How NOT to be a Vishing Victim

welcome everyone to the podcast. We have Craig and BJ and we have Jamel again, Jamel joined us a couple months ago and we talked about password security. But Jamel, if you want to just give us a brief overview of what your position is and what you guys do and your experience and things like that.

Sure. thank you for that introduction. There I'm Jamil from the gatekeeper team cert Barbuda's gatekeeper is the proximity to the fade lock and key. The goal with gatekeeper is you unlock your key using a pen and proximity token, and never have the type of password again. I work in client success and my job is to make sure our clients are happy. They know exactly how to use gatekeeper and it is working to their expectations. We've been in this space now for about five years and access control and password management to ensure that. people are using strong and complex passwords and also not sharing them, which I think is kind of a theme of today. Making sure that people are protecting those passwords, taking them seriously.

So what's cool about gatekeeper is it's not just another technology that just makes things more secure. It actually makes your life a whole lot easier. So usually with security, it's the balance. Work flow and ease of use versus productivity. But what I like about gatekeeper is it actually makes your life easier with never having to deal with passwords and you let the gatekeeper do that and handle that for you and then increase the security for you. So rapid log in and log. And that, frequent walking away from your computer system and then walking back and having it detect that you're by auto unlock, all those seconds add up. And before you know it, you've got hours back, that you could be more productive instead of wasting that.

Yeah, it's very rare to find something that marries convenience and security. So when you find one, you hold onto it.

And I think that's a unique factor, obviously with gatekeeper. I think we at Petronella Technology Group work hard at trying to find really good solutions for our audience and gatekeepers. Definitely one of them.

Yes, and I love my gatekeeper. I use it literally every day.

Thank you. It's good to hear. Thank you for the good words. I say right now I have over 200 something passwords stored in mind, and I don't know if.

same here. Joelle, do you have any updates from your dev team around the mobile app? I'm excited for the mobile app.

Yeah, no, I think it's something we're trying to release in quarter two. Right now we do have the imports, the ability to turn the phone into a token to act as your gatekeeper, but this next phase will then now allow you to have your passwords there as well.

Yeah, I think that's going to be your game changer right there. I can't wait for that. I'm chomping at the bit for that to come out.

Same here. It's funny, not an athlete having geeky take care of all my computer pass and I'm like, oh wait, my phone has just as many passwords, if not more.

that's right. Yeah. I'm excited for that. I didn't mean to put you on the spot, but that's why I was asking, but quarter two, that's just around the corner. So that's not too far.

I've played with test versions of it, I know it's real.

Yeah, they're technically only a couple of days left in quarter one. So yeah, we're almost in quarter two. So no pressure.

and then in soon too, they're going to roll out where they automatically change your passwords every however long you set it up.

Yeah. You said the time period. What did every day you could probably be a little bit of a headache for some people, but every day, every three months, whatever your team needs to feel secure, we'll let you do it.

That's awesome.

Yeah.

So then today there's a lot of news to get to. one of the big things this weekend, Morgan, Stanley's announced that they were breached in a social engineering attack, which we definitely want to talk about. And it was just pretty neat that gatekeeper is on right when that happened, because that's something that gatekeeper could have helped with if they had done something like that. But also. BJ was telling us there's some pretty big news that was going on actually in the ward BD. Do you wanna tell us a little bit more about that?

Yeah, I guess on the day that the war started, there was a breach, a cyber attack happened on European global satellite internet. And I didn't hear anything about it. I don't know if you guys did, but I didn't hear anything about that until just recently when they have made their determination that they're saying it was a Russian military. Hackers that they say did it. But until they've found or, identified their culprit that's the first I heard of it, but they were calling it an anonymous attack. At first, and then now they've said it was the Russian military, but it happened, on the same day that the war started. And there were a bunch of communications down in Ukraine because of this on the day that the war started. So it was already affecting Ukraine that day, I guess there was a whole bunch of communication, mishap that. So this global satellite internet seems to be a reoccurring theme, an undercurrent for this whole thing, but definitely there's a lot going on with this.

Yeah.

