Episode 9: Let's Talk FinCrime and the Digital Underground

What happens on the dark side of the internet? In this episode, we’ll talk with expert financial crime fighter and founder and CEO of Q6 Cyber, Eli Dominitz. Listen in as Eli shares who operates in the digital underground, how we can monitor this activity and how to keep yourself safe.

Eli Dominitz is the founder and CEO of Q6 Cyber, an e-crime intelligence company based in the USA and Israel. Through a combination of proprietary technology and human analysts, Q6 monitors the “Digital Underground" (DarkWeb, DeepWeb, malware networks and infrastructure) to collect targeted and actionable e-crime intelligence used to proactively eliminate fraud, data breaches, and other electronic crimes. Prior to Q6 Cyber, Mr. Dominitz co-founded another cybersecurity company focused on vendor risk management. Mr. Dominitz holds an MBA from Harvard Business School and an Honors B.Sc. in computer science from York University.

You can hear more of our conversation with Eli by visiting actimize.nice.com/podcast

Transcript

Unknown: 0:09

Welcome to Let's talk fin crime, the show where we explain not only what compliance and financial crime are, but most importantly, what it means to you, and how it affects your daily life. I'm your host, Dave Ackerman. I'm a lawyer, former Chief Compliance Officer, and financial regulation expert for nice Active Minds based in New York City. As always, we bring you conversations with some of the most interesting people we can find. All designed to help you understand what's happening in the financial world. Many people don't realize that the internet or the quote unquote cloud is not a one particular place. The internet is actually just a vast network of computers all over the world, connected together so that people can move information easily from one place to another. So this network allows us to chat to connect to merchants and obviously share crazy cat videos, which is the entire purpose of the internet. Today's episode focuses around the dark side of the internet, appropriately called the dark web. The dark web operates just like the internet does. It's a series of connected computers. But the difference is the dark web is designed to hide people's identity and activity. You might be wondering, is that even legal? And the answer is yes. There's nothing inherently wrong with masking one's identity online. But it does create an environment that's ripe for criminals. So for those Harry Potter fans out there, think the difference between Diagon Alley with all the good bright shops all out in the open and not turn alley world a shady goings on are happening. Our guest this episode is an expert in fighting crime on the dark web. Le dominance is the founder and CEO of two six cyber in he crime intelligence company that monitors the digital underground. Alec, thanks for being here. Really appreciate it. Hi, Dave, thank you for having me. So this is gonna be cool, because I think a lot of people don't even necessarily realize how the internet works, let alone that there is a dark side of it. So can you kind of explain to people what is the dark web other than a really, really cool name? Sure. So the traditional definition of the dark web is really a set of networks that use internet, but require some kind of a special tool, or software or access or configuration, in order to access those networks. You know, most people are some people are familiar with the Tor network, the Tor network is an example of one part of the dark web. So if you want to access the Tor network, you need to have a special browser that can give you access to that network, you cannot use Google Chrome or another kind of traditional browser in order to access that part of the dark web. So that's a traditional definition of the dark web. Really, it's broader than that. So other folks use terms like the deep web, which might sit on the traditional internet on the regular networks that can be accessed by by a typical browser. But those parts of the internet, the deep web, they're not indexed by traditional search engines. So you can we just go and find those sites, you need to be able to, you need to know where they are. And you've got to have access, usually by form of credentials in order to get into those websites. So those are really the dark web and the deep web as most people think about them. Over the over the last couple of years, oh, they've evolved and moved into mobile channels as well. So if you think of mobile apps, like telegram and discord that legitimate folks will use for communications, for interaction, those networks and those apps are not being used for illicit purposes, as well. And we'll talk about that in more detail. So it's a long way of saying the dark web really began initially as a set of networks that kind of set on the internet, but required a special type of access. And over time, it's broadened to include the deep web and mobile as well. So okay, but that's interesting that the the idea of requiring special access, so I don't have to worry about my mother accidentally surfing the dark web and finding something illicit, you have to actively seek this out, right? You have to use either a special browser or some other form of way to communicate with this. It's not like somebody who's sitting there using Google's gonna accidentally find their way onto it. Right? Correct. I think for the most part, you've got to be seeking that kind of content or that kind of access. You're not going to just fall into it. However, I think if you if you surf the internet and you're looking for certain keywords, you're probably going to, you know, get to the edges of some of the dark web, but I think by and large, you're right, you're going to need to be seeking it out in order to get there. So who's seeking it out, you know, because The way you're describing this, I'm picturing some kid in his parents basement trying to score questions for the midterm. You know, like just, I don't particularly if you're seeking something like this out of these master criminals, or these people who are just like I said, just a kid in somebody's basement. It's a wide range. So let's talk about different types of folks who might want to use a dark web. The first and I think we'll get into this in more detail, excuse me are fraudsters and cybercriminals, who use a dark web as a way to collaborate to interact to exchange information to traffic and stolen data. So you've got a very significant, significant contingent on the dark web that is made up of cyber criminals and fraudsters are really motivated by financial gain. There are other folks or types of folks who use a dark web, there's quite a bit of drug trafficking and trade that goes on in the dark web. So there are dark web marketplaces where you can buy and sell illegal drugs in small and large quantities. And that's been going on for many, many years. There are folks that leverage a dark web in order to traffic or trade child pornography. And then there are folks who use the dark web or tools that are part of the dark web for legitimate purposes. So the dark web also offers anonymity. So if you want to surf the web, or or engage in some activities, totally anonymously, you can do that using some of those tools. And there are folks who care a lot about their anonymity and want to use the dark web for those purposes. So they don't necessarily need to be legal or unethical. But I would say, based on what we've seen, that would represent a small minority of the activity on the dark web, most of it is going to be made up of the malicious and nefarious activities that I mentioned in the first part. So that makes sense then, though, because if you're in order to get onto it, you need to actively seek it out, right. And then once you've actively seek it out, like, like you said, there's nothing inherently wrong with wanting to be anonymous. And I think people sometimes forget that. One of the benefits of cash transactions is it's anonymous. If I go into a store, and I buy a soda, and you know, I hand them the cash, they hand me the soda, no one knows my name, no one knows my address, my account number, there's no types of checks or anything like that is a completely anonymous transaction. Now, I also can't remember the last time I paid for anything in cash. But, you know, that is the idea behind a lot of these tools, originally from the, you know, legitimate side was to mimic that kind of economy online, which is a difficult thing to do, because there's all these fraudsters so. So like you said, the vast majority of this of the traffic on this dark web is more likely than not for nefarious purposes. So then what kind of information is traffic on the dark web, you'd mentioned? child pornography and drug sales. And I mean, I can't imagine somebody just randomly rocking up and trying to buy like, you know, pound of weed in a state where it's illegal. So we talked about drugs. We talked about child pornography, there's counterfeit goods, there are a range of services that are provided. If you're looking for somebody to offer some sort of criminal support, you could find that on the dark web. So there's a whole range of services and products that you can find on the dark web. I think as it relates more more specifically to financially motivated crimes and fraud. We look at the activity in the dark web, and we categorize it into four distinct categories. One, stolen data. And we'll get into this, I think in a lot more detail. This is where all the data that is hacked and compromised by the cyber attacks that we read about in the newspapers. A good chunk of it eventually makes its way to the dark web and is traded and shared amongst different cyber criminals and fraudsters. So stolen payment card data, account credentials that are compromised to malware and other means. Those are the types of stolen data that are traded regularly on the dark web. second category is what we call hacker tools and collaboration. So if you're looking for certain types of malware, if you're looking for mobile malware, all sorts of tools that are part of the you know, cyber criminal toolkit are found and are traded on the dark web. So you can go and buy it, you can trade it, you can rent it, it's all there. Now. third category is mule mule services and new accounts that's exploded in the last couple of years. And now, those are mule accounts or mule operators basically, intermediary account. financial accounts that are used to move money around the world, they're also physical meals, they help shape and reshape physical goods around the world. These are all parts of the, you know, fraud, fraudulent campaigns that are going on every single day. So mules occupy a big chunk of the dark web. And then finally, what we call just broadly speaking crime as a service. So if you want to hire somebody to go hack into a company or hack into an individual's computer, you can find those kinds of services very easily on the dark web. And that's just one example. There's a lot of different flavors of crime as a service that are available. So you know, there's a lot that's out there today. And I would say, every single month, we're discovering something new that didn't exist. If there's a demand for it, if there's a need for it, you're going to find it on the dark web. That's amazing. So one thing that you have said in previous interviews that I've heard you give is, I think people because either of movies or pop culture, people think dark web, cyber criminals, very sophisticated, very well, finance individuals. And something you said before that I absolutely love is you can be an idiot and still profit from the dark economy. And it sounds to me like like the tools that you were talking about, if somebody had the gumption and really tried and tried to educate themselves, they could figure this out pretty easily. Yeah, so the dark web, really lowered the bar for bad guys to get into the business of cybercrime and fraud. If you go back five, certainly 10 years ago, in order to be a successful fraud, or cyber criminal, you have to be pretty capable. And you have to have a wide enough skill set so that you could execute whatever scheme or schemes you were planning on doing. Over time, though, as a dark web grew and really expanded, a lot of tools, services, stolen data, and hacked data are very easily and widely available to anyone who wants to get into this game. So for better or worse, what I've seen professionally in my career is the average person, whether it's because of pop culture, or movies, or whatever the case is, they view the dark web or cyber criminals as these very well educated, smart, very well capitalized individuals. And something that I've heard you say publicly before earlier was, you know, a person could be an idiot, and still profit from the dark economy, which I find absolutely fascinating. So is it because of those tools that you had mentioned online, or, you know, is it just, if someone looks hard enough, they're going to be able to educate themselves, like what makes it so easy. It's definitely the tools and the availability of those tools on a dark web. So if you go back 510 years ago, and you wanted to get into the business of fraud or cybercrime, you had to be quite capable, you had to have a skill set that is wide enough so that you could commit a scheme or set of schemes. As the dark web group evolved and expanded. There are so many vendors or providers on the dark web, and I'm talking about criminals who offer tools, services, stolen data, hacked data, for very affordable prices. And so if you want to get into the business of cybercrime and fraud, you no longer have to build those capabilities or develop them in house, you just access the dark web, and you can pick and choose from amazing providers of tools, services. And like I said earlier, it's not very expensive. So getting into the business of cybercrime, and fraud is quite easy. Now, it's not very expensive. And that makes it a problem for financial institutions and others who are trying to defend against his adversaries. It makes him more complicated. You've got a lot more folks getting into the business of cybercrime and fraud. And even though they're not coming in with a very sophisticated or complex set of skills, they're able to leverage them or acquire them very easily and very quickly. So that's exactly what's been happening. And unfortunately, we only see that trend continuing. And I'll give you a good example. Mobile malware, which a lot of folks talk about, and of course, it's you know, it's a it's a, it's an area of concern for financial institutions and others, mobile malware is much more difficult to develop, and spread and control. And so, developers and authors have mobile malware. There aren't many of them that are really, really good at what they do. But those that are able to offer and distribute their malware on the dark web, which means that, you know, any cyber criminal who may not be skilled enough to operate or certainly not develop and even operate their own versions of mobile malware, they can just access the best tools that are out there at a relatively cheap cost. So that's what's happening nowadays. And like I said, it's it does not seem to be slowing down that that trend of crime as a service tools as a service, malware as a service, that is not slowing down. And the contrary, it's only growing. It's almost, it's a little scary, I have to admit, you know, being in this business. I had a former mentor of mine Tell me years ago, when technology started really changing the game of compliance and fraud, that, you know, when you think about where this evolved from the the term con man came from confidence man, right, they an individual who had that skill set, that they were able to get you to do something that would either be against your better judgment or, you know, get you to trust them to a point where they bring, you know, bring your money, bring you information, bring whatever it may be. And then over time, because of the availability of technology, it's the games almost flipped completely. Now it's more of a numbers game, and they just try to hit and hit and hit. And this idea of the dark web, being able to traffic in information in tools in all of these things, near anonymously, is, as you said, that's a trend that is very scary for someone who is trying to protect either their institution, their company, it doesn't even have to be a financial institution. I mean, we've seen places get hacked and held for ransom numerous times. So I think, let's pivot a little bit and kind of talk about what kind of information are we talking about that's being trafficked on the web? So if someone is buying one of these mobile malware tools, or their they're purchasing something crime for a service, what are they trying to get? What are they trying to get their hands on? Let's, let's answer the question from the lens of a financially motivated actor. If you are, if you're one such person, or again, those financially motivated now you've got malware being mobile or desktop based malware, you're going to try to spread or disseminate that malware to as many potential victims as possible. There are some actors who are strictly focused on corporate victims, and the way they monetize their victims is through attacks like ransomware, as you mentioned, in some cases, espionage where they they steal very sensitive information, and then they go and they sell it to the highest bidder. those groups that focus primarily in corporate targets tend to be more sophisticated. And, and really, really careful in how they operate. So it's a lot more difficult to identify them. The tools that they use are even more sophisticated. Another type of actor that is also financially motivated, might be just focused on generating income quickly, by targeting both individuals, businesses and other organizations. And their The game is a lot simpler. So if they're able to infect a victim with malware, beat desktop or mobile malware, the malware is going to sit on the device and effectively watch what the person is doing, collect information and send it back to the bad guys. So the person is shopping online, they're, you know, buying some product enter their credit card, that information is harvested sent back to the bad guys, person is logging into their online banking account in order to pay a bill or do something else. malware is recording that session recording the credentials, sending it back to the bad guys person is on their email. You know, replying to friends or doing something malware is harvesting that information, getting email credentials, getting the contact book, or the address book, etc. So these are some of the things that malware is capable of doing. malware might also not turn the victims computer into a small Bitcoin mining operation with install software in the background that tries to to mined for Bitcoin, to look for any cryptocurrency wallