We're sunsetting PodQuest on 2025-07-28. Thank you for your support!
Export Podcast Subscriptions
cover of episode Did You Hear About the Latest Rip-Off? Non-Fungible Tokens! How Law Enforcement Tracks Bitcoin!

Did You Hear About the Latest Rip-Off? Non-Fungible Tokens! How Law Enforcement Tracks Bitcoin!

2022/4/22
logo of podcast Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

AI Deep Dive AI Insights AI Chapters Transcript
People
C
Craig Peterson
Topics
Craig Peterson: 本期节目讨论了 NFT 的投资风险,指出 NFT 的价值与传统艺术品不同,其数字特性使其易于复制,缺乏内在价值,投资需谨慎。同时,节目还揭示了比特币并非匿名的真相,执法部门可以追踪比特币交易。此外,节目还讨论了网络安全威胁,包括 FBI 未经许可清除设备中的恶意软件、俄罗斯支持的僵尸网络攻击、匿名者组织对俄罗斯的网络攻击、Microsoft 对俄罗斯域名的查封以及利用 QR 码进行的网络钓鱼攻击等。节目还分析了勒索软件的演变,从最初的简单加密到后来的数据窃取和破坏性攻击,并建议用户采取相应的安全措施,如更新软件、配置防火墙、定期备份数据等。最后,节目还介绍了 CISA 提供的免费网络安全服务和工具,并强调了多因素身份验证的重要性。

Deep Dive

Key Insights

Why are Non-Fungible Tokens (NFTs) considered a risky investment?

NFTs are risky because they often lack intrinsic value and can be easily replicated digitally. For example, Jack Dorsey's first tweet was sold as an NFT for $2.9 million, but its value dropped significantly when resold. NFTs primarily offer bragging rights rather than tangible ownership, making their value highly speculative.

How is Bitcoin not anonymous despite common misconceptions?

Bitcoin transactions are recorded on public ledgers, making them pseudo-anonymous. While wallet IDs are used instead of personal information, transactions can still be traced back to individuals through wallet numbers and transaction records. Law enforcement has successfully tracked Bitcoin transactions in multiple cases.

What is the FBI doing to combat malware on private devices?

The FBI has used search and seizure warrants to remove malware from private devices without the owners' explicit approval. This includes disrupting botnets created by Russian government hackers, where infected devices were under foreign control.

Why should users be cautious with QR codes?

QR codes can direct users to malicious websites, especially when they use shortened URLs like Bitly. Scammers are embedding QR codes in emails, tricking users into scanning them and potentially exposing their devices to hacking or malware.

How is Russian cybercrime linked to a single office building in Moscow?

Russian ransomware gangs have been traced to the Federation Tower East, a prestigious skyscraper in Moscow. American researchers and the Biden administration have identified this location as a hub for cybercriminal activities, with millions of dollars in ransom payments flowing through it.

What are the risks of using WordPress for websites?

WordPress sites are vulnerable to supply chain attacks, where third-party plugins or code can introduce security flaws. Recently, millions of WordPress sites were forced to update to patch critical vulnerabilities that could have allowed attackers to download full backups of the sites.

What free cybersecurity tools are available from the government?

The Cybersecurity and Infrastructure Security Agency (CISA) offers free tools and services, including known exploited vulnerability databases and multi-factor authentication recommendations. These resources are designed to help individuals and businesses improve their cybersecurity defenses.

Chapters
This chapter explores the rising trend of Non-Fungible Tokens (NFTs), questioning their value as investments. It uses the example of Jack Dorsey's first tweet being sold for $48 million, then resold for a fraction of the price, to highlight the speculative nature of NFTs and contrasts them with traditional investments like art.
  • NFTs offer ownership of digital assets, but lack intrinsic value.
  • The resale value of NFTs can plummet dramatically.
  • High-profile NFT sales don't guarantee future value.

Shownotes Transcript

Translations:
中文

Jam packed today. We're going to start with non fungible tokens. If you don't know what those are, this is a very big deal because so many people are investing in them right now. Are they really investments? I've got a bit of a blowback here. Most people think that Bitcoin is anonymous. We're going to talk about how it absolutely is not. We're going to talk about anonymous. In fact, the Russians, Microsoft, what they're doing against the Russians and this little comedic thing about cars.

NFTs are a very big deal. I'm going to pull up here on my screen right now. This is a picture of Mr. Jack Dorsey. We'll go full screen. An article from a website called Coindesk. Coindesk is one of these sites that really tries to track what's happening out there in the Bitcoin community. Of course, nowadays it's much more than Bitcoin.

We're talking about all kinds of different currencies that have a blockchain back end. They're called cryptocurrencies basically. But the big one was, of course, Bitcoin. And there is a whole concept now when we're talking about things like cryptocurrencies and these non-fungible tokens.

People have been investing in them like crazy. People are making millions of dollars every week. Now, remember, I am not an investment advisor, and particularly I'm not your investment advisor. So take all of this to your investment advisor. I'm not telling you to buy them. I am telling you to be cautious here, though.

Because these non fungible tokens are designed to give you the ability to be able to just own something in the digital world. What might you own in the digital world? We've had a lot of different stuff. We've seen some just crazy monkey things. Have you seen those, these little pictures of monkeys? They're they're graphic designed and it's all animated. If you will, it's like cartoons.

And people pay money for them. One of the things that people paid money for was the rights to the first tweet ever on Twitter. So that's what you're getting when we're talking about an NFT, a non fungible transaction. It is now yours. So this particular NFT we're talking about was of our friend here, Jack Dorsey. We'll pull it up again, this article.

And he had a tweet that was sold last year for $48 million.

That is a lot of money. So people look at this as an investment, but it's not the same as hanging art on the wall. You've got a Picasso that has some intrinsic value. It's a painting. It has oil paints on that. It was designed by and painted by a crazy man years ago.

And you can take that Picasso and you can turn it around and sell it. It has some real value. If you own the rights to something, let's say it's one of these monkey pictures. It reminds me of a postage stamp and you paid real money for it. Some of these things are going, as I said, for over a million dollars.

And this Jack Dorsey first tweet went for $48 million. So let's say that's what you did, right? You bought this thing for $48 million. What do you have? Really, what do you have?

Because anybody can go online and look at that tweet. Anybody can print it up and stick it on a wall. Anybody can go out and get that picture of the monkeys, right? The guy drew. And you can look at it. In fact, I can pull it up right now if you wanted to see it.

But people paid real money for that. So they've got what really, what do they have? You can't take it off the wall like your Picasso and sell it right. Or Banksy. If you're into the more modern art, it's just not what is doable. How, how do you make this work? Owning the NFT only gives you bragging rights in reality. That's what it does. You have bragging rights.

Because you could take that digital picture and make a hundred quadrillion copies of it. Yeah, you'd still own the NFT. You would still have in the blockchain for whatever NFT company you're using the rights to it. They would say that you owned it. So let's talk about the blockchain behind it. There are a lot of companies that are trying to give you that blockchain.

Okay, all right, I get it. Yeah, I get to own it. But who's running the blockchain behind it? Who's validating that you own it? With Bitcoin and many of these other blockchain currencies that are out there, there are various ways.

Companies and individuals who are registered, who have all of the paperwork, if you will, saying who owns how much of what and who paid who and everything. And that, by the way, is why it takes so long for some of these Bitcoin and other transactions to occur. But how about the NFT? There are tons of companies out there that say they will certify the NFT.

So it gets to be a real problem. And when we get into this Jack Dorsey tweet and this article about it, which I will, let me pull it up again here for you guys. This guy, Sina Estavi, bought the very first tweet ever from Twitter founder Jack Dorsey for $2.9 million last year. And he decided that he wanted to sell it.

So he listed it for sale.

Again, at $48 million last week. Real. He put it up for open bid. And this article on Coindesk is talking about that. And you can see that if you're watching me on Rumble or YouTube. I'm showing you my screen here right now. But this Iranian-born crypto entrepreneur named Sina Estavi purchased it for $2.9 million in March 2021.

Last Thursday, he announced on Twitter, where else, that he wanted to sell this NFT. And he said, hey, listen, I'm going to put 50% of the proceeds to charity. The auction closed. This was an open auction. People could go and bid on it. And that auction closed today.

with an offer of basically $277 at current prices when this article was written. $277 and the lowest bid was $6. And as I recall, this is not in this article, but there were only a handful of bids. Like when I say a handful, I mean like a half a dozen bids. It's crazy. This is a real problem.

Because the deadline is over. He paid how much for it, right? How much did he pay? Pull that up again. $2.9 million last year. And his highest bid was in the neighborhood of $280.

Isn't that crazy? So did he get money on this? Did he win money on this? I don't know. I'm looking at this saying, is it worth it to buy something like that? You might think, oh, the very first Apple computer, an Apple One.

Well, that's going to be worth some serious money. Yeah, it is. It's something you can grab onto. You can hold onto it. It's something. And you can sell it. You can trade it. You can take a picture of it. You can't make digital copies of it. It's a physical thing that's worth something. Same thing with that Picasso on the wall. It's really worth something. It has some basic intrinsic value.

Jack's true tweet the very first tweet. How much is that thing worth? It basically nothing so the tweet is showing he'll pull it up on the screen again that he's selling at Jack 2006 03 21 at 8:50 14 p.m. Just setting up my Twitter. So there you go. There's Jack his very first tweet

And it's absolutely amazing. All right. Is it worth it? Let me pull up some other stuff here for you guys. I'm going to pull this up. Here is Coinbase launching an NFT marketplace in hopes of appealing to crypto and mainstream users. So here's some examples from NFTs. I'm going to zoom in on this for those of you guys watching on Rumble or on Twitter. I mean, actually, you can see it on Twitter, too, but YouTube.

Here you go. Here's some NFTs. It's artwork and it's a creature. So you can buy creature number 7806 right now.

for six ETH. So let me see value of six Ethereum is what? Ethereum to US dollars. So for $3,084 as of right now, you can get a crappy picture that even I could have drawn, okay, of this guy. And look at all of the work this artist has put in. There's how many of these up here? One, two, three,

four, five, ten of them. And it's the same head each time. It looks like it's almost the same eyes. He changes colors and he's got different backgrounds. It's absolutely nuts. So that's what they're trying to do right now, trying to sell these NFTs. So who's going to buy that? Who's going to pay $3,000 for artwork that Hunter Biden could have done with a straw blowing ink around? Here's another one.

This is from Ledger Insights. NBA's launching dynamic NFTs for fans. Baseball cards for the NBA that are basically just worthless. They're NFTs, non-fungible tokens. It has taken the crypto world by storm and people are losing millions as you look.

But it really is changing the e-commerce world. Bitcoin, blockchain, all of the rage. A lot of people are talking about it, but I gotta say most people who are talking about it don't know much about it. And when it comes to anonymity, Bitcoin is probably the worst thing you could possibly do. It's amazing.

There are a lot of misconceptions out there when it comes to technology, almost any kind of technology. And blockchain and Bitcoin are examples of a very misunderstood technology. Now, I'm not talking about how does it work? How are these ledgers maintained? How does this whole mining thing work? Why has China backed?

Why are a lot of countries going away from it? One country now, the dictator said, yeah, we're going to use Bitcoin as our official currency in addition to the U.S. dollar. What's going on? It is complicated.

behind the scenes. It's complicated to use, although there are some entrepreneurs that have made some great strides there. I saw a documentary on what has been happening in that one country I mentioned where they are able to pay in US dollars using Bitcoin.

So they'll go up to a vendor on the street, quite literally, they'll have their smartphone with them, the vendor has their smartphone, they type in 15 cents for the taco and hit send, it goes to the other person and they have 15 cents worth of Bitcoin.

By the way, these types of micro transactions with the way Bitcoin is structured behind the scenes, make things even less manageable in the Bitcoin world than they have been in the past. And that's why in case you didn't know, Bitcoin is making some major changes here fairly soon. They've got to change the way all of this ledger stuff works because it takes too long to record and authorize transactions.

And these ledgers just get way too long when it comes to all of these kind of microtransactions. So there's stuff going on. Bitcoin, there are many of these types of currencies out there. Ethereum is one. You've heard about Dogecoin because, of course, that's Elon Musk has been talking about and many others.

And they're all different somewhat, but the main concepts are that one of the big concepts, I'm going to pull an article up here on the screen for those watching on YouTube or also on Rumble. But this is an article from our friends at Wired Magazine. And I have subscribed to Wired for many years. This particular one is about what Wired is calling the crypto crisis.

trap now that's a very big deal it is a trap and it's a trap in a lot of different ways that's what we're going to talk about right now crypto is not what its name implies

A lot of people look at it and say, oh, crypto, that's cryptography. That's like the German Enigma machine in World War II and all of this new great crypto that we have nowadays. And there are some pretty amazing new cryptographic technologies that we've been using.

But no, that's not what's really going on. You see, the basic premise behind all of these technologies is the concept of having a wallet. And this wallet has a unique identifier. It has a number assigned to it.

So if I'm sending money to you, I'm going to have your wallet ID, your wallet number, and I'm going to now send you some amount, a fraction, most likely, of a cryptocurrency. Certainly if it's Bitcoin, it's almost certainly a fraction.

So I'm going to send you $100 worth of, let's say, Bitcoin. What ends up happening now is these ledgers, which are public, are all going to record the Craig sent you message.

a hundred dollars worth of Bitcoin. Of course, it's going to be in a fraction of a Bitcoin. So sometimes there's rounding errors. It's not going to be really exactly a hundred dollars. Plus there's the amazing amount of volatility, volatility in the cyber currencies. So even though I meant to send a hundred dollars, it might end up being 110. If it goes up, it might be 90. If it goes down, you get that and you understand how that works.

So the problem now is I have sent you $100 and public ledgers that anyone can gain access to now say wallet number 1234 sent $100 to wallet number 5678. Obviously, the wallet number is a lot longer than that.

So that's fine. And there's a degree of anonymity there. It's really called pseudo anonymity because in reality, it's not completely anonymous because people know the transaction occurred and they know the wallet numbers, correct? It's like a bank account. If I put money into your bank account, that bank account number knows that the money came from a check that I wrote. Can you imagine that someone writing a check?

And that check, I had a number on it, a bank account number, right? So it can all be tracked. Well, much the same thing is true when it comes to cryptocurrencies. These cryptocurrencies are in public ledgers, and those public ledgers can be used with a little bit of work to figure out who you are. So this article here from our friends at Wired gets really hairy.

And it might be of interest to you to read, but this is talking about a takedown that happened. And this is a massive takedown. This takedown was of a whole group of people who were involved in some really nasty stuff. In this particular case,

what it was Kitty just a terrible thing and the abuse surrounding it so this article goes into not a lot of detail I'm not going to read it because here on the air because I don't want to upset too many people because it's some of the details of this even to think about them are incredible but

The police broke into this middle-class suburb home in the outskirts of Atlanta and there was Homeland Security. It was a guy from the IRS and they came in, they took all of their electronic devices, they separated the family, putting the father who is an assistant principal at the local high school, assistant principal.

And he was the target of this investigation. So they had him in one room. They had his wife in another room. And they put the two kids into a third room. And they started questioning him. Now this is part of a takedown of a, as I said, a whole ring of these people. Including this assistant principal.

at a school. Can you believe that? So this IRS guy had flown in from Washington, D.C. to have a look over what was going on. But this agent from the IRS and his partner, whose name is, let's say his name was Janaskowski. I probably got that wrong. And Tigran Gambarian. And they had a small group of investigators and they were at a whole bunch of different federal agencies, not just the IRS. But

What once seemed to be untraceable was no longer untraceable. Now, I've talked on the show before about a lecture I went to by the Secret Service about how they had tracked down and shut down the world's largest website that was being used to sell illegal materials online.

And it's fascinating what they did. But frankly, they're calling this particular bust a proof of concept. And that's why the IRS was in on this as well.

But it was huge. So here's a quote from the IRS agent in this Wired magazine article. He's saying he remembers how the gravity of this whole thing. Let me pull this up on the screen too so you can read along here. But this was a high school administrator, a husband and a father of two. Whether he was guilty or innocent, the accusations this team of law enforcement agents were leveling against him

Their mere presence in the home would almost certainly ruin his life. And he, as well as these other people, were counting on anonymity from Bitcoin. Now, obviously, I'm glad they got taken down. But listen, folks, if you think that it's safe, that it's anonymous, it ain't. Bitcoin just ain't there. CraigPeterson.com. Stick around.

I've been blamed for really complaining about people not updating their software. And that includes things like firewalls. The FBI has stepped in and they are going ahead and doing updates for you.

What should we be doing as a country? People are not updating their software. They're not updating their hardware and particularly their hardware. Take a look at what's been happening with the firewalls and the firewall concerns. Everybody has some sort of firewall. Well, almost everybody, but enough people that we can say everybody has a firewall.

You get your internet from you name it. And because of the fact they're using something called NAT, Network Address Translation, they've got some sort of firewall in front of you. So for instance, you've got your phone, right? You're using your phone and it's got internet on it. You're going through whoever your carrier is and that carrier is giving you, you know,

Internet access, right? They don't have enough IP addresses, particularly IPv4 in order for you to get your very own unique little address out on the internet. No, they do when it comes to v6, things a little bit different, but your device is not completely exposed on the internet. Windows comes with a firewall and by default, the windows firewall is turned on. Now this gets more than a little concerning because

Because that firewall that's turned on isn't really doing anything. Because they've got a firewall turned on, and yet every service is accessible from outside, which is defeating the purpose of the firewall. Again, it's a complaint I've had about Microsoft now for decades, which is they have features that are just checkboxes. Yes, yes, it's got a firewall. Yeah, it's turned on. A

but the features don't work. So having a firewall and having everything open defeats the purpose of a firewall. Macs do not have a firewall turned on by default, but they do have their services disabled.

which is just as effective, if not more effective. So one of the things we advise people to do is go into your Windows system, into the firewalls and your security settings and turn off any services that you're not using. If you're not sharing file systems, then turn that off. In other words, like you're mounting the G drive or whatever you might call it from another computer, then you don't need it.

If you're not a server for what's called SMB, then you don't need to share it. So turn off everything that you don't need. The worst that's going to happen is one of your programs isn't going to work right. And what you did last year, you're going to turn it back on.

And you can do a lot of research online to find out what they are. We have over 200 settings that we change in Windows when we get a customer. Now, on the Mac side, you can turn it on. I like turning it on. I like turning off the ability to see my machine. So, in other words, the ability to be able to ping it.

So I turn it on and I enable specific services. And again, you can do some research on that. I've got an improving Windows security course that people have taken. And we should probably do that again, if not just have some free webinars on how to do this. So you guys can learn how to do it, but not that hard to do. Anyhow, bottom line is...

People aren't updating their computers, even the Macs and Windows. We have a client that we just started, a new client, and we're tightening things up. And we've been finding Mac computers that are major, multiple major revisions behind. And that to me is shocking because everybody,

Apple Macs are just so easy to update. It is extremely rare that an Apple update will make your computer break. Unlike in the windows world where it's pretty common. So windows guys, I can understand, but you're even more exposed. You're a bigger target. You need to keep up to date. So how about all of the other equipment that we have?

I've had warnings again and again with you guys about what's happening with our smart devices that are out there, right? Our security cameras we have up in the corner, right? We have these smart thermostats people are using. The list goes on and on of all of this equipment that we're using that is exposing us because when was the last time you updated it?

How about the firmware in your router or your Wi-Fi? Some of the devices that I recommend to people, and if you have any questions, just email me, [email protected]. I can give you recommendations, even if you're a home user, although my business obviously is working with businesses.

on what kind of wifi to buy, what you should get, what you should do. I don't charge for any of that stuff. Okay. You get it, but you have to ask [email protected]. So you get this information and you go ahead and you buy whatever it is, but you don't keep it up to date, which is why I tend to only recommend stuff that automatically updates.

But that also means every few years you're going to have to replace it because unless you're using the good Cisco equipment where you can get a seven-year life out of it, you're not going to find that in consumer-grade equipment.

So what's happened here? I'm going to pull this up on my screen for people watching this on YouTube or on Rumble. But here is a thing that came straight out of our friends here from the FBI. This is from CISO. This is a magazine that I do follow. But they're talking about what they call Cyclops Blink-18.

The article says, for the second time in a year, the FBI has used search and seizure warrants to clean malware from devices owned by private businesses and users without their explicit approval.

The FBI used this approach to disrupt a botnet believed to be the creation of Russian government hackers. So they're calling this Cyclops Blink malware discovered earlier this year.

So here's the problem. What do you do if you're the federal government? How do you try and keep your country safe? Now, we know we've got these military contractors. They make missiles that take out missiles, right? They provide defensive systems. You've heard of Iron Dome from years ago all the way through all of the current stuff.

That's what they do. But what do they do? What can they do when there's a botnet? A botnet is where there are multiple computers in this case, probably tens of thousands of computers located in the United States that are acting like sleepers. They sit there and they wait for commands as to what they should do. Should they try and attack a machine? Should they try and spread more malware? What should they be doing?

And these things are vicious. They are absolutely nasty. And in this case, we're looking at Russian malware. So Russia effectively, like the Americans, you might remember that TV show. It was a great show. But it has...

Computers that are owned by you and me and our businesses and government agencies that are under the control of the Russians. Now you don't even know it. You're using your computer, you're playing games, you're going to Facebook, whatever it is you do on your computer. Yet your computer is under command and control of the Russians.

So the FBI goes to a court and says, hey, we've got to go ahead and shut this down. We need a warrant. They get the warrant. And the search and seizure warrant lets them now get onto these machines that are part of the botnet or the controlling machines for the botnet and either remove the malware or

or go ahead and take control of the botnet themselves so it can't be used. And by the way, our friends at Microsoft, they've gotten involved in this too, which is really, frankly, cool in shutting down some of these botnets. Hey, I want to encourage everybody,

Take a couple of minutes. Go to Craig Peterson dot com slash subscribe. That's Craig Peterson, C-R-A-I-G-P-E-T-R-S-O-N and subscribe. And I'll be sending you a special report on passwords plus two more. I send out the most popular special reports that anybody has ever asked for.

Hey, I've got a little bit more to discuss on what's happening with Russia and Microsoft and more. But I'm also going to talk about QR codes. There is a great explanation that's in your newsletter from Monday about why you shouldn't trust them. Let's finish up this Russian thing and

And then we're going to get into why you cannot trust QR codes and a brand new way the bad guys are using QR codes to really mess with us. Now, if you're watching over on either YouTube or on Rumble, you'll see this. Let me pull up my screen for you.

But here we go. So this is very interesting. In the last segment, we talked a little bit about what our friends over at the FBI have been doing, which is they have been removing malware from people's computers because people haven't been keeping their computers up to date, right? Part of the botnets that we explained.

Well, the FBI isn't the only one out there trying to stop these Russians and the hackers. Anonymous has been very big at it. In fact, let me pull up this other article. This is from Security Affairs. And here we go. And it's talking about this whole army of these anonymous hackers. Now, anonymous have been a nightmare for many businesses that they didn't like.

All right, anonymous will go ahead and they'll do usually pretty basic stuff. They'll do denial of service attacks, some other things. So they don't like you because they don't like the don't say gay bill in Florida. And without bothering to do any research, they'll just start attacking organizations that support it or organizations that don't support it depending on how they want to do it.

So this is an interesting article here because it's talking about these very websites that they've hacked. Now, some of them are government sites and some of them are private industries. Now, one of the cool things, bad things about hacking private industry and releasing the emails

is now the competitors to these businesses know what they're doing. And in some cases, there's proprietary technology that's being released. Now, when it comes to Russian proprietary technology, the Western world doesn't care a whole lot about some of it. But here are some examples of what these hacktivists have got at. This is a company called Forrest.

37,000 emails stolen from the company, Russian logging and wood manufacturing firm. Again, it would give you a little bit of an idea into the whole Russian, what are they doing in the forest industry? This one I think is a little more concerning for the Russians, Aerogas.

This is an engineering company that focuses in the oil and gas industry. Their clients include a whole bunch of Russian companies. They've leaked approximately 100,000 emails from Aerogas.

That is a huge deal because so much of the country's revenue, the number one industry in Russia, is oil and gas. Petrofort, one of the largest office space and business centers in St. Petersburg,

The hackers have leaked approximately 300,000 emails from PetroFort. Again, you can use that to find out what's happening in their economy. What are they doing? How are businesses doing? Are they going to go under? So you can see some tweets here. I've got them up on my screen on YouTube and Rumble. Anonymous, what they're saying that they've done. And you can follow Anonymous directly on Twitter.

particularly fond of them. They've done a lot of things that I disagree with. But this is really telling us about a whole new approach to warfare. Right back in the day, you and I couldn't get involved. We could potentially take up arms and go and fight, right? Think about the Spanish-American War. Think about what's happening now in Ukraine, where Americans have just...

gone over there and taken up firearms in order to help defend Ukraine. People who are maybe of Ukrainian descent, maybe not, right? But we have never seen this type of involvement by average citizens because anonymous is not like some big fancy company or government agency. Anonymous is a bunch of people

who are trying to be anonymous and do something. So they stole 145 gigabytes. Look at this. It's just crazy. So here's the anonymous Twitter thread itself, right? Talking about what it's absolutely incredible. So that's what anonymous is up to. They are hacking Russia and they're hacking Russia in a big way. Now, next up, we have our friends at Microsoft.

Microsoft has been seizing Russian domains that they are accusing of having been linked to.

to these Russian hackers that have been going after think tanks and government agencies in the US and the EU, I should say, which I'm sure includes the UK because the UK has gotten involved. So this article from The Verge is talking about how Microsoft has seized seven domains

belonging to Fancy Bear, APT28, which is, we've seen them active in a number of companies here, right in the Northeast, the United States. These companies who are trying to provide materials, software, hardware for government contracts, right? So they're not even direct providers.

government contractors for the feds. They are just subcontractors. And then we've seen fancy bear in there. We've seen the Chinese in these companies. It's incredible. They have no idea that all of their intellectual property is being stolen, which is why the federal government has started cracking down on contractors and subcontractors.

and this whole paragraph 7012 thing, we're getting geeky here, but companies that have to protect even unclassified information, confidential, unclassified, and they haven't been. So Microsoft,

a court order. You can see this on my screen over at YouTube and at Rumble to take control of each domain on April 6th that then started redirecting them to a sinkhole. So what they do is they take control of the DNS for the domain. So

So the root name servers now point to a Microsoft named server and then send them to a sinkhole. A sinkhole is basically nowhere. You go there, there's nothing on the site, right? Or in this case, also servers used by cybersecurity experts to capture and analyze malicious connections. And they'll do that.

Oftentimes when we're talking about these botnets, like we talked about a little earlier today. So apparently they're trying to establish long-term access to the systems of the targets.

What did we just talk about? Long-term access? Botnets, right? That's what botnets are. So Microsoft has gotten involved. They've been doing this now for a little while. It's obviously not their normal business model, but it is something that they've been doing. They were also, by the way, the fancy bear linked to the cyber attacks on the DNC in 2016, and they also targeted the U.S. election in 2020, which is why, part of the reason why, anyway, it's like,

don't use electronic equipment for our elections. Have paper ballots, have people count those ballots. Yeah it takes longer. You can't have the instant thing on TV which is why all of these news services say oh don't do that that's ridiculous. But it's the only thing we can guarantee that these guys like I got it up on the screen again

Fancy bear, the Chinese, etc. It's the only way they can't get in. And if we were doing paper ballots and we had bipartisan people counting the ballots and independents counting the ballots, observing this.

We wouldn't have all of these problems that we had with the last election where people were saying it was stolen. It was hacked. How do we know it was stolen? How do we know it wasn't stolen? Go back to paper ballots, get rid of the scanning machines and particularly get rid of these electronic voting machines where you touch the screen to cast your vote. Those things are ridiculous.

Ridiculous. What if there's a software bug in it? How can you go back and change the vote? People have complained about it again. And wait a minute, I voted for this guy and yet it recorded my vote for the other guy. It's ridiculous. Anyways, back to QR codes. Okay. I'm going to pull this up on the screen because I think this is a cool article here. This is from actually a site over in India. It's called scroll.in.