So one of the things I was just going to talk about with the fishing, what I like about gatekeeper is if you can get in the habit of not typing. Or manually typing the URL or clicking on any kind of links in the emails and you just use your gatekeeper solution. Then it's a lot safer from fishing because it's already stored in your password manager. So you're making sure that you're always going to the same or the correct web property. And then you're authenticating. You're not going to get tricked into clicking on something else. If you get into that habit, that's going to protect you Fastly.

Yeah, exactly. So even if you're at the wrong site, it's like, why isn't this going to pop up? And that's really important.

Yeah. And just think about, all the time that you save with that too, because if you're manually typing in the URL, the things that you frequent throughout the day, all those seconds and minutes add up. So it's like shortcuts on your desktop. It's kinda like a shortcut to get to the applications that you need to use in your line of business.

Yeah. I will say one of my favorite things about it is really gamble to create unique passwords. I think sometimes that's what gets lost a little bit. Is that. A lot of times we say, oh, I have this one strong password. So I'll use it here and here from my most secure accounts. But really all you're doing is leaving a potential vector point where someone can now hack one and get access to all. And that's really something that I really like is that set of 16 character random password for this site that I'm going to use twice in my five-time problems. And now I feel secure knowing, okay, if something happens I didn't really have anything secure there anyway, and that's only one password. One pass was lost. Everything else is still. I said, it's really something. I think that gets lost. Is that uniqueness backwards from creating passwords?

Yep. Absolutely.

And I think also what's interesting about this Morgan Stanley attack is that it was actually from, vishing not fitting. So that means that somebody called and was able to trick someone at Morgan Stanley to give over their password. And log-in credentials over the phone, which, a lot of times right now there's a lot of phishing emails. It's easier, right? It's a lot easier obviously to send out emails and just to call. And I think actually, because of that right now, I wouldn't be too surprised if there's maybe a reemergence of vishing because it's pretty good tactic, you don't get a lot of those, hackers are lazy, they're smart, but they're lazy. They want to get as much as they can. And so usually sending an email is much faster with that,

Obviously anybody can go and open a fake Gmail account. So it's super easy for a hacker or bad actor to go and send a bunch of emails. But I think the problems that they're having, or they're going to spam or getting caught by some of these phishing filters. So if they do that at the phone level, most likely they're going to get through. So they're going to it through either life or they're going to get through on voicemail. And I think that's why they're using that vector point. And then, moving on to smishing too with SMS texting, the response rate or the open rate for a text message versus an email. It's exponentially higher. I don't know what the exact stat is, if somebody texts you versus emails, you're more likely to open the text. And that's why we always say never click on any links. Try to not accept calls, auto deny calls out of your contact list and engage your phone provider to help with some filtering options that they have. Those are so important and essential nowadays, but I think that's why they're using the vishing and the smishing angles, because email was just not giving them enough connection,

Yeah. I just want to clear up some details real quick. It said that actually the. Breaches where the result of vishing of social engineering attack, where the scammers impersonated Morgan Stanley, during the call to give it to the target, to hand over their sensitive information. So they were tended to be Morgan Stanley. So I guess it wasn't really Morgan Stanley that was hacked, but their clients.

Yeah, that's a big difference though. So it's the folks that were using Morgan Stanley services being targeted by the bad actors. Yeah. So the Morgan Stanley customers.

I think it said too, that in 2021, Morgan Stanley was the target of a successful attack. So I wonder if maybe they were able to use some of the information they got from that to. Do that, that speculation,

maybe that's how they curated the list that people knew. They knew to, approach.

get it from somewhere.

Yeah.

I guess that would have been an awkward phone call. If they would've done this vishing to someone who had gatekeeper and they would have asked for credentials and they would have been like, honestly, I don't know. And then if I need to get in there and read it to you, you better have a lot of time on your hands. Cause it's a long one.

not only that but they're not going to get it without the token either. So even if you get a password,

yeah, that could have benefited Morgan family in this particular situation. It's interesting, right? Because these are the places that have the budgets for the right solutions. Sometimes maybe I wonder if they get so big and they start to feel like they have all these fancy systems in place, but it doesn't mean necessarily that they haven't neglected something in the corner somewhere. That there's still a way in and sometimes maybe getting big and. Not proudful, but maybe that's the right word. It can yield negative results for you as well. Probably.

what would be cool one day though? And I'm sure Jamel would appreciate this as long as you give us credit, is that if the banks use the tokens for their banking, consumers and customers. So this way, if you banked at bank of America or whatever, name, your bank.com then the bank would already have the partnership with gatekeeper through Petronella, and then they would get tokens for all their users. So the savings would be priceless versus the cost of investment, because now all those consumers have that huge extra wall of protection for themselves. They're quick to issue credit cards for their token, physical card in their hand and a pin number. So why not add a gatekeeper token?

