Épisodes

  • Gold bars and bold lies.

    Gold bars and bold lies.
    Jun 19 2025
    Please enjoy this encore of Hacking Humans. On Hacking Humans, ⁠Dave Bittner⁠, ⁠Joe Carrigan⁠, and ⁠Maria Varmazis⁠ (also host of N2K's daily space podcast, T-Minus), are once again sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines to help our audience become aware of what is out there. First we start off with some follow up, our hosts share some more information on VIN swapping, and a clarification on bank participation in FinCEN. Maria shares a telling tale about a Bethesda couple loosing $367,000 in gold bars to a sophisticated scam involving fake officials and elaborate deceptions, but a police sting led to the arrest of a suspect, highlighting a growing nationwide trend of elderly victims targeted by gold bar fraud. Joe's story comes from KnowBe4 and is on DavidB, their VP of Asia Pacific, thwarting a sophisticated social engineering attack via WhatsApp by recognizing inconsistencies in the impersonator’s behavior and verifying directly with the colleague they claimed to be. Dave's story comes from the FBI on how criminals are exploiting generative AI to enhance fraud schemes, including using AI-generated text, images, audio, and video to create convincing social engineering attacks, phishing scams, and identity fraud, while offering tips to protect against these threats. Our catch of the day comes from a listener who received an urgent email from someone claiming to be an FBI agent with a rather dramatic tale about intercepted consignment boxes, missing documents, and a ticking clock—but let's just say this "agent" might need some better training in both law enforcement and grammar. Resources and links to stories: ⁠“VIN swap scam costs Las Vegas man $50K, new truck"⁠ ⁠FinCEN⁠ ⁠Gold bar scammers claimed hackers could fund Russian missiles, police say⁠ ⁠Real Social Engineering Attack on KnowBe4 Employee Foiled⁠ ⁠Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud⁠ You can hear more from the T-Minus space daily show ⁠here⁠. Have a Catch of the Day you'd like to share? Email it to us at ⁠hackinghumans@n2k.com⁠.
    Voir plus Voir moins
    46 min
  • Managing online security throughout the decades.

    Managing online security throughout the decades.
    Jun 12 2025
    This week, our hosts⁠⁠⁠⁠⁠ Dave Bittner, ⁠⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠⁠, and ⁠⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠⁠T-Minus⁠⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start off with some more chicken follow up, this week, delving into malware-related chicken names. Dave’s got the story of Brevard-based Health First Health Plans teaming up with the FBI to warn consumers about a nationwide medical insurance scam where victims pay upfront for fake coverage and end up stuck with huge medical bills. Maria shares the story on how a recent April 2025 survey reveals that while most US consumers feel confident identifying scams and rely on traditional security measures like strong passwords and two-factor authentication, many still experience scam attempts and data breaches, with real-time threat detection emerging as the most valued feature in security products. Joe shares a personal story about how he was mildly got, got—tricked, that is—he thought he was filling out a quick survey for a waiter, but it actually ended up as a Google review. It's a reminder of how AI and tech are blurring the lines in everyday interactions, and how easily people can get tripped up by these evolving processes. The catch of the day this week is from the Scams sub-Reddit, and Dave reads a text from a scammer claiming to have information on his doing drugs at his old work place. Resources and links to stories: ⁠⁠⁠ALERT! Brevard-Based Health First Health Plans Joins FBI to Expose Medical Insurance Scam Scams and Protections US Report: April 2025 We make building an app so easy, anyone can do it '700 Indian engineers posed as AI': The London startup that took Microsoft for a ride Artificial Intelligence stories ⁠Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠⁠.
    Voir plus Voir moins
    43 min
  • OWASP software and data integrity failures (noun) [Word Notes]

    OWASP software and data integrity failures (noun) [Word Notes]
    Jun 10 2025
    Please enjoy this encore of Word Notes. Code and data repositories that don't protect against unauthorized changes.
    Voir plus Voir moins
    8 min
  • No cameras, no crew—just code.

    No cameras, no crew—just code.
    Jun 5 2025
    This week, our hosts⁠⁠⁠ ⁠⁠⁠⁠Joe Carrigan⁠⁠⁠⁠, and ⁠⁠⁠⁠Maria Varmazis⁠⁠⁠⁠ (also host of the ⁠⁠⁠⁠T-Minus⁠⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow-up from a listener on class action settlements: they’re a class action attorney and shared that the best way to verify a notice is to contact the law firm listed in the court documents—plus, unclaimed funds don’t go to the attorneys, but are redistributed to claimants. Maria's story is on a listener dealing with phishing calendar invites that auto-add to their calendar—she shares tips like avoiding the “decline” button, adjusting settings to prevent automatic invite processing, and contacting email admins to help block these pesky requests. Joe's got the story on a film made almost entirely with AI tools like Google Veo and Runway—while the results are stunning, the process was chaotic, proving that human creativity, direction, and a lot of trial and error are still essential behind the scenes. Our cluck of the day is from listener Clayton, who writes in with a scam email sharing a fake job about a virtual interview. Resources and links to stories: ⁠We Made a Film With AI. You’ll Be Blown Away—and Freaked Out. AI Will Smith eating spaghetti pasta (AI footage and audio) Just got access to Veo 3 and the first thing I did was try the Will Smith spaghetti test. AI video just took a startling leap in realism. Are we doomed? Impossible Challenges (Google Veo 3 ) Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠⁠.
    Voir plus Voir moins
    47 min
  • OWASP server-side request forgery (noun) [Word Notes]

    OWASP server-side request forgery (noun) [Word Notes]
    Jun 3 2025
    Please enjoy this encore of Word Notes. An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers.
    Voir plus Voir moins
    8 min
  • The great CoGUI caper. [OMITB]

    The great CoGUI caper. [OMITB]
    Jun 3 2025
    Welcome in! You’ve entered, Only Malware in the Building. Join us each month to sip tea and solve mysteries about today’s most interesting threats. Your host is ⁠⁠Selena Larson⁠⁠, ⁠⁠Proofpoint⁠⁠ intelligence analyst and host of their podcast ⁠⁠DISCARDED⁠⁠. Inspired by the residents of a building in New York’s exclusive upper west side, Selena is joined by her co-hosts ⁠⁠N2K Networks⁠⁠ ⁠⁠Dave Bittner⁠⁠ and ⁠Keith Mularski⁠, former FBI cybercrime investigator and now Chief Global Ambassador at ⁠Qintel⁠. Being a security researcher is a bit like being a detective: you gather clues, analyze the evidence, and consult the experts to solve the cyber puzzle. On this episode, our hosts discuss Chinese-speaking threat actors are targeting Japan with a massive phishing campaign using a sneaky new kit called CoGUI, which has hit organizations with over 170 million messages in a single month. The campaign mimics trusted brands like Amazon, PayPay, and Rakuten to steal login and payment info—lining up with warnings from Japan’s Financial Services Agency about attackers cashing out and buying Chinese stocks. While the CoGUI kit is slick with its evasion tricks and browser profiling, your hosts are hot on its trail with new detections to help stop the phishing frenzy.
    Voir plus Voir moins
    36 min
  • Lights, camera, scam!

    Lights, camera, scam!
    May 29 2025
    This week, our three hosts ⁠⁠⁠Dave Bittner⁠⁠⁠, ⁠⁠⁠Joe Carrigan⁠⁠⁠, and ⁠⁠⁠Maria Varmazis⁠⁠⁠ (also host of the ⁠⁠⁠T-Minus⁠⁠⁠ Space Daily show) are sharing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with a bit of follow up, one from listener Aaron, who shares some safety tips for chickens, and from listener Shannon, who writes in with a new fashion statement. Maria’s got the story on how Trump’s sweeping new tariffs are creating the “perfect storm” for scams, as cybercriminals exploit consumer confusion with fake fee requests, shady links, and urgent messages—three red flags experts say to watch for. Joe shares the story of a new FBI warning about an AI-driven phone scam targeting iPhone and Android users, where scammers impersonate senior U.S. officials through fake texts and voice messages to steal personal information via malicious links. Dave shares the story of a classic Hollywood pitch deck scam, where fake agents from bogus production companies like "Hollywood Talent Agency" and "Writer’s Edge Production" lure authors into paying for useless film services with promises of big-screen adaptations. We have our new Cluck of the Day, and this week, Jonathan Webster shares a classic scam attempt: a fake PayPal invoice PDF designed to trick recipients into calling a fraudulent support number or paying a bogus charge. Resources and links to stories: Trump tariffs create the ‘perfect storm’ for scams, cybersecurity expert says — 3 red flags to watch out for FBI warns of new phone scam targeting iPhone, Android users, advises not to answer these messages Senior US Officials Impersonated in Malicious Messaging Campaign The Hollywood Talent Agency / Writers Edge Production Scam Have a Catch of the Day you'd like to share? Email it to us at ⁠⁠⁠⁠⁠hackinghumans@n2k.com⁠⁠⁠⁠⁠.
    Voir plus Voir moins
    42 min
  • OWASP security logging and monitoring failures (noun) [Word Notes]

    OWASP security logging and monitoring failures (noun) [Word Notes]
    May 27 2025
    Please enjoy this encore of Word Notes. The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system.
    Voir plus Voir moins
    6 min