And they're talking in here about how hazardous it can be

to use QR codes. Now, they're not saying don't use QR codes. We've all had to use them. I've got up on my screen this picture of being at a table and you scan the QR code in order to get the menu, in order to order. I did that. I was in Vermont and we were riding motorcycles. A buddy and I were going to the little tiny restaurant, small restaurant, and it had a half a dozen tables and they didn't have menus. You scanned it.

The QR code that was there on the table and you placed your order and off it goes. A lot of places they've been doing that with menus. You've seen that more and more saves them money as well and lets them change their prices more frequently. Yeah. Thanks for that inflation guys. But why shouldn't you use these QR codes? Why should you be extra careful? Here's the answer.

QR codes are the URL of a webpage. That's the bottom line. Would you click a random URL that came in an email? Would you click on a random URL in an ad or on a webpage? We certainly know better than to click URLs in our emails, but that's exactly what the QR code is. And on top of it,

The URL in a QR code tends to be what we call a shortened URL. So it might be bit.ly, so it might be bit.ly slash and then some random characters. How do you know where it's going to take you?

You don't. All you know is it's going to take you to Bitly, but that Bitly URL could be sending you to a malicious site. And now your phone could be hacked. It could be using your phone for Bitcoin mining for who knows what. So be very careful. And the bad guys are using these in a different way that you might not have seen before, which is they are embedding QR code graphics into emails.

And they're thinking that people are going to hold up their phone to the email. And what are they going to do? They're going to scan the QR code that was in their email. And now they're in trouble.

Yeah, that simple. Hey, visit me online, CraigPeterson.com. Make sure you sign up for my newsletter, CraigPeterson.com slash subscribe. Of course, CraigPeterson, S-O-N.com. And I'm going to send you my top three special reports. Absolutely free. We've got to take care of these bad guys.

This is a big deal, quite literally a big deal. Russian malware. We have been able to track it down now, track it down to a single site. Yeah, all of these bad guys are in one building in Moscow.

Hi, everybody. Of course, you're listening to Craig Peterson. Thanks for taking a little bit out of your day today as we continue to really talk about the stuff that's most important in the world. And there could be nothing more important, I think, than some of our cybersecurity, our lives, our fortunes, etc. That's what we have to pay attention to.

Well, this is a very big story and it's a bit of a scary one as well. We've had a lot of ransomware over the years and a lot of ransomware. Have you said it yourself? I bet you if you haven't someone who has had ransomware because frankly, it is pervasive in every aspect of pretty much everybody's life out there.

So when you get hit with ransomware lately, something a little different has happened. It's really gone through three phases. The first phase was the ransomware would get onto your system. Usually it came as an attachment, probably embedded in like a word file. It's been embedded in PDFs, embedded in all kinds of stuff. Even drive by downloads on websites have brought malware in.

But in this case, yeah, it was annoying. It was a problem. It would give you a red screen. You've probably seen it before warning about the ransomware and it told you, okay, here's what you can do to get your files back.

And in order to get your files back, you usually would have to go to some exchange online, take dollars by of course, Bitcoin or some other cryptocurrency. And then that cryptocurrency would be used in exchange now for you to get a key that would hopefully decrypt everything. And in reality, it often didn't decrypt hardly anything at all.

So it's been a problem and a problem for a lot of people. The FBI said that at the time, so this is Gen 1 of ransomware, you were lucky if 50% of the time you got all your data back.

Gen 2 of ransomware is when the bad guys started getting a little bit smarter. They didn't just take your files and encrypt them and then say, hey, pay up, buddy. What they did at this point is they got onto your systems and they poked around. They went, we call in the industry, east-west on the network. So they got onto maybe your kid's computer network.

Maybe you were hooked up via VPN to the office to do work and it wasn't a great VPN and the kid's computer had that virus and that virus weaseled its way all the way over the VPN directly to the office. Because remember, VPNs are a network.

in that, yeah, okay, it's encrypted, and so someone who's got a wiretap isn't necessarily going to get anything. But it's a VPN. It's a tunnel. And that tunnel was used many times for malware like ransomware to creep over to the office network. That's been east-west. It's going from one machine to another machine. And in businesses, man, you saw that one a lot as that ransomware moved around. So that was the second one.

So the ransomware got on the machine. It would then look for files that it thought you might not want to have exposed.

So it looked for files with bank account numbers in them, social security numbers, maybe intellectual property. We saw a lot of that theft is continuing to go on primarily from the Chinese and then an intellectual property theft. What happened next? Well, of course, it ended up moving the data, the files, and then what they would do.

is encrypt your disk. So before they encrypted your disk, they got copies of all of the stuff they thought might be important to you. So now the threat was in version two of ransomware, pay up or if you don't pay up,

You are going to have to pay us to not release your file. If you didn't want all of that client information online, if by law you would get nailed for having that client information out online. And that's true in most states now. And the federal government's been putting some teeth on some of their laws as well. Then what are you going to do? Yeah, you paid the ransom. So that was version two.

Version three that we're seeing right now of ransomware is simply destructive. And if you go way back in history, you remember I got hit with the Morris worm, which was one of the first pieces of nastiness out on the internet.

And that was early 90s. My business that I owned and was running got hit with this thing. Even before that, there was nastyware, viruses, if you will, that would get on the computer and destroy everything. It was just malicious. As I remember, somebody at UC Berkeley, some researcher, and he didn't like what the researchers were saying about him. So he put some floppy disks together and

on them he put this erasing malware and shared all of the stats with anybody and of course you plug that disk into your that little floppy disk into your windows computer and it says okay i'm going to go ahead and open it up and oh look at this a virus let's run it and so he then wiped out the computer of everybody else that was a competitor of his out there in the industry

Yeah, a little bit of a problem if you ask me. So how did that end up getting around? What ended up happening? Well, everybody got really upset with him. Nobody really found out what was happening, who did it, etc. That's what's happening now.

So version three of malware is like some of the very first malware we ever saw version three of ransomware. So some, again, some of that very first ransomware was pretty nasty. It's not the sort of stuff you want to see running destroying files, but at least you could get back from a backup. Nowadays, a lot of people are doing backups by attaching a disc directly to their machine, or they're backing up to another machine on the same network.

Remember that whole east-west thing? You didn't want the data going back and forth. It caused problems. Yeah. So what happens now? The Russians apparently are just trying to cause havoc with businesses. Anybody who has decided that they're going to be anti-Russian in any way, they're attacking.

So they'll erase your disks, they'll erase all of your data. If you have backups on that thumb drive or that USB external drive, they're going to erase that. If you have backups on another machine on the network, hopefully from their standpoint, they'll be able to get onto that machine and erase all of your backups, which is again why we like 321 backups at the very least. There's some others that are even better.

And if you're interested, send me an email, me at craigpeterson.com. I'll send you a webinar that I did on this. I'm not charging you for that, but it was a free webinar to begin with, but a webinar on backup and how to back up properly and why to do it this way. Again, me, M-E, craigpeterson.com. Be glad to do that. What we're seeing now is,

is a huge problem let me see if this is going to work for us yeah okay it is i am by the way live here there we go on my computer so people who are watching can see my desktop so here we go

This is Russian companies who are linked to this Russian malware ransomware are hiding in plain sight is what they're calling it. So what does it mean to hide in plain sight? Well, in this case, what it means is.