Yeah. Are you listening? Bank of America?

I'm sold.

Just give me credit for that.

Oh, absolutely. I think I've had this nice reporting is proof.

Yeah, but think of that though banks, we talked about in several podcasts and, bank that we worked with, they got tens of thousands of customers. So if you can be a part of that good work to secure tens of thousands of customers, I'm not saying it's a silver bullet, of course, but people were just not good with passwords. It's a fact. Why not be one of the. Spanx in the world to differentiate yourself and use token based proximity, token technology by gatekeeper powered by Petronella

I, to agree with you. I think if they want to be as secure as possible, they have to start thinking of that end user aspect of okay, what can we do? What is the extra mile? We can go as a company to make sure that our people, that bank with us feel secure and we feel that we're going really above and beyond what we can to make sure that data is safe and secure.

But also taking that a step further with the bank and, the cool logging capabilities and the access control domain. The bank's going to know, Hey, my customers logging in from home or, Hey, my customer is trying to log in from, out of the country. You know what I mean? So they can get, geo stats and different logging capabilities to o to know, Hey, this is really my.

Yeah. Good point even more. You can do more secure things in the backend to ensure that, yeah, this is a customer banks us, because this is a bank of America or a Stanley approved token that we know we've issued out.

I would think that could be a negotiation angle for the bank to get a lower rate, maybe on cyber insurance. Be able to offer more perks to their consumers. I know there's FDI insurance and things like that, but, I feel like that's such an old type of insurance and I don't think it's ever been lifted as far as the limit on raising it. I think. I got a hundred thousand dollars to protect your account or something like that. And yeah, that might be great for most people. But my point is that if we enlist technology and security controls like gatekeeper and proximity tokens, and these banks extend that protection at the consumer level, I'd be attracted to that. I would want my bank to use gatekeeper. I use it in my daily work, but my bank doesn't use it so I can use it from my side. But I'm saying I think that would be cool.

a hundred percent agree with. Yeah. I really see a good scenario that situation. instead of just offering the option to implement MFA, in some cases it's no it's requirements. It's how we do our business. It's the most secure way to ensure that both of us are protected because it's not good for either of us, my company, whether they, social engineer, Jew doesn't matter, my name is associated with that incident. it really is something that benefits everyone. Two-fold.

What was the latest stat I think it was $9 million was the average cost of a breach. And I know that it's going to be way less than that to roll out Kiki Petronella. to these banks. Hey, look, if you've got thousands of consumers or customers at your bank, any one of them can have a breach. Look how easy it is nowadays. Look. The good work that you would do by protecting your customers and look at how many more banking customers would trust you to do more transactions. And ultimately it's a win-win.

I think we've laid out a nice case for someone who's listening in.

Yep. So attention all banks, call Petronella first. We'll hook you up with gatekeeper. All right. What other headlines are for the day? Anything else?

Yeah, there was something else. So this is from a day or two ago, but I don't know if you guys have heard of this woman, Jan easterly. She's the cyber security and infrastructure security agency director. And she was on CNN, headline is preparation, not panic, but the head of us cybersecurity on possible Russian cyber attacks. Basically she's saying that the U S government is making preparations in face of a possible Russian cyber attack on us critical infrastructure and businesses.

Wow.

Yeah, you kind of get the impression that they think that there's been a lot of groundwork laid and they're briefing themselves for something that they expect to be coming.

Yeah, I can't say I'm too surprised I think it's may of 20, 20 and 2021 seem to have been just a lot of stuff that one year, but it was, seemed to be that cyber issue that affected the east coast with the gas line just last year. I hope in that time, We've been able to beef up security, but makes more than a half week.

