Here’s the full transcript of our very own cybersecurity specialist, Hank “The Hacker” Fordham, featured as a guest on Global News’ A Little More Conversation with Ben O’Hara-Byrne last October 11, 2024 – 8PM PST / 9PM MT.
Ben: As we mentioned earlier in the week on Monday, October, is Cybersecurity Awareness Month and every week between now and the end of October we’ll be focusing on a key topic and letting you know more about it and how to best protect yourself as well. Now the initiative is an internationally recognized campaign, cyber month that is—that’s held each October to help the public learn more about the importance of cybersecurity and it helps Canadians stay secure online of course by teaching them simple steps to protect themselves and their devices.
To help us out this month the team here at A Little More Conversation is teaming up with RBC and they are the proud sponsor of the show for the month of October. Online safety of course is a big part of RBC’s work with its estimated 17 million customers not to mention protecting the company itself from the threats that lurk across cyberspace you can find out about that at rbc.com/cyber that’s rbc.com/cyber.
On Monday we began our weekly segments with RBC’s Chief Information Security Office Adam Evans, and we began by looking at the rise of cyber attacks. How they’re evolving, who’s being targeted, what are hackers looking for, how is that information used, what you can do to better protect your personal data. Here’s some of what Adam has to say.
Adam: It’s all about the next attack. What other information can I get from that individual person or organization, and those attacks just keep on perpetuating that cycle that keeps repeating itself until they have what they need. And then they will launch maybe a large scale attack, and the outcome is maybe fraud, versus collecting more information.
Ben: Adam Evans there RBC’s Chief Information Security Officer speaking on the show on Monday. We thought an ideal way to make this important cybersecurity topic, and that advice really hit home to you, would be to add something. So we do those on Monday’s and then on Thursday’s we go on to even more detail from other folks out there who either know a lot about the topic at hand or who have been victims of some of the issues we’ve been talking about.
My next guest might be familiar to listeners out there. Hank Fordham also known as “Hank The Hacker” is with X10 Technologies and he’s been kind enough to join us to talk about hacking generally and specifically. Hank, thank you so much for your time tonight.
Hank: Thank you so much for having me Ben.
Ben: Tell me about what a red team hacker is because I wasn’t quite sure what it meant.
Hank: So a red team hacker is an ethical hacker who works on a team typically carrying what’s called pen testing engagements. And, these are ethical hacking engagements where they’re basically attempting to make entry to the company either by remote means or by an assumed compromised internal means. And then a report is generally created after that, which recommends and mitigates so that the client can improve their security posture moving forward.
Ben: Right so essentially you have to get into the mindset of a bad-ass hacker to test the systems of the company to let them know where they’re vulnerable.
Hank: Absolutely, I always say it’s never a dull moment
Ben: Sounds it, what are we, we talked a little bit about it on Monday, what are you seeing out there these days. Because it feels like we’re reading a lot more about significant hacking incidents. Doesn’t mean there are more of them out there, maybe we’re just paying more attention to them. But what are you seeing in terms of trends these days when it comes to these sorts of things?
Hank: Well, working in x10 is giving me a unique opportunity through some of our SOC operations actually just to see how some of these attacks are starting to evolve. And, obviously through different partners, that we have like the Gal Senior Care Foundation—I’ve noticed that these attacks are starting to evolve like Adam Evans said, where their gathering more and more information and even using resources like the dark web to collect, you know for example leak passwords, and in cases before I’ve seen where they kind of send an email and say I have your password and demand some form of cryptocurrency payment and we look at that same formula tech now where it has actually evolved into the attackers collecting enough information to not only be able to spoof’s the victim’s email address so that it looks like it’s actually coming from yourself but they actually include the leaked passwords, a full name, and in some cases a picture of a house or an address and they start saying. “I’ve got personal images, or I’ve installed a piece of malware on one of your devices and if you don’t pay this ransom, you basically don’t want to see what happens next” which obviously is a scam.
Ben: So in other words they’re building a sort of dossier on people. I get that this happens much more quickly than I would picture it, but they’re essentially building information, building up this profile of you and then attacking. Which is obviously much harder than the individual to either fight back again, or for people to recognize as not you.
Hank: Absolutely, and it generally works really well when they’re attempting to hoodwink victims into like Adam said into submitting additional information or paying money, or even downloading malware. And it’s no surprise when you look at this evolving threat that in 2023 alone Canadians paid over 567 million dollars just from fraud and cyber crime alone.
Ben: That’s a lot of money, you know, I’ll be honest Hank. I know what a bank robbery looks like, but I don’t really know what a hack looks like. How does it begin, is there a lot of planning, is there a lot of money, I’m thinking Ocean’s Eleven, but it’s not right?
Hank: What we see in most cases and this is kind of something that has been a pattern over the last few years, especially. It generally starts to happen via phishing attacks and this is again where they’re trying to kind of hoodwink you into downloading something, or clicking a link submitting information, and it’s a very like un-Ocean’s Eleven as anti-climactic as that is. But when you look at some of the tools and the ease of access to these tools that are being available. It actually does start to look like a movie, like there’s market available implants that make it very fun and easy to learn some of these techniques.
Ben: So ultimately, when they’re committing the robbery, as you mentioned its information that they are after. That they’re trying to build a profile of you, is that right?
Hank: Yes, in most cases it’s kind of a bulk list. Because they are sending these emails out in bulk, and the interesting thing is the scam where they send you a cryptocurrency address is you can actually look up that address and see how much payments are going through that wallet. And generally in the past you wouldn’t see any payments being actually made. But now that’s starting to happen where people are getting these scams and they’re kind of falling for the context of the scam and sending that money.
