122: Lisa

JACK: Here’s a question; what’s the biggest threat facing music venues, sports stadiums,
and theatres?
Well, I don’t know, but I’m gonna go out on a limb and guess, but it’s insider threats.
What I mean is I think there are a ton of people who want to get free entry into all
these places, and they do get in without paying all the time by using an insider.
I’ve seen it with my own eyes; I’ve been to the movie theatre and saw someone pay their
way to go in and then once inside, open up one of the side doors and let their friends
in who were outside.
I’ve also seen the same thing at a baseball stadium; someone was standing outside the
exit and they were just waiting for someone inside to leave, and as soon as that door
opened on the stadium, boom, they grabbed the door right before it closed and went inside
and quickly blended into the crowd.
They just got free entry into a sporting event, all because someone on the inside let them
in.
Insider threats are a major problem that companies have to face.
(INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet.
I’m Jack Rhysider.
This is Darknet Diaries.
[INTRO MUSIC ENDS]
JACK: Let’s start with just you telling us your name and what do you do?
LISA: Okay.
[MUSIC] Do you want me to – are you good to start now?
JACK: Yeah. LISA: Okay.
Hi, I’m Lisa Forte.
I’m a partner at Red Goat Cyber Security, and professionally I run cyber-crisis exercises,
deliver training, and insider threat program development companies.
In my personal life, I climb, cave, and explore abandoned mines.
JACK: So, do you have a degree?
What did you get your degree in?
LISA: So, I did my degree in law and then I did a masters in international law and Maritime
law.
So, I was very legally focused and then decided that – well actually, by accident I got
involved in security and more physical security, and I – that’s how my career sort of took
off and I abandoned law completely.
So…
JACK: Okay, so a degree in Maritime law.
Where did that take you?
LISA: So, I actually got a job working for private security companies, as they like to
be called, putting – you put eventually armed guards onboard ships to protect them
from pirates and fortified the ships to protect them from pirates.
JACK: [MUSIC] Whoa, Lisa’s job out of college was to help secure ships from pirate attacks?
That’s wild.
Apparently there are a lot of ships that need to move cargo past dangerous waters like the
coasts of Somalia.
Now, Somalia has been characterized as a failed state in the past, with insurgents currently
controlling a portion of the country.
There are parts of Somalia that have no organized government.
So, for a while, it was a dangerous area for ships to pass by, since there were Somali
pirates that would try to come and take over the ship.
When a pirate attacks you out to sea, nobody is around to rescue you if you get in trouble
out there.
So, ships were increasingly trying to find ways to protect themselves, but legal questions
started to come up.
Are they allowed to carry weapons and put armed guards on ships?
Well, sure; it’s out there in the ocean.
Who’s gonna enforce laws out there?
But what about when you’re docking into ports in countries where weapons are banned?
Lisa was helping this shipping company navigate the Maritime laws to learn what they were
legally allowed to do to protect themselves.
But this soon got her interested in making their ships more secure, like adding defense
mechanisms to thwart pirate attacks.
She started thinking through all the scenarios of what could go wrong out in open waters
and how to protect against it.
This interested her more than the law stuff, so she moved into the operations side of things,
helping boats secure themselves from pirates.
LISA: And just loved it, and just loved working on security and managing risk.
That’s basically what kickstarted my love of security.
JACK: Yeah, tell me more about this pirate stuff.
What were some of the tasks you were given and what were you doing there?
LISA: It sort of started really in the nineties in the Somalia area, so the Horn of Africa,
as they called it.
It actually started because the Somali people were attacking ships and tackling illegal
fishing that was happening in Somali waters, and it sort of evolved to a point where they
became essentially as sophisticated as we now see ransomware groups in the cyber-security
space.
So, they had – they were running insiders and big insurance companies in Europe, they
were doing OSINT, they were running motherships to have lots of attack boats out on the water.
They were hugely, hugely well-funded; I think at one point it was like $13 billion annually
that they were making.
It was an insane industry.
JACK: [MUSIC] She studied what these pirates were doing, and typically they had ways of
finding out what ship would be passing by and where it was located off the coast of
Somalia out in the Indian Ocean.
Then the pirates would dispatch a few small, fast motorboats, skiffs to catch up to one
of these massive cargo ships.
They’d get alongside of it and throw grappling hooks onboard the ship and climb onboard with
assault rifles.
LISA: So, they’d – they would take control of the ship.
They would get to the bridge, they would take control of the ship, and then they would hold
the ship and its cargo for ransom.
So, that’s how they do it, and then typically that ransom would be paid and they would release
the vessel.
But yeah, it was obviously horrible for the crew.