As a species and a collective, we unfortunately seem prone to folly. So unfortunately,

the sad reality is that I would be highly surprised if they actually bolstered their security, sadly, I hate to say that and be that, but most people that suffer a breach, they're still in panic mode from the recovering and the damage control. They don't sadly enlist, cyber security professionals to help them speed up the process of not only remediation, but hardening of their security systems. So I don't know. I guess time will tell, we'll see if we get another pipeline attack or maybe it'll be an electrical attack this time or who

yeah, what's spooky kind of feeling is that they keep talking about this, right? Bracing for these attacks that they expect to be coming and because they haven't come yet, but they're still just as often and frequently talking to. The threat, it then paints a picture that I think they might believe that this is being very strategically calculated, planned out and they're not rushing to do whatever they're doing, but they're laying carefully their framework. And that's where the concern is that it seems like whoever's behind. This is working very patiently and very methodically in a calculating fashion. And it seems like, the government is aware of this and bracing for whatever's coming and each day that passes that it doesn't come is just makes you question how much deeper it's going. And so when they do try to hit that switch, is it going to be a carpet full? And that's, the concern, how deep are they going with this?

I do feel like probably the U S government itself is trying to implement, security measures, but you're only as strong as your weakest link. So if you have all these people in the DIB and we know the people in dev haven't really, maybe some of them have started working on it. But they're still not. Where they need to be. So even if the U S government has the best security in the world, it's still got vulnerabilities because of the DIB.

Yeah. And the dip is defense industrial base. So it's mostly consisting of our supply chain. So all of those folks are obviously looking towards compliance with CMS. And should be already compliant with NIST 801 71 and D farce. But yeah, we're here to help those DIB folks, but sadly, most of them are not as secure as they should be.

If we really step back and just be objective, just from our experience in the last few years, objectively speaking, there's been a real problem with inaction, even in the face of knowledge that this is very serious for the whole nation and every citizen of this nation. And even in that light, there's been a problem with inaction from all the way down, up and up down. And unfortunately, Again, those two words, dwell time come to mind because we know firsthand all the vulnerabilities that are out there in the dead, because we've seen them and we've seen the lack of action. And so following that train of thought, the vulnerabilities are just mind blowing, right? Because our cyber security in the DB is like at kindergarten level and that's a shame and that's truly a shame, And there's not any action being taken to change that. And so with that being said, if you have military level trained hackers, then these are my goodness. Imagine them almost like super soldiers from the cyber kind, that have the high-level hacking ability. And we know that state of our dip, okay, it doesn't take a rocket scientist right. To figure out. And now they've got dwell time. Oh God,

I just feel like it's a ticking time bomb. All Putin has to do is snap his fingers, and then we're going to forget about the colonial pipeline,

that colonial pipeline was our wake up call and we missed it,

it should have been, but it wasn't. And you think about all these water supplies, our electric supply. He knew these people are not where they need to be with the security

And then it makes you wonder what's really going on though. I'm sorry, but if I can just speak candidly, it begs the question, what is really going on because at the high levels, they know more than we do about the level of risks, right? We're just a private cyber from small guy. we're not privy to classified info or anything like that. And we know very well, the level of risk. So that means the ones that the high up levels they know even better, the level of risk. Why have they not been on breaking news? Here's what tools you need to get ASAP. Hurry. Redcoats are coming type stuff in the streets. You know what I mean? Why have they not? Why? What is really going on here? What is the ultimate plan?

Did you guys watch the don't look up movie?

Yeah.

guys didn't watch that with lead art. Okay. It was really big. It was on Netflix. It was basically a media is hitting the earth and these astronauts found it Leonardo DiCaprio's the teacher. And then Jennifer Lawrence is the student that found it They go to Washington DC and try to warn everybody and nobody takes them seriously. And they're like, are we crazy right now? a meteor is about to destroy the earth and nobody's doing anything. And it almost feels like that right now. something is going to happen.

but here's the thing that's crazy though. Outside of that is there's still no regulation around to finding the boundaries of cyberwar. So if Russia strikes us, what happens are we at war? that still has not been defined. I just don't understand.

probably impossible for them to define because there's been so much meddling in those waters over the years, by all parties involved

is it going to take though?

that's a great question. They have committees on that and they can't decide,

I personally think our country likes the freedom of being able to do this I wouldn't say, I guess this gray area, they being able to move in it's I don't think it necessarily by defining it Yeah. It limits adversaries, but also limits us.