Ben: When we read about hacking incidents involving major corporations because we see a lot of them these days, Ticketmaster ,London drug, is that again the same thing, is that targeting the same information? That just a big treasure trove of data, of names, of addresses, and so on that they can or whatever information it contains there that they can take away?
Hank: The London Drug cyber attack is a good example in a sense that the cybercriminals were after that information, I believe it was the information of a lot of employees. And when they get this information , they threaten the company that they’ll release it. So, in some cases you see in a ransom where they attack they encrypt the information and they make it unavailable or halt operations and we see on the other side of the fence where they take the information and they just say if you don’t pay this balance then we’ll release it to the public.
Ben: Right, so there’s a couple of different tactics going on here.
Hank: Yes, and that’s why I think there was a lot of recommendations not to pay ransomware, especially during covid just because if there was data encrypted then you paid the house that data unencrypted there was actually a high chance that they could return and say if you don’t pay an additional fee, we’ll just release the information. I think that’s why it’s important for companies to kind of further develop that cybersecurity plan by having a pen test and introducing monitoring tools like an EDR or a SIM and even having a SOC.
Ben: My pleasure to have Hank Fordham also known as “Hank the Hacker” he’s with X10 Technologies, where of course in the midst of Cybersecurity Awareness Month, we’ve been focusing, or we will focus each week on a different topic around cybersecurity. We’ve been looking into hacking this week so Hank is taking us behind the scenes pulling the curtain away so to speak to give us an inside look on how this all works.
Hank I wonder when you look at most of us use our Data or don’t protect our data properly. I’ve heard it’s often compared to leaving the keys, or in addition to leaving the front door open, is that true, are we negligent from where you sit or how we handle obviously very sensitive and very valuable stuff to people who are willing to break in to get it.
Hank: You know that;’s a good question, and I don’t think its that we are more reckless with how we use data. There’s definitely a little bit of that, definitely depending on how much we use the internet for things like saving passwords. But things are also getting easier, for the cyber criminal. When you look at some methods, or some of these techniques a few years ago would have taken a lot more technological know-how to actually carry out these attacks. But you look at now a days where there’s different platforms with like I mentioned earlier with the implants and hacking gadgets it makes it a lot easier to carry out these attacks and just as an example we look at or think of a story earlier this year where there was actually someone who boarded a plane in Australia and he was using what’s called a Wi-Fi pineapple basically a small device that gives off a fake Wi-Fi network. And he was hoping people would connect to that free Wi-Fi network and enter their credit card or go do online purchases or log in to social media and so you can imagine over that period of a flight how much information this cyber criminal was actually collecting. So I don’t think it’s not that we’re becoming reckless, but that there’s a little more we can do and it’s just about that training and awareness that we are all to that advantage when it comes to a cyber criminal targeting us.
Ben: Tell me about that because of course I’m probably one of those people who I saw free Wi-Fi on a plane, I’d be like oh I’ll use that, which I mean is a terrible instinct. But I suppose those are the types of things we really need, if it’s getting easier for cyber criminals to sort of prey on us we need to be more aware of what it is they can do.
Hank: You know, I’ll admit, I’m the guy on the airplane that’s using the free Wi-Fi too. But, again, just extra awareness and training there’s steps that you can take even if you’re using free Wi-Fi just to make sure that your information is not being exposed and immediately my mind jumps to using multi factor authentication on all of your accounts. And making sure like Adam Evans Said, that the settings inside your social media accounts are configured in a way your multi factor authentication is actually functioning correctly. And if you’re traveling around, then if you’re like me and you like using the free Wi-Fi on the plane it’s definitely worth looking into getting what’s called a VPN. Just so that all of your data is encrypted while you’re browsing.
Ben: You know it always feels like how are authorities doing, how are the folks like you are doing in trying to keep these folks at bay. Because it always feels like this cat and mouse you know, you build a bigger wall, they build a taller ladder and it just goes on and on and on.
Hank: You know I love that you said that its like cat and mouse, because it is, it’s a constantly evolving game and obviously again with working in a security operation center, we run a center where 24/7 we are getting an alert and blocking potentially malicious threats and the methods and techniques are just constantly evolving. So it’s interesting to see these things and definitely fun to be a part of I guess trying to fix them or trying to make things better.
Ben: This is going to sound like one of those questions your dad would ask you, but how much is machine learning and AI change, or how much has it change, or how much might it change, the whole dynamic here that people can sort of program something else to do it for you and just put your feet up.
Hank: I think it’s quite significant and especially when we look at the things like carrying out a phishing attack where one of the pieces of advice a professional might give a few years ago was to look out for things like grammar errors, AI now removes that piece of advice kind of becomes obsolete so we lean towards you know looking for the context of the message. Is it trying to convince you to supply some piece of information or click on a link, and I always suggest to people that, you pause for a moment and, you think and again this goes over kind of to the Gal Senior Care Foundation, with generations assisting loved ones. LIke who are your connections, who do you call when you get that weird email, that’s asking you to send bitcoin or asking you to log in to your bank and because you’ve been locked out. It’s definitely more important to communicate these things.
Ben: I always think of seniors, I guess lots of. I was reading recently that it’s actually younger people who fall victim to these more because they’re more active online but it always feels like those stories of people preying on seniors or seniors showing up buying, you know gift cards and its always really depressing and how do we protect people against that?
Hank: You know that’s a good point because I think I love the theme of cybersecurity month, this month is generation cyber-safe because online security knows no age. We’re all affected in different ways and we all have different kinds of practices when it comes to things like making a strong password or actually following through with using multi factor authentication
Ben: Hank, I appreciate your time tonight. Thank you so much for adding a lot of context to this story
Hank: Oh, it’s been an absolute pleasure thank you so much for having me.
For more cybersecurity solutions, email us to book a meeting with our X10 Technology experts.