There were many situations where people were killed, crew were killed from the boardings
that happened.
It’s a very, very difficult situation to be on a ship.
You definitely don’t want to be having a gun battle inside a metal ship.
That’s – you know, there’s not an optimal situation for that.
JACK: Okay, so if that’s the typical attack scenario they’re facing, Lisa had to figure
out ways to straight put an end to these attacks, which would also save lives of the people
onboard her ships.
LISA: When you’re thinking that scenario through, you need to put barbed wire up around
the ship to make it harder to get onboard.
You need to weld internal doors shut in the right order so that you can slow their advance
through the ship if they do get onboard.
We’d also build a citadel in the middle of the ship which would be a bit like a panic
room for the crew of that vessel to go into if the pirates boarded the ship, because obviously
the main priority at that point is to save the lives of the crew.
We’d also put water cannons around the ships, and there was this really cool device that
lots of shipping companies implemented on their ships called an LRAD.
JACK: LRAD.
Well, that sounds intriguing, and you know me; when I’m intrigued, I want to know more.
So, I looked up what LRAD is, and it’s got an interesting origin story.
It was invented because of what happened to USS Cole.
[MUSIC] This is a Navy destroyer, a warship, and in the year 2000, USS Cole was parked
in Yemen, resupplying.
Well, a barge came up alongside it and [EXPLOSION] it detonated a bomb right next to it, causing
a major hole in the hull of this destroyer.
Al-Qaeda took credit for this attack, which was eleven months before 9/11.
So, what the Navy needed was for a way for ships to warn or communicate or to protect
themselves from potential enemies without having to be lethal.
I mean, this was a warship that was attacked.
They could have easily defended themselves by just opening fire on any ship that got
too close, and that’s just not practical to shoot at any ship that gets too close.
So what the Navy wanted was a way to stop other ships from approaching unless they were
approved.
This is why LRAD was invented.
LRAD is an acronym; it stands for Long-Range Acoustic Device.
Simply put, it’s an MP3 player, but with a wicked set of speakers, speakers that can
be pointed in a specific direction and heard up to two miles away.
[MUSIC] So, if a boat is approaching, you can play it a message in whatever language
you have on the MP3 player to warn them ‘don’t come closer or else.’
Okay, so LRAD’s a directional speaker, but it’s also a weapon.
Some call it a sound cannon because this thing is capable of pumping out noises of up to
160 decibels at range.
Your car horn is somewhere around 110 decibels, and I’ll tell you, if you stood right in
front of your car while it’s honking, it’ll start to hurt your ears pretty quick, and
you’ll want to leave the area or cover your ears.
160 decibels is more like a train horn, and if the LRAD is pointed right at you playing
sirens as loud as a train horn, your ears are going to start to hurt and you’re gonna
wanna get out of there.
Even if you cup your hands over your ears, it only reduces it like, twenty-five decibels,
so it’s still uncomfortable.
Even if you put really good earplugs in, well, now you’re pretty much deaf if you continue
to approach.
You can’t talk on the radio or chat with the person next to you, and you really can’t
hear anything of what’s going on.
So, once this technology became commercially available, cargo ships who were passing by
dangerous waters were equipping them to try to push back any suspicious boats that were
approaching, first by giving them a verbal warning in different languages, and then turning
on a siren if it got closer, which would push them away if they couldn’t take the noise.
LISA: It’s supposed to be so incredibly painful if this sound wave hits you that it’s
disorienting, and that was used really successfully because obviously the last thing we want to
use is force, right?
We don’t want to be firing at human beings.
But we also recognize that we had to have that capability.
For the while, pirates were often targeting ships that had no armed guards, and they knew
what ships did and did not have the armed guards on.
So, over time, that became mandatory.
So, we put armed guards onboard the ships that would have – well, for the last company
I worked for, they would have M4 carbines, and they had a whole set of rules of how you
would escalate force with lethal force being the absolute last resort if necessary.
One day it was – I would run these people and they would call it and check in and sort
of tell me what was going on and whatever, and if there was an approach made by the skiffs,
made by the pirates, they would call me on the satellite phone and alert me to it because
the company had to be appraised of how the situation was escalating.
[MUSIC] So, one day I’m driving back from a BBQ with another colleague and the phone
goes.
I answer it and it’s one of my team leaders onboard the ship.
He says we’ve been approached; we’re being approached by three vessels.
We’ve sent them warnings, we’ve tried to raise them over the VHF, we’re not getting
any response.
They’re kind of heading straight for us.
We’re just letting you know.
So I was like okay, thank you; that’s great.
Just escalate the force as usual, which would typically be fire the water cannons, set off
the LRAD.