You're right. Because we've all seen Edward Snowden.

Yeah but remember when the gas prices started going up from I remember from 87 cents and that it started going to, dollar 50. And when it did that in a short period of time, people were freaking out, oh my gosh, I can't afford $2. If we're going to have another issue or were at risk for another issue, like colonial pipeline, look at the gas prices. Now there are about $4 at some areas it's $7, what is it going to take? And at what level is it going to get to before, people don't put up with it anymore. And then what happens if you go to turn on your water and it doesn't work anymore because of a ransomware attack, at what point in time. Are we at war with the nation that's attacking us

That's a good point because right now the reason that we're not quote unquote involved invasion is because we don't want to start a nuclear war.

not only that, but because Ukraine is a part of NATO too.

Yeah, but Iraq wasn't part of NATO near, there was Afghanistan.

Yeah, but if you, crane was part of NATO, then we would be involved in the war because that's the whole point of NATO to join forces and one another

and that's what you Curry was trying to do. And that's why they got attacked was because they wanted to join NATO.

I don't know, I'm not a NATO historian but don't you think that NATO needs to be updating their cyber policy?

Oh, God NATO should be enforcing proper cyber hygiene.

But then that begs the question. That's what I'm saying. Like somebody NATO together, nation states need to get together and figure out the solution to this. Because let's say we modernized NATO where we all have a treaty, and if somebody that attacks one country will then get cyber attacks from all of NATO. Let's say that happens. That would, I would think. Probably stomp out the potential of a fire from an adversary, because if they think, oh, I'm going to attack this NATO country, and then I'm going to get attacked by 20 countries that are part of NATO. I'll probably not do that.

Seems like that sounds great on paper, but after levels we've reached of unsustainability. I think the underlying. Is that all these world leaders deep down understand we've reached a level of unsustainability with these problems because when you have super powers that are already meddling In the background with cyber war over the years, quietly and anonymous. And then you have nuclear powers these parties that are involved. And then we reach an escalated crisis. We're now an active military crisis. Now it's okay, where do you go from here? You have nuclear weapons and cyber war. What is a possible solution here? Like it's unsustainable.

Yeah, but also the current state would, cyber is not sustainable because if new cyber weapons are developed, that'll knock out water supply as well as electrical and or gas. You're going to kill more people than if you dropped a nuclear bomb, because all these people are going to starve and they're not going to be. The necessities that they need, right? So you have a whole nother, more powerful, potentially worse than nuclear, because now you don't have all the tight controls over who can launch it because it's a free for all. And then we've got the issue with the satellites

Oh, and speaking of that, Craig, sorry to interrupt you, but you should know this before you go on Elon Musk. You know how he's involved in the satellites and Russia. Right before the war started, Russia was about to launch one web, a global satellite internet system that the British government was largely invested in while they can feel that launch, supposedly because of the British government being in bed. But then Elon Musk took up that contract and he's launching the one website of lights, but he put out a statement recently and he said that Russia and China could very easily attack his satellites if they chose to.

Yeah, that's what I was going to bring up again. When are we going to get to a point where we actually have military operations happening to protect our properties and satellites in space? Because right now, I don't know if you remember the debate, I think there was an American astronaut on a Russian ship or something like that, where there was a speculation around, are they going to let. The American home there was a joint collaborative effort between Russia and America in space. And with this whole conflict escalating with tensions, there were some banter going back and forth around, oh, we can blow up your satellite or we're not going to let this astronaut come down. I don't know if you guys remember this, but my point is that if we currently have. And adversary that is putting us at risk of us losing our communications. At what point do we police our satellite systems? You know what I mean? Are we going to get into the star wars now?

Yeah. It's interesting you say that Craig, because everybody expects change, be announced on an Intercom system, right? Hello guys. We're now in a star wars situation, But it doesn't happen that way. Things change creeps up on the species. We're obviously in some type of a war that's obvious they're fighting over global satellite. Internet's.

So is that an act of war though?

But even if it is an active horse, so then what Craig, so then what does the United States act? And then what Russia newts. And it's. not sustainable. None of it is. As you guys know, I'm a firm believer. I think autonomous AI is going to have to by the law of probability and the law of how necessity is the mother of invention. I do think autonomous AI will have to act as sci-fi as that seems tell me another solution I don't see another one.

I think it'd be really interesting for us to go into this a little bit more. I just looked it up is a cyber defense as part of NATO's core task of collective defense. And it does affirm the international law applies in cyberspace. But then the enduring challenge is the evolving nature of the cyber threats, obviously. I'm sure it's hard to keep up with that, but I think we should, look into that a little bit and see what they say.

Yeah.

and then also analyze what they don't say, what is, and what isn't, what could rush do without fear of major repercussion and starting aside, or nuclear

Yeah. And then it's social complicated, right? Because. Craig's asking really smart questions about all this. What are the policies and stuff, but then you have to step back and question we're just average people, right? We're just citizens. We're not the elite rulers of this world. And then when you start to think about, yeah we might not be normal, but we're definitely not the elite rulers of this. Even if we were authorities upon the earth, we wouldn't be elite rulers of the earth because these headlines here say that Google assistant sent me this article. It says Bilderberg wholly. And it names two politicians who joined the billionaire boat club. And this Bilderberg club is real. It's not a conspiracy theorist thing. It's real. They have meetings. They have summits and they're tied to NATO, a lot of the heads of Nate or in this thing. And they're all elites, right? With lots of money in super yachts, who are gay and what do they know and what are they really up to? Why do all the billionaires have super yachts? And why are they all invested in space companies? Why is that a common theme with elites and billionaires? I don't get it. What's going on here. Is this a war that's far above our heads?

I think it's more or less just supremacy. I think They just want to be ahead. They have the resources to stay ahead

They all engage in space companies. And I guess that's a possibility, right? That you get so much money, you get so powerful that you just don't know what to do with it because you can only shop at Walmart so much. So there's okay. I guess I need a superyacht and then I guess I need to explore space because now my bridges are too big for earth,

What's comical though, is everybody wants to go to Mars or wherever planet. And leave earth but my point is, there's no economy there. So it's okay, you get this fancy rocket and you go to Mars or whatever but you've got dirt to look at and you look around and it's not like you have a grocery store or anything to do there. You're in solitary.

pulling their resources to fix earth instead of a steep, are all from somewhere else. And are they all aware of the fact that autonomous AI might rise up and squash them and are they all trying to flee for that reason? That's just something to consider as a possibility because they all seem to want to get away from here pretty quickly.

You guys should really consider watching don't look up that movie. That really good

I watched captain Marvel last night and that's all I needed to see.

We should probably wrap up.

Yeah.

Yeah, let's do some research into the NATO cyber war stuff. And let's talk about that. Cause that sounds pretty cool. but Jamelle, thank you so much for joining us again. It's always a pleasure having you can I ask a question real quick, Gemma to Jamel before we go? One thing that I was curious about, so when you have people contacting you, what is their main reason for contacting? I imagine it would be something for compliance insurance. They had something happen to them. Or what is their usual motivation?

Honestly, the main reason is they're tired of typing passwords. We thought compliance would be the easy thing, but it turns out it got to stoke people's lives in this back that you kinda got to stoke the ability people, honestly they know they need passwords, but they're just looking for easier way to manage them these days. That's ultimately what we're hearing the compliance. Those do come into factor, but but the real thing is they just need help managing all these.

Yeah.

Yeah, and it's great. Like I said, I use it all the time and definitely if you're interested contact us and we can get you set up with them as some good rates too, we have vendor, no prices.

our great partners, like gatekeeper. We work hard to get the best rates possible, so definitely reach out to us and we'll get you set up. Awesome. Thank you, Jamal. I appreciate it. Definitely tune in again soon.

absolutely. Thank you.