Money that's been paid by American businesses to these Russian ransomware gangs, some of who, by the way, are actively going after anyone that criticizes Russia, found these American researchers that it led to one of Moscow's most prestigious addresses. You can see it up here on my screen. This is a New York Times article.

It's just a random act of journalism, people. Sometimes even the New York Times gets it. And they're saying millions of dollars have gone through this. So they've been tracing. Where did they go? The Biden administration has also apparently zeroed in on the building. It's called Federation Tower East.

It's the tallest skyscraper in the Russian capital. How would that be to have a business and just this beautiful tall skyscraper and have a view that would be really cool. So they have targeted some companies in the tower as what it's trying to do is stop the ransomware gangs, right?

made in cryptocurrencies. Russian law enforcement usually has an answer to why don't you just shut down these bad guys that are out there trying to steal all of our money. They say there is no case open in Russian jurisdiction. There are no victims. How do you expect us to prosecute these honorable people? That apparently is a quote from this Massachusetts-based cybersecurity firm.

called Recorded Future. But I'm looking at a picture. It's up on my screen right now. You guys can see it. But this is the Moscow Financial District called Moscow City, 97th floor, Federation Tower East. This is really pretty. You wouldn't know this isn't like London or any other major European capital. There's some cranes in the background building up new buildings, buildings.

The cybercrime is really fueling some growth there in Moscow, which is, if you ask me, the exact reason why Vlad is happy as a clam to just go ahead and have these Russian cybercrime guys just go and bring money in, right? Money is bringing in great money for them.

The Treasury Department, by the way, has estimated the Americans have paid $1.6 billion in ransom since 2011. One ransomware strain called Raya committed an estimated $162 million last year. It is really something. Let me tell you.

So when we come back, we've got a lot more to talk about. We're going to talk about the cloud. If it's more secure, why is the cloud broken? If masks work, why aren't they working? Anyways, we'll talk about that when we get back. And visit me online, CraigPeterson.com. Stick around.

I hate to say it, but there is another big scam out there right now, and it is hitting many of us, particularly the elderly, quite hard. We're going to talk about that right now, what you can do about it, and how you can recognize when it's happening. Interesting article that came out this week in Wired. It's actually in Wired's, let's see, what is it? Yeah, March 2022 issues. It wasn't this week. Never mind.

And it's talking about a serious problem. I'm going to show you guys who are watching. I have this on Rumble, YouTube, Facebook as well. So you guys can see along. And of course, right here too. Now, let's not forget about that.

But this is an article that says we were calling or excuse me, they were calling for help. Then they stole thousands of dollars. I'm going to read parts of this article. It's just amazing. It's by Becca Andrews. Back channel. What is that? Okay, so that's just a category.

On December morning, one December morning, my mother's phone rang. She tugged the iPhone from the holster she kept clipped to the waist of her blue jeans and wondered who might be calling. Perhaps somebody from the church who was checking in on her recovery from coronavirus. Hello, she said. The voice that greeted her was masculine. This is just great writing. The caller sounded concerned and he told her something was wrong with her Amazon account.

Somebody has access to your bank accounts through Amazon and they can take all your money. I'm calling to help. Her mind raced. Oh Lord, she prayed silently.

The voice was warm and reassuring, and my mom tried to focus closely on his words. My dad was driving to work in his truck, and she was home alone. She'd been cooped up in the house for weeks with COVID, isolated from her community, and she missed the balm of a friendly voice. I just love her language here. It's just phenomenal. She tried to steady herself. The man said he needed to make sure the money was safe.

He transferred her to a different male voice, again, soothing, reassuring, calm. She promised not to hang up. A brain injury decades earlier made it hard for her to follow his instructions, but she stuck with it.

The voice explained slowly, carefully how to swipe and tap her phone until she had installed an app that allowed him to see what was happening on her screen. Now he followed her every move. After some hours, she mentioned she had to relieve herself hours.

"'It's okay. I'll stay on the line,' he said. She parked the phone outside the bathroom and picked it back up when she was done. As noon approached, she told him, "'I have to eat. I'll wait. It's okay. Don't hang up. We'll lose all our progress.' She set the phone down on the counter to make a sandwich, then pulled some chips from a cabinet and patted over to the kitchen table."

The phone buzzed with the text, it was my father checking in. She typed back that there was a problem, but she was fixing it. She had it all taken care of. She tapped the tiny white arrow next to the message field to send her reply, and then she heard the voice, its volume elevated, it sounded angry. She frowned and brought the phone back up to her ear. Why would you do that? You can't tell anyone. What if he's in on it?

She felt confused. That didn't make any sense, but she also didn't fully trust herself. She was worn out from her slow recovery and the steroids she was taking as a treatment gave her a hollow buzz of energy. Now I want you guys to go have a look at this over on Wired site. Read the whole article. It is a phenomenal, absolutely phenomenal. But what it's doing is telling the story of this woman who

who was trying to do the right thing, trusting other people, which many of us do. I have a default trust with a little trepidation. I will admit that. But with the whole lockdown thing that happened...

Many of us have just been longing for a little bit of companionship. And to hear a stranger who's trying to help out, that's a huge plus. It goes on in this article and talks about how reassuring these guys were and what they did. It's

She installed this cash app and opened up PayPal, downloaded Coinbase, set up Zelle so she could send money directly from her bank account. She doesn't know about any of these things. It's just incredible. So the afternoon wore on and the guy said, hey, we're almost done. And her husband, of course, was on his way back and the sun was down. The father got home. He noticed right away that something was off.

And she said, she took care of it. And he said, you took care of what? I'm not supposed to tell you, it said. So the scammer had siphoned away all of her personal information. The scammers had her social security number, date of birth, driver's license number, and about $11,000. These new financial apps like Zelle and others that are legitimate, PayPal apps, right? Zelle you can use to send money legitimately to someone else.

But it links into your bank account. That's why I don't like them. I have a friend that's been pushing me. Oh, this app, it's great. It saves you so much money on gas. Look at how much money I've saved. And he sent a screenshot of it. And I went online and had a look. And guess what? I read reviews. It again, like this, tied into her bank account directly. And what can happen? Like here, everything was emptied.

So in the next few months, this author, this story and her father tried to undo the damage. Very frustrating. Getting scanned, of course, is really dehumanizing and it just breaks your trust in other people. How could someone do something like that? It's just incredible. You've got to go through the stages of grief and everything.

She talked to people. She said she got chilly half replies or just as often silence when she was calling around.

Trying to find someone with some empathy. Okay. It's just incredible. Great article. If you can still find it, the March issue of Wired. I'm sure it's available online. This goes on and talks about her mother's seizures getting worse. And of course, now they don't have the cash that they had been saving. And it's just very depressing. Now, I had this. You might remember about a year ago, I talked about it. I had something like this happen to a friend of mine.

And I'm still not quite sure what happened, but it looks like it was a password spraying or password stuffing attack. And they got into the app that his company uses to pay people. And sure enough, they got in and they directed his next two paychecks to their own account, which went right out of the country like that.

