That's amazing. >> Yeah.
>> I have a confession to make.
I was not good about passwords
and then we did the LastPass episode about passwords.
>> Oh, that changed everything.
>> Oh my god, I spent half a day,
changing every single one of my passwords
from far back as I can find.
To make sure that they were long and unique
and all the things that you're supposed to do
for good hygiene.
>> And it's just so easy when you use LastPass.
>> Once you buy into the ecosystem,
it really does take care of itself.
Like, I never expect myself to remember my passwords.
I know where all my stuff is very safely, securely put
and I go in and get the password
and then I use it, like a key basically.
>> Yeah, exactly, it's not just easy,
but it's safer.
>> One of the best parts of that day
was, I knew that future Brian
would remember none of these passwords,
so I try to make future Brian laugh
with all the passwords that I made.
It's been a fun, like,
it's like hiding your own Easter eggs.
[laughs]
>> See, I just use the auto generate thing,
where it's just a string of gibberish.
You just right click, populate, you're done.
>> And that extension, on Chrome at least, is fantastic.
You just click on it,
it takes you to the website,
which can be a phishing protection.
Let's say you get something
from what looks like Bank of America,
you just click on the extension,
say let me go to Bank of America,
ain't no way to mess that up.
It's going to take you to the actually site
and give you the actually password to get in.
>> You're not falling into the trap,
you're going around it
and going to the real thing,
to see if it's legit.
>> The app is even better now,
with the facial recognition thing.
You'd use face ID to open it
and you're like, "Yep, that's my password."
Then I'm good to go.
>> That is so simple.
There's really no reason not to use it.
>> Look man, you know you should have long, secure passwords.
You know you should be using a password manager.
So, do yourself a favorite,
click on that link,
make us look good and use LastPass.
>> It's easy, it's affordable
and it makes you safer.
There's no reason not to do it.
LastPass. >> LastPass.
>> LastPass. >> LastPass.
>> DRESSPANTS ROBOTMAN: LastPass.
>> All right, so how do you spot a phishing attack?
What are the clues you look for?
>> The trick is, that a lot of times you can't.
>> Looks like that to me.
I'm sitting here looking at it,
it looks like a UPS thing.
>> Yeah, so, this UPS one
and you'll note down there it says,
"Clicking on your tracking number."
And your device is immediately infected with malware.
>> And in meanwhile looks like Wells Fargo,
looks like Bank of America,
looks like PayPal.
>> These are fool proof, right. >> Yeah.
>> Now, there are methods that you can use
to check them out.
But just looking at these,
there's no reason to suspect that they're fake.
>> I think the important thing
is that people have a tendency to think,
"Oh, I can spot a fake."
And the answer is, no, no you can't.
They're exactly perfect copies.
The only defense you have
is to ask yourself, at the moment you're about to reveal
any kind of sensitive information,
did they contact me or did I contact them?
And even then, you can't be 100% sure
because often times people use numbers
that are very, very close to the actually numbers,
misspellings on traditional websites, and so on.
>> And most cases, you can't actually spot a fake,
if you're not looking for it.
>> That's the number one thing,
is be on guard at all times.
>> Yeah, any email you get, any text you get.
Even if it looks like
it's coming from someone you have trusted
and had a relationship with, for decades, in some cases.
Like, for instance, this one is a mock up
of an amazon.com phishing attempt.
>> And he uses some variation of the original.
It's not amazon.com, it's generic openings.
>> It says, "Dear Client."
Instead of, "Dear Brian."
>> But even then, if it said, dear Brian,
that wouldn't make it any safer.
They're reaching you, you're not reaching them.
>> Exactly, that's really not the best example.
But it is a marker.
And all of these add up to fraud.
>> Here's and important point,
always hover over links,
before you actually click them,
to make sure they're going
where it looks like they're going.
>> Exactly, if you just take your mouse and hover over it,
the actually information will pop up.
Rather than what
you're seeing. >> So, how much
can you rely on the https?
Because we've had a number of fans, in the comments,
point out that https by itself,
doesn't really save you from anything.
Because it could be a bad actor on their end.
And you're right, if they're a bad actor,
if it's a phishing scam,
https is not going to save you.
>> It's another thing,
that you look for all of these different signs.
There's probably not going to be one big red flag.
But there's going to be a lot of little things.
Even like in the Nigerian email scam,
you're going to find misspellings and things like that.
So, you just got to keep your eyes open
and if you start getting a bad feeling about something,
just always reset and say, "Great, thank you,
"I'm going to contact you and take care of this."
>> Always be the one who initiates contact
with anything sensitive.
>> Hang up the phone and then dial the number
that you know you have for your bank.
Or send the email that you know you have
for this particular provider of any given service.
Go through the channels that you have always used.
>> All right, we're not bad guys,
but if we were bad guys,
what would it look like?
What tools would we use
to craft a phishing email?