If still that didn’t work, you’d fire shots well clear of the target, so into the
water around the boat to give them a warning.
So, they did all this escalation of force, and then one of the other guys comes on the
phone and he says they’ve just fired an RPG at the boat.
I remember I had them on speakerphone and I looked at my colleague.
My colleague looked back at me and we just thought, what on Earth do we do now?
The pirates had an RPG on their boat and they’d fired it and hit it at the ship.
It hadn’t actually hit the ship; it hit a cargo container onboard the ship.
To say that this shocked me well out of my comfort zone in about the space of thirty
seconds was – be a huge underestimate of how I felt at that moment in time.
JACK: Well, clearly these approaching boats were escalating the situation, so the cargo
ship returned fire on the smaller boats.
LISA: My team who were onboard the ship, they fire their weapons; they hit the skiff and
the skiff stops dead in the water.
This could have been a bit of a risk because the ship that they were on was slow.
It wasn’t very maneuverable.
Assuming they would possibly have more RPGs onboard that boat, they could have done a
lot of damage, but thankfully it didn’t go any further.
But that moment for me was – it just sort of catapulted me into a whole world of now
what?
It was – yeah, I don’t think I’ve ever had anything quite like that since, to be
honest, and hopefully not again.
JACK: That story reminds me of the classic quote from Mike Tyson.
MIKE: Everyone has a plan until you punch them in the mouth.
JACK: I like that quote because I feel like it carries over into cyber-security; you can
and should make all kinds of plans for when you get attacked, but there will still be
an incident that hits you in a place that hurts, bad.
[MUSIC] If whatever plan you have doesn’t guide you through that situation, you’re
having to figure out things on the fly, which is not good.
LISA: Yeah, and I think the other thing was that in a very similar way to ransomware groups,
the pirates’ tactics developed quite quickly.
The other problem was they were very well-funded because they were receiving all these ransom
payments.
So, they had the ability to do things that we couldn’t do on our side because obviously
it would be hugely illegal or at least incredibly frowned upon by the international community.
JACK: Yeah, that’s another interesting concept, that attackers don’t stick to what’s legal
or play by the rules, yet defenders do have to remain legal on how they defend, which
gives these kind of battles a type of asymmetry in how the battle is waged and how companies
secure themselves online.
So, after Lisa helped secure ships from pirate attacks, she decided to move on to something
else.
LISA: So, I actually took a – I took a job working for UK counter-terrorism intelligence
for – it’s essentially run by the UK police, their counter-terrorism intelligence capacity,
I suppose, which was interesting.
I learned a lot, definitely.
Really appreciated the experience and learnt a lot about online radicalization, particularly,
and how that worked and why it was so successful.
So, it was a really good learning experience and it very much got me interested in the
cyber OSINT online space.
Then I moved into one of the UK police cyber-crime units as a cyber-protect officer helping basically
give advice to companies on how best to protect themselves and spreading that message.
That was really what kickstarted my cyber-specific type of career.
JACK: It was after that when she left that job and started her own cyber-security company
called Red Goat, which is when I started following her on social media and such.
Her company does cyber-security crisis exercises.
LISA: A bit like what I used to do with the ships, essentially; running through what we
would do if an attack happened, but also we’ve been doing a lot of work in the insider threat
space, helping companies develop their programs, helping companies develop their responses
to insider threat attacks, and that’s been a really interesting journey for me.
JACK: Insider threats; this intrigues Lisa a lot, and she’s been focusing on this particular
aspect of cyber-security for a while.
Sometimes cyber attacks come from inside the company by somebody who works in maybe accounting
or in a science lab, and this is very dangerous since these people have trusted access.
So, why is that?
Why would someone attack the very company they work at, and how can companies even defend
themselves against this?
Well, to understand this, let’s hear a story of how one of these attacks happened.
LISA: [MUSIC] So, I have one story that I can talk about, which I’ve had to – full
disclosure, I’ve had to change a couple of details in it to obfuscate who the company
was.
JACK: It starts out with her going to a company to have a meeting, and at that meeting, one
of the guys there says he’s read Lisa’s report on insider threats and he wants to
run something by her to get her take on it.
LISA: So I said okay, yeah, sure, no problem.
He says it’s about insider threats, but I kind of need to have this conversation in
a different room.
So I thought okay, fine.
We sort of chat on house rules, agree to keep it quiet and sort of redacted.
JACK: He goes on to say that the company he’s working for is in the middle of dealing with
an insider threat themselves, and starts explaining what happened to Lisa.
LISA: He said well, he’s a scientist who works at this company and basically he’d
written a long LinkedIn post.
When we went back onto his LinkedIn to look, you could see the long LinkedIn post and this
comment from this profile that was a woman who asked this kind of fairly leading, maybe
slightly provocative question.
JACK: LinkedIn is turning more and more into a social network now.
Not only does your profile show you where you work and where you live and what skills
you have, but you can make posts and write articles and share pictures and comment on
other people’s posts, too.
The post that the scientist made didn’t have anything wrong with it per se; like,
it wasn’t revealing any private data about the company or anything, but the comment he
got from this woman was interesting.
Well, to him at least, so he clicked on her LinkedIn profile.
Huh, she’s a scientist just like him, and she works in the same field as him, too.
This combination of having similar skills and interests and her comment on his post
was enough to get him to direct message her and begin chatting.
They started by pointing out their common interests and learning more about each other,
and they seemed to be interested in each other.
Chats continued going back and forth for a while.
Eventually they exchanged e-mail addresses and he started e-mailing her from his work
e-mail account.
[MUSIC] Now, this is interesting because the company he worked at was able to later pull
up these e-mails and see what they were talking about.
So, Lisa was actually shown what these e-mails looked like.
LISA: When we review them, it’s sort of saying things like talking about how much
he hates his manager, how frustrated he was.
So, this was at the very start of COVID.
Because of the nature of his job, he’d been asked to still come into the lab, whereas
other colleagues could work from home and that caused him a lot of irritation, shall
we say, and his manager was being rude.
The normal, I suppose, problems that we have in a workplace.
Nothing particularly untoward.
Then she says to him, do you want to come and visit me?
I’m in Kazakhstan.
Having been – or been looking at flights to that area of the world, they’re about
– from the UK, roughly about £500 for a flight.
So, for someone’s who’s a relatively successful scientist in this kind of organization, that’s
not a lot of money for someone that’s on that sort of salary.
Yet, his response is I really can’t afford that.
I can’t afford to take a trip.
I can barely afford to service my car, which is quite interesting but also sort of alludes
to the fact that potentially he’s having some sort of financial trouble, personal trouble
that’s draining his finances in some capacity.
So, she then has this amazing idea that there’s a job role that she might be able to get him
in Russia.
Her company spans all these different countries and there’s a job opening for a scientist
of his description there, and she’s pretty certain she can get him the job, but she needs
to see proof of some of the things he’s been working on just to kind of make sure
his experience is sufficient, et cetera, et cetera.
So, he proceeds to send her large quantities of files, documents, projects, things that
he’s been working on that are obviously hugely sensitive that the company themselves
are sinking a large amount of money into R&D.
They go into loads of detail oddly over work e-mail on relocation costs and relocation
packages and remuneration packages and things like this, all of which were exceptionally
generous.
JACK: Hm, imagine being in this position, yeah?
You’re offered a significantly higher-paying job in another country with all moving expenses
paid.
It sounds and looks good to you.
You want the job, but they say okay, but show us that you have the skills to do what it
takes.
You might say well, just look at my LinkedIn profile; it shows all the things I’m good
at.
But then they say yeah, but we want to see examples of your work.
Is there any research that you’ve done that you can show us?
This scientist thought that was a good opportunity.
Of course he wanted to show off his work, right?
This was a big chance for him to move up in the world.
So, he starts sending them work he’s done, formulas he’s created, compounds, mixtures,
and some of the actual scientific work he was doing at this company.
Of course they had more questions and wanted to know more about what he was doing at the
company.
So, he starts sending them other research and is now approaching the line of sending
these people some of the intellectual property of the company he worked for.
I mean, as Lisa explains it to me, it almost sounded like this scientist was giving up
some of the secret recipe of what goes into the company’s product.
Sending proprietary information that your company doesn’t want to be public is a form
of a data breach.
Since this was a scientist working in the lab of that company who was leaking the data,
then this is classified as an insider threat actively exfiltrating private information.
LISA: This goes on for a while, and she actually sends him some documents too to get his opinion
on some scientific documents she’s working on, the validity of which is very difficult
to establish, I suppose, because they’re in Cyrillic, they’re – you don’t know
whether you’ve just made it up or stolen it from somewhere else.
Who knows how genuine it was?
JACK: This is sort of common for the scientific community to get their work peer-reviewed,
so nothing was really out of normal for him to see some other research that another scientist
was working on.
LISA: Yeah, so he sent all this stuff, she sent some stuff back to him, so I’m presuming
from his perspective he’s thinking it’s – there’s some sort of level of reciprocity
going on.
Then something happened that really diverted the company’s investigation, and I’m not
sure and I still to this day am not completely sure whether I think it was coincidental or
whether it was a deliberate act to obfuscate what else had been going on.
But essentially, this woman said that the person in HR in this company was going to
send him some stuff to read.
So, they sent him the stuff to read, he opens it on his work device – not a lab device
but another work device – and surprise, surprise, it contains some malware.
JACK: [MUSIC] Hm, this just dialed up the threat significantly.
I mean, up until this point, this could have been a legitimate job offer and he was voluntarily
sending them data so he could just show them how good he was.
But for them to install malware on his computer?
Now I don’t trust her at all.
In fact, I don’t even believe any of her profile is accurate.
She’s probably not a scientist, she probably doesn’t live in Kazakhstan, and maybe she’s
not even a woman.
This whole thing was an elaborate plan just to get access into the company that this scientist
worked for.
LISA: Now, the company at this point – for whatever reason, the malware didn’t execute
properly or something was wrong with it.
Something happened that meant that the payload wasn’t delivered successfully, which was
lucky.
But what happened was, which was more interesting, suddenly this set off alarm bells in the company,
which was the first time they actually realized something had gone wrong.
They hadn’t noticed any of this prior to this piece of malware.
At that point, it diverted all of their attention and all of their resources into that.
JACK: The company took a look at the scientist’s computer for any suspicious activity, then
started asking the scientist questions.
This eventually led them to the e-mails that were going back and forth that the scientist
was sending, and there were all kinds of private information in there being sent outside.
LISA: But they immediately suspended him as soon as they found out that he’d been passing
files and so on and so forth.
Now, interestingly, when I first came in and I started having conversations with them,
I said how long has he been suspended for?
They said something like two, three days, something like that.
I said okay, so his account has been disabled; he can’t get in, he can’t do anything.
They sort of paused and looked at me and I thought, you haven’t disabled his account,
have you? They hadn’t.
They hadn’t done anything at all.
Thankfully he hadn’t tried to access anything from his home, so that was a piece of luck,
but again, more often than not, these situations happen, you haven’t disabled that account,
and then they go in in some sort of act of revenge or sabotage to do something callous.
JACK: So, they fired this scientist and tried to make sense of who would target a company
like this.
Lisa never got to the bottom of that, but she had some theories.
LISA: [MUSIC] I would say that the two most likely situations would either be corporate/industrial
espionage, so a competing company in a foreign state wanting to steal R&D to get ahead.
That’s likely.
They’ll invest lots of time, effort, and money into doing that.
Or conversely it could also be a nation state actor if they saw enough benefit in it.
I know MI5 in the UK have – with another organization have launched a Think Before
You Link campaign because they claim that this has become such a huge problem in the
United Kingdom that they’ve launched a whole app and a whole campaign to try and raise
awareness of this – pretty much this exact attack vector, in some respects; being contacted
on LinkedIn by profiles asking for information.
So, I think in certain industries, this could be attractive to nation states as well.
But yeah, I think those are probably the two most likely, because we haven’t seen any
evidence of it leaked anywhere.
It hasn’t looked like it’s been up for sale anywhere to our knowledge.
So, that – if I had to stab in the dark, that’s where I’d go.
JACK: Hm, nation state actors?
Really?
Are we at that point that government spies are using LinkedIn to make connections with
people and sending them malware?
Well, yeah.
Looking at the news recently, I saw a story that did exactly this.
[MUSIC] Back in March of 2022, someone broke into a crypto company, Axie Infinity, and
stole $540 million worth of cryptocurrency.
This was attributed to be the work of the government of North Korea.
The latest article I read about this story is that the way they got in was through LinkedIn.
They targeted people who worked at Axie Infinity, enticed them with great job offers, and when
the employee opened the document, malware was put on their work computer, which gave
North Korean hackers access into that network.
That’s how they were able to steal $540 million worth of crypto.
So yes, nation state-level threat actors are in fact using LinkedIn as a way to social-engineer
someone to get access into that company.
It’s no wonder, right?
If you want to target a specific company, it’s so easy to go onto LinkedIn, look up
the company there, and see a whole list of people who work there.
Then you can interact with those people right there on LinkedIn to try to manipulate them
or coerce them into doing something like sending you intellectual property or getting them
to install your malware.
So I wonder at this point; is LinkedIn itself a vulnerability?
LISA: I don’t know, because you see, this is the trouble I have.
On the one hand, it’s important for my business and my career to be present online.
But conversely, I appreciate that that makes me much, much more vulnerable.
So, it’s a really difficult one.
I’ve been contacted on LinkedIn by very strange individuals who have offered me all
sorts of really strange opportunities in exchange for information on people and people I’ve
worked with.
You don’t have to name your clients, but tell me what they’ve been doing with this,
this, and this, almost all of which have been very odd profiles; typical stock image-type
profile pictures.
I wouldn’t say hugely clever, but that may be because I’m tuned into this type of attack
vector that I can spot that in a way other people might not be able to.
So, I’m well aware that this is clearly going on.
I’ve got a friend, Philip Ingram, who used to work in the British military, and he gets
contacted all the time by people who he, at least, believes are from China who are trying
to get information or invite him to very suspicious-type events to sort of lure him, I suppose, into
maybe handing over some information.
So, I think it’s – it definitely makes you more vulnerable, but that’s the society
we live in, so I think we probably need a little bit more healthy paranoia.
It would also be great if on LinkedIn you could turn off direct messages.
That would be an amazing functionality to have on LinkedIn, because you can do that
on Twitter, you can do it on Instagram, but you can’t do it on LinkedIn.
JACK: It’s true; if someone has LinkedIn Premium, they can direct message any user
they want.
But I think fixing that alone isn’t enough that it’s gonna stop this kind of attack.
Anyone can still comment on your posts and see your profile, and perhaps work out what
your e-mail address based on your name and where you work.
So, I’m not sure if that’s the best fix for this.
Personally, I don’t like putting any personal information online, especially listing my
whole resume on LinkedIn.
I’m on LinkedIn myself, but I’ve redacted all the names of the companies I’ve worked
for and all the locations.
I used to say I’m a podcaster, but I get contacted by a lot of PR companies and shady
marketers who want to pitch me a guest or game the podcast charts for me.
So, now I don’t even say I podcast, but I can see clearly that the more information
you put up on LinkedIn, the more someone can use that to their advantage, not yours.
[MUSIC] We’re gonna take a quick break here, but stay with us ‘cause when we come back,
Lisa’s gonna tell us another insider threat story.
LISA: So, I think one of the most powerful stories for me that I’ve come across in
my work was actually a situation where there was a young girl who worked for this company.
The company worked in the extractive industry, so sort of oil and gas, that sort of situation.
People think that the oil and gas industry is not very innovative, but it’s actually
really innovative and it has a lot of very valuable commercial licenses and information
that is incredibly saleable.
This girl had sort of come out of university, she’d traveled around South America, she’d
done humanitarian, environmental projects, things like that, and she’d accepted this
job within this company and was on their environment impact team.
She was contacted on Facebook, actually, so a different platform to the usual ones.
She was contacted by this girl who claimed to be in Peru.
This girl actually claimed to work for the same company and she said oh, I see that you
work for the same company as me.
I’m really interested in learning and practicing English, I’m really interested in British
culture, traveling to the UK and things like this.
It would be great to connect, be friends on Facebook, whatever.
JACK: Huh, what a soft and gentle approach to start this out with, huh?
The woman who worked at this oil and gas company had done some volunteer work in Peru and is
now being contacted by a Peruvian woman who’s claiming to also work for the same company,
but wants to know more about the British culture and language.
I mean, I wouldn’t immediately flag this as suspicious if I was receiving this as a
private message.
I’d find it interesting, actually, that we had some commonalities.
As they got chatting, it turned out they both had a lot of similar interests; they both
cared about environmental issues and had traveled to many places in South America and did volunteer
work and had similar degrees and worked for the same company.
Pretty cool to meet someone who has all these similar interests as you, right?
LISA: Now in hindsight, looking at it, it was fairly obvious where these similarities
had come from because this girl’s Facebook profile was wide open.
All of her antics and voluntary work in South America was photographed, catalogued, and
on Facebook.
Pretty easy to work out what her political ideological interests, et cetera, were.
This profile mirrored almost all of them exactly.
JACK: So, their relationship was building up over time and more trust was being formed,
and even a friendship, all through the Facebook chat app which is text only; no audio or video.
One day, this fake profile Peruvian woman contacted the woman who worked at this company
and said…
LISA: [MUSIC] And she said I’ve been hugely distressed because the company that we work
for has been leaving the site that they used in Peru unsafe, and it’s causing people
to have all sorts of illnesses.
These people are – they’re poor, they can’t afford legal help, they can’t afford
medical care, and it’s part of the company’s plan to do this.
They don’t care about my people in my country and it’s horrific.
JACK: Well, this hit this woman hard.
She was horrified to hear that the company she worked for was causing people to get sick
and to be unsafe work conditions and was contaminating the environment.
In fact, she was so upset by hearing this news that she suggested they both quit working
for this company.
She wanted to quit her job over this.
This was just too awful for her to be a part of.
LISA: The Peruvian lady said no, no, we’re not going to quit.
What we should do is try and expose what they’re doing to a journalist.
[MUSIC] So, she thought this is a good idea; okay.
Well, how are we gonna find a journalist?
The Peruvian girl said well actually, I know one and he lives here in Peru.
He’s an American guy and he worked on the Wikileaks story.
He’s worked on exposing governmental corruption and corporate corruption and all these sorts
of things.
So obviously this sounds like a really convenient, great idea, right?
So, magically this journalist shows up in the Facebook Messenger chat.
JACK: [LAUGHING] Okay.
LISA: And in he walks, and he’s got all these ideas of what you would need, evidence-wise,
to support a story that exposed corruption, which is reasonable to assume, I would have
thought.
So, he’s saying to both of the girls equally, these are the sorts of documents I need you
to go get from your company.
Go and find them; photocopy them, photograph them on their – on your phone, send them
to me at this e-mail address, whatever mode of transmission you wish to employ.
He’s saying it to both of them, but obviously only one of them actually works at the company.
So, it’s all sort of – I suppose you could call it social proof in the sense that the
actual victim in this situation thinks both of them are doing it.
So, they go into the company and this went on for a long time.
I think in total it went on about nine months of requesting different documents to be found
and getting colleagues to print things off for you so that it’s not logged as you printing
it off, and all these sorts of fairly obvious obfuscation methods, I suppose.
But it was under a great guise ‘cause he’s an investigative journalist who you’d expect
to know these sorts of tricks, right?
It all made sense.
So, this girl’s going in and getting all these documents, and when she was interviewed
by the company, she actually said to them that there were a few documents on that list
that she was quite surprised to see.
She wasn’t quite sure how they exposed environmental damage and corruption at an environmental
human rights kind of level.
But she deferred to his expert journalistic skills, I suppose, and obtained them.
[MUSIC] Anyway, by the end of this sort of saga, when he at least claimed he had everything
he needed for the story, what was really interesting was how they both extradited themselves from
the situation.
So, the journalist said I’m gonna disable my Facebook account for a while so I can focus
on writing the story.
He disappears.
Then the Peruvian girl decides that this has been hugely stressful on her and she’s going
to go and spend time with her family, and she’s going to log out of Facebook and,
you know, be offline for a little while.
So, she disappears.
That’s the last she hears of either of them.
It wasn’t until later on that this gets discovered, which unfortunately I can’t
tell you how it gets discovered, because the method that happened would reveal who it was.
But safe to say, it was another company within the space that obtained information in a certain
way.
This was discovered by the company and then they sort of started to unpick everything
and worked out what had happened.
So, she was convinced, actually, that somehow her two friends who were genuine, in her mind,
had been silenced or somehow disappeared by her employer for quite some while.
So, she was actually very distressed to find out that this was actually not – this had
all been a lie, because it had gone on so long.
I think that’s part of the hugely damaging side of some of these attacks, is that you’ve
built this rapport, you’ve built this relationship, you’ve built this narrative that gets yanked
from underneath you.
I think it’s a bit like romance scams I suppose, in that respect, that people get
convinced of the narrative and it’s just not true.
JACK: As it turned out, the company wasn’t even mistreating people or causing people
to be sick with unsafe work conditions.
That whole story was a lie simply to get this lady to send them company documents.
LISA: One thing they did really cleverly, actually, was they kept reiterating for her
not to tell anybody; not to tell her parents, not to tell her actual friends, not to tell
her colleagues, because they’re writing this article, this super-secretive, whistleblower-esque
article.
It has to be kept secret.
I think that line was what enabled it to go on for as long as it did, because I think
if she told somebody else or started talking about it as a concern, someone would have
said this sounds a bit odd to me.
Then it might have unraveled.
JACK: So, any hunches here on who’s behind this one?
LISA: So, I suspect from the information that we had that this was actually acquired by
potentially an organized crime group and then sold or attempted to be sold to another competitor,
just because the person who approached the competitor who eventually flagged it wanted
money for the information.
So, I suspect that this was actually acquired purely for financial gain in this particular
instance.
But again, potentially it could have been another group.
I don’t think it would have been a activist group just purely because I think you would
have published it.
As there was no actual wrongdoing, there wasn’t anything really to hang your hat on and say
this company’s doing this hugely immoral thing.
[MUSIC] So, yeah.
JACK: We all have some kind of weakness.
We all have something we care about or have a passion for, but there’s something that’s
just close to our heart, and with the right kind of message sent to us directly at the
right time, it can hit us like a heat-seeking missile.
In this case, because this lady cared about the environment and people’s health, this
was used against her to get her to leak lots of sensitive documents from inside the company.
It’s almost not fair that the bad guys out there play so dirty and manipulate those who
genuinely want to do good in the world.
It must have felt awful for this lady to learn that the whole thing was made up and it was
a lie and she didn’t have a Peruvian friend at all.
They were just actors there to manipulate her into sending them documents.
They even made up the lies about how the company was doing misdeeds.
How does a company protect itself from this kind of problem?
LISA: I think – so, insider threats is my sort of area and I think for me, if you’re
building an insider threat program in your company or you’re developing one, you need
to invest in training, for sure.
Your staff need to be aware of these sorts of things that can happen and why they’re
not things that we should be doing.
But I think more importantly – and often I see companies make one really critical mistake
here, and they start thinking about insider threat programs and they immediately go down
Draconian monitoring of all staff.
I had a company who said to me, am I able to turn on the webcams for my com – for
my employees while they’re working from home?
Now, there may be countries in the world where that’s permitted, but that’s not Europe.
Europe is not going to allow you to turn webcams on and off on your employee’s devices.
I think the problem you have if you go down that route is you’re doing it because you
want to know and you want visibility on what your employees are doing.
But what you’ll actually do is you’ll increase the risk that you’ll get disgruntlement,
that you’ll get people who want to sabotage the business.
Unhappy employees are way more likely to become insider threats than really happy and contented
employees.
So, my argument very much is invest in employee assistance programs, helping your employees,
identify when they’re struggling, and helping them recover from that.
Essentially patching the vulnerability that exists so that they can’t be blackmailed
and they can’t be exploited in the way that so many of these cases have been.
JACK: Mm-hm.
That’s what my sentiment was too, is the happier the employee, the more loyal they’ll
be and less likely to do something like this.
LISA: I became semi-obsessed with – recently with secret cities that had existed in Russia
when it was in – when it was the Soviet Union.
There was one city in particular called City 40 which was created by the Soviet Union to
create their nuclear program.
They basically took hundreds of thousands of people out of their homes, moved them across
the country into this city that they had built, prohibited them from seeing their relatives,
their family, prohibited them from contacting anybody on the outside.
Yet, these people were so happy and content and loyal because they’d actually been given
this amazing quality of life in comparison to the rest of the Soviet Union at the time.
[MUSIC] It’s a really extreme example, but they felt privileged.
They felt satisfied and privileged and because of that, they were more than happy to keep
this agreement of silence to protect the Soviet nuclear program.
I think it’s a really good example of how, actually, if we’ve got that feeling of ‘my
employer really supports me and I’m happy and I’m content’, people who are happy
and content don’t go and sabotage their employer, by and large, right?
That’s coming from someone who’s in a really dark place, typically.
So, I think we have to be very aware of how humans feel, and are we making it a really
nice place to work where they are supported and challenged and promoted and whatever,
because that’s how you’re going to get loyalty and that’s how you’re gonna get
a less vulnerable workforce.
JACK: I’m trying to think if we should take some more lessons from this or if there’s
things we should pay attention to.
LISA: Yeah, I think the only other thing that I’d add generally; I think the – and this
kinda comes from my experience in working in the piracy industry and – or stopping
piracy, I suppose I should say, is that a lot of security is very much focused on the
perimeter.
It’s very much focused on – to use the pirate analogy – stopping the pirates from
getting onboard the ship, right?
But if you don’t have a plan for what happens after that, you have no way of stopping the
attackers’ advance.
You have no way of remediating damage or assessing damage or in – or working out what’s even
been compromised.
I think that it has to be a two-limb thing, and it’s the same for insider threats.
It’s all well and good building all this stuff to prevent it, but you have to also
be able to detect it, remediate it, investigate it quickly and efficiently, which a lot of
companies haven’t invested at all in what happens, so to speak, when the pirates board
the ship.
So, I think that’s a really powerful lesson that people need to start taking onboard as
well.
JACK: Oh, I love that you brought it full circle at the end there.
That was really well done.
LISA: [LAUGHING] Yeah, we’ve come full circle.
JACK: Okay, well then I think we’ll leave it there.
LISA: Cool.
(OUTRO): [OUTRO MUSIC] A big thank-you to Lisa Forte for coming on the show and sharing
these stories with us.
You can follow her on Twitter; her name there is @LisaForteUK.
If you want to hear more from her, she’s created her own podcast called Rebooting,
but she’s also given many talks at conferences, so you can just look her up on YouTube and
there’s tons of stuff that she’s sharing there.
You can also learn more about her company by visiting red-goat.com.
This show is made by me, the outsider, Jack Rhysider.
Sound design by Ponyboy, Andrew Meriwether, editing help this episode by soda pop Damienne.
Mixing is done by Proximity Sound, and our theme music is by the two-bit Breakmaster
Cylinder.
Fun fact; if you search for a lighter on Amazon, they’ll give you 6,000 matches.
This is Darknet Diaries.