These are bad people. And how do you deal with this? It's incredible because if you've got someone like her mother who has mental problems due to no fault of her own and is a very trusting woman, what do you do? She's walking around all day with her phone on her hip. That's how we started this out. Do you take that phone away from her?

That would be dangerous, frankly. So this is a very problem. They had a USAA account. It was her bank account. USAA is usually good about this sort of stuff. In fact, my other friend had USAA as well. But they did help deactivate Zelle.

But they didn't do anything about the $999 that were transferred through it. Very bad. So they figured out maybe we should change our passwords. She had them change them. And if you would like information about password managers, again, I'm not selling anything. I'd be glad to send them to you.

If you sign up for my email list, you're going to get them automatically. CraigPeterson.com. I've got a bunch of data information I want in your hands. It talks about the free stuff, talks about the paid stuff, none of which I'm selling you. CraigPeterson.com. Sign up right there on the top of the page. Thanks. Stick around.

We've had some serious supply chain attacks over the last couple of years, and they have caused all kinds of problems for tens of thousands of businesses. If you use WordPress, there was one of those this week.

We have had supply chain problems like you wouldn't believe. So let's start out by explaining what is a supply chain problem. And in this case, we're narrowing it down to cybersecurity because we've had supply chain problems from everything from our toilet paper

to the food we eat. But what I'm talking about right now is supply chains when it comes to cyber security. And one of the biggest problems we had was a company that's supposedly providing cyber security for businesses, right? Some of the biggest businesses in the world.

And I'm looking at an article right now from Security Boulevard saying how to protect the supply chain from vulnerable third-party code. It can be a script that's downloaded online. It can be an open source library. We've seen big problems with GitHub lately and pulling in libraries. We've seen big problems with what are called containers lately, which are little mini containers

versions of computers with all of the software there, all ready to go, ready and roaring to go.

All kinds of supply chain issues for a very long time now. And these supply chain cyber attacks have been hitting some of our cybersecurity companies really the hardest. I'm pulling this up on my screen right now. If you're watching this on Rumble or on YouTube, and you can see links to those, by the way, in my emails that I send out every week, craigpeterson.com.

Craig Peterson dot com. But you can see here supply chain hits cybersecurity hard. Supply chain security is not a problem. It's a predicament. That's an interesting look because we have to use some of the supply chain stuff, don't we?

CISA, the FBI are issuing cybersecurity advisories because of the Russian attack over on Ukraine and in the U.S. The weakest link in supply chain security, fears of rising fuel. CISA, FBI, NSA, international partners issue advisories. Toyota stops production after possible cyber attack at a supplier. Isn't that something? This goes on and on. So,

What's a guy to do, right? Many of us are using websites in order to run our businesses. Heck, we've got websites for our soccer team, for the kids. We've got websites for pretty much everything that's out there today. And those websites need software in order to run. So the basic idea of the website is nowadays you're using a content management system. They're called CMSs.

And there have been a lot over the years. I've used quite a few myself off and on. This is very interesting though, because this particular piece of code is code that runs a website. I'm going to show you this article from Ars Technica here on the screen. But it's talking about millions of WordPress sites that got a forced update to patch critical plugin flaws.

So when we're talking about supply chain, in this case, we're talking about something called WordPress, right? And this WordPress software, as good as it is, can have bugs. So WordPress is the content management system. So you load stuff up into it. In fact, I'll bring up my site right now. So I'm going to bring up the craigpeterson.com site.

And on my site, I have all kinds of stuff, which is why it's so slow to load. I've got to fix that one of these days. But this is an example of a WordPress site. So you can see right at the top of the site, I've got watch this week's show, Jobs What's Up. Of course, that was last week. You can watch it on Rumble or on YouTube, and then it's got my latest show. So if you click on one of these, here you go, and you can listen to it.

It starts right out here. See? Ta-da. So there you can listen to my podcast right there on the site. And I've got an automated transcript of it. It's for you, depending on what you want. It's got links over here to take you to iTunes or YouTube or Spotify or SoundCloud or iHeart or Google Play or Audible. All of these links take you to different places.

And this site, instead of having to program a site in HTML, what we're doing is we're just putting some data in. So we say, okay, I want a default page. Somebody else has already set it up. Somebody else has already got it all programmed. It just works. And it's all right there for me.

Here's some related posts on the side. Here's the most popular ones that we have right now. This is a content management system. And specifically, this, of course, is WordPress. So what happened? Well, if I had a, yeah, and here's what it looks like over on Audible. You can listen for free on Audible.

This is what happened this last week. WordPress, which has this great software that I use and tens of thousands of others use out there, very popular in order to make it easy for me to have my website, probably your business, probably your kid's soccer club, you name it is using WordPress. It's just over the top popular. It is using code that was written by other people.

The reason we can make programs so quickly nowadays is we're relying on other programs.

So we'll go ahead and we'll grab this program that does this part of what we need to have done. And ta-da, we're up and we're running. I just have to write the glue, right, to put it together. The API calls, whatever it might be. Because the idea is let's make it easier for programmers. So you've got something called GitHub. Here, let me pull it up so you can see that. You can go online if you're following along at home to github.com.

And as it says right there on their front page, where the world builds software, that's a beautiful world, isn't it? That blue, you can see the air around it.

And that's what it's doing is where the world builds software. So let's say we want something. What do we want? Let's say we want something to make a chess program. So we can talk about chess. Oh, and it's saying, oh, you have to be able to do this. So I'm just going to skip that for now. But it would come up and tell me, okay, here's all of the chess programs that are out

there and I find one that's close to what I want to do. So what do I do at that point? Well, I go ahead and have a look at the license. A lot of the programs up there have a very open license, so I can just take that code, modify it. And I have a chess program without having to write a chess program.

It's really that simple. That's part of the supply chain. If you bought my chess program, you would actually not just be getting the code that I wrote, which is typically just glue code with maybe some APIs or application program interfaces. In other words, using someone else's code would now make it whose program. It's like the Pharaoh's barge. It would make it other people's programs, not my program. So you got to figure out

What's in my supply chain? I've got a new client. I do work as a virtual chief information security officer. Actually, it's a fractional CISO.

And as a fractional CISO, one of the things I have to do is look at the whole supply chain. Who are they buying even physical things from? And could there be injected into their software, into their systems, something that might be coming from yet another supplier? Man, does this get complicated very fast. But this week...

Our friends at WordPress, they went ahead and forced all WordPress sites to update. Very good. Okay. Otherwise, people could have downloaded a full backup of the sites that are out there. Something you really just don't want to happen.

Anyways, go right now, CraigPeterson.com, while the bits are still hot, and sign up right there, CraigPeterson.com, for the newsletter and get those special reports that are going to get you started. This is the moment you've been waiting for. We're going to talk about free cybersecurity services and tools.

tools that you can use. Now you have to be a little bit of a cybersecurity expert to use them, but not much. This is from the government.

This is, I think, an amazing thing. This only came out within the last few weeks. I have it up on my screen. There we go. Right now, for those of you who are watching on Rumble or YouTube, you can see it right there. Free cybersecurity services and tools from the Cybersecurity and Infrastructure Security Agency, CISA.

Reminds me of Marvel with shield, that really long name that came up with an acronym for as though they weren't aiming for that acronym in the first place. But there are some tools that you can use. There's tools that I use as a cybersecurity professional, and some of them are obviously going to be pretty darn complex.

And if you're looking at my screen right now, or if you want to go online at CISA.gov slash free dash cybersecurity dash services dash and dash tools, or just look it up online, you'll find this on my website as well. I'm going to try to make sure I get that up today.

But what they have done is they're showing you what they call their key or their known exploited vulnerabilities. Okay. And this is where they are showing the CVEs, which are the, frankly, these are the ones that I use. It is published by NIST, which is the National Institutes of Standards and Technology, and

And this gives all of the details. So this is CVE 2021-27-104.

Okay. And this is detail. And of course I would be using detail and it's telling you here's the advisories. There's one from GitHub. Accelion has one. Here's the weaknesses, the known software configurations. So you can find where they all are at and everything. So all of the details. So they're telling you about that. These are the ones, this was in the vendor product.

project, I should say. So we'll look at the data added to catalog. Here are a few in Cisco right now. So this is their small business series of routers, which we do not use for anyone because they don't provide the type of security you want, but Cisco is taking care of the problems, right? Many of these update themselves.

Here's Microsoft Windows installer contains an unexpected unspecified vulnerability, which allows for privilege escalation. A lot of stuff this week. This is crazy.

Apache Tomcat, which I am never been a fan of and problems. So all of these came out on March 3rd and more, right? So this is just page one. So let's look at page two here. Oh, wow. More Microsoft Excel exchange server.

Some more Cisco vulnerabilities. Why Cisco? Why Microsoft? Because they are, frankly, the big boys on the block. Why do you rob the bank? Because that's where the money is.

So they list all of those right here. CISA does. They're warning you to use multi-factor authentication. I don't want to sound like a broken record, so I'm not going to say use multi-factor authentication today. I just refuse to say use multi-factor authentication. And this one talks about what it is, right? Many names. Now, they're trying to make this simple statement.

But really, a FIDO key, fast identity online, considered the gold standard of multi-factor authentication. Well, for online it is, websites, but not for others. So how would you know that if you weren't an expert? So yeah, this is the government talking, right? And they're here to help.

So they have the service. So what do I do, right? Me, Mr. Idiot. I click on this and they are talking about the service that they've got. I'm showing it up on the screen. It's called CISA Insights. And they're talking about website defacement, destructive malware, not pet you, want to cry, right? All these things. What can you do to prevent it? And they make it sound easy. Now, I want to say something here.

Because I have a couple of mastermind groups. And in one of my groups, I rescued a group member from a $40,000 loss. And so I was explaining it in our next mastermind meeting because everyone wanted to know. What should I do? How should I do it? And they all tuned out. And I thought I was being simple enough. I was trying to be simple. Not like...

Simple Kamala Harris explaining that Ukraine is a country beside right next to another country called Russia. And that's why there's an invasion. Okay. I couldn't believe that. Did you guys hear that?

It was just incredible. But I didn't get that simple. And I know you guys are the best and brightest and you're trying to figure this stuff all out. And that's why you need to make sure you sign up for my email list right now because I do have simple step-by-step stuff. And these tools that they're talking about and services are supposedly available. Now, I went to a bunch of these places.

and I tried to get some services. So they said they'll do a free scan of the network.

So I filled it all out. And according to their standards, my company, because I do cybersecurity for everything from government contractors through dentists and manufacturers and distribution companies. So I fit the critical infrastructure definition and I have never heard back from them. I check my spam box at least once a week looking for their reply. So I don't hold up a whole lot of hope.

but there is some good information here that you can get email via social media via just all these different types of things that you could use for it and again i want you to look for it online it's on cisa.gov if you go to their home page you'll see their tools they've got a shields up warning right now on their home page

because there have been so many attacks coming from China and coming from Russia, but particularly Russia. And you can see their StopRansomware.gov, which has some great tips, particularly for home users and small businesses. The CISA Culture Hygiene Services website.

that they have, doing business with CESA and careers. They're looking for this as part of Homeland Security.

So there's a whole lot that you can do and you can find. But I want to let you guys know that this is out there. A lot of this stuff guaranteed is going to be above 98% of people's heads out there, just in general, even IT professionals. So look for information that's going to help you that's on your level.

And to that end, we have right now three things. If you sign up for the email list or if you're already on my email list, you can just email me at CraigPeterson.com or just hit reply to any of my emails and I'll see it and ask for them. But we've got stuff on Instagram.

your computer, keeping it secure, keeping your password secure, comparison between using a one password manager or using LastPass, which I am not advising to use right now, but that's in there. There are a lot of different things that are there that are ready for you to get right away. And then if you have other questions,

I've got dozens of little special reports that I've written in response to people's questions. Don't be afraid to send them to me at, you know, me at CraigPeterson.com and I'll make sure I get you an answer because it's that important.

Okay. I'm not here trying to sell you something. I am here because most of you guys can, could never get my services. You don't need them. You can't afford them, whatever. I'm a fractional CISO. I'm one of the guys that keeps the cybersecurity working and alive for businesses. It's not going to be everybody, but it's, it is, there is, I should say a lot of information you guys need and need to understand. And I want to help you.

okay i think i've beaten that horse enough and it was probably passed dead but you'll find some of this stuff on my website at craigpeterson.com i've been working on some other changes to it i would also ask you guys if you're hearing part of the show today i know a lot of people who are listening on the radio or tend to be out and about in their cars listening on the weekend i listen to a lot of radio then

But go ahead and subscribe to either my podcast, and there are a lot of ways to do that. And I showed those people who are watching on video how to do that. And if you would, give me a five-star rating.

On whatever platform you're using. Hopefully I've earned that. And then also, if you'd like video, I have my whole show up. It's like about an hour and a half long on multiple platforms. So rumble.com rumble, R U M B L E is a competitor to YouTube.com.

So if you don't like censorship, if you want a site that is trying to keep that information out there, get it out there for you. Rumble is your place. You'll find all kinds of interesting characters there other than myself. Right. A lot of conservative people go there to rumble.com.

I have it up on YouTube as well because YouTube isn't the worst platform in the world. They're also not the best, but they are the biggest. Did you know YouTube is the second largest search engine in the world? Okay. They have a lot of people on YouTube.

And then on Facebook as well. You'll find me there on Facebook, of course, Craig Peterson. I had YouTube, excuse me, facebook.com slash Craig Peterson. And I didn't use it for a long time because I hated Facebook. Just I looked at it as a time sink that I just didn't need. I got a lot of stuff to do. I got a lot of people to help. And so I didn't really do anything with it until somebody else got the slash Craig Peterson. But I do have a trick for you.

If you go online with your web browser to CraigPeterson.com, that's my website, slash YouTube, it'll take you right to my YouTube page, or CraigPeterson.com slash Facebook. Guess what? To your Facebook page. CraigPeterson.com slash iTunes slash SoundCloud.

etc. It'll take you right to my page on all of those sites. And have a look at the video. Let me know what you think. I would appreciate that feedback. And make sure you tune in on the radio too. It's great. Don't watch this while you're driving. They're taking the kids to school. A lot of people listen to this while they're taking the kids to school on podcast. Anyways, take care. Thanks for being with us.