>> Who's this we?
[laughs]
I just want to say, you're horrible.
And I'm a paragon of virtue.
>> No, I'm saving people.
>> There are actually lots of phishing kits available.
Some of them for actual, like, pen testing.
>> Penetration testing, that's were people hire individuals
to try to break in and test their security, right.
>> Exactly, huge market for it, obviously.
You want to find out if you are bullet proof, or not.
And so, you hire people to poke holes in your organization.
>> You hire someone to shoot bullets at you.
You're like, "It turns out I'm not."
[laughs]
"Bad idea."
>> And then the pen testers, "Penetrated."
[laughs]
That's how they do it.
>> "Hostage down."
>> Lots of different tools available, for free,
on the internet.
There's a social engineering toolkit
which is kind of the go-to for pen testers.
There's MultiGo, which is an open source information.
Kind of a data miner.
Where you can find all sorts of stuff.
Basically anything on the web
associated with a person or an organization.
It just scrapes it and does visual graphs.
>> So, it does your research for you.
>> It's incredible and terrifying.
>> Horrifying. >> Yes.
There're also lots of free, easy to use,
email spoofing tools.
>> Sounds like we're advertising for the bad guys here.
>> This is actually a legitimate one.
Search for, yeah, SPF Guru
and go to mail spoofing test.
And you got to click, I am the owner.
And go to Create.
And you're going to receive a confirmation request
to your email address.
So, go to your email.
>> So, everything at brian@shwood.com
forwards to my Gmail account,
and I found out, there's no easy button
for you to press
to say, "Hey Gmail, go check my email
"and get the latest email that just got in."
But if you go to Accounts and Import,
you'll see this right here,
this is the only place I've been able to find it,
that Check Mail Now button.
And then if there's anything in your other email account,
it'll grab bit and put it in your Gmail.
>> My work domain account forwards to my email account.
And so, I'll have to go in there and do that.
Okay, so you got an email here, "Email spoofing requested."
So, clearly this is not a tool
that the bad guys use, "Hey you're about to get tricked."
[laughs]
So, Spoofed Sender Address?
>> Okay, modernrogueshow@gmail.com.
We're going to pretend to be us, talking to us.
Subject, New Episode.
>> New episode and we need your bank account.
Doesn't sound suspicious,
I think you've got a promising career.
>> This is the kind of email we would send.
Check mail now. >> Yeah.
>> So, now it's going to go to brian@shwood.com,
grab that new email.
And, nope, nope.
Nope, nope.
>> JASON: There's a text, you got a text.
[laughs]
>> Yeah dude, it's not sending it.
[laughs]
Either that or Gmail's filters are too good.
>> I don't understand,
that was working just fine.
You want to try another one? >> Yeah.
>> Okay, there are lots of little tools out there,
a lot of them you can download,
but this one is just a website
and it's really easy to use, anonymailer.net.
>> All right, from, Dresspants Robotman.
>> He always sends some really weird stuff.
>> To. >> Okay,
you just made up an email for Dresspants Robotman.
>> Right, okay, there we go.
>> Typical. >> There we go.
>> Butts and butts and butts.
>> Classic Dresspants Robotman.
Boom, oh, I just got an email from Dresspants Robotman.
What? >> I didn't even know
he had internet. >> Soon.
That's what it should say.
>> Just say, soon.
>> So, this is interesting.
First of all, it went to spam.
And second of all, Gmail says,
it may not have been sent by that person.
So, it seems like there's pretty good protections,
like, baked in.
>> And there's an option there
that says, "Report phishing." >> Yeah.
>> And this is clearly a proof of concept.
But imagine if you used all of the assets
from a legitimate sender.
>> You would not be able to tell.
People often think,
this is the mistake they make in magic,
is they think, "Well, I'm smart
"therefore I can't be fooled."
And the smartest people are the ones
who are like, "I can always be fooled,
"by everything, so, I'm constantly
"going to be questioning everything."
>> Exactly.
>> So, the most important thing is,
always be the one in charge of the conversation.
Make sure if you're handling
any kind of sensitive information,
you're the one who initiated the call
and that you called the right number
and that you're talking to the right person.
>> Yeah, and be really careful on what you click on.
>> But I think, the important takeaway
is always open any email
that claims to be from the Modern Rogue.
>> Yep, yep, just like lastpass.com says.
>> Aye. >> Trust the Modern Rogue.
>> Aye, Henry Winkler shows up,
he's just like, "What's going on guys?
"I heard you're doing my bit."
I did magic for Henry Winkler once,
in his kitchen.
>> Were you invited?
[laughs]
He's in his robe,
getting up in the middle of the night.
>> And he was super nice,
he was like, "Well, hello, can I help you?"
>> Brian, "Hi."
[laughs]
>> Someone screaming.
[laughs]
>> Living in America.
>> That's fishing.
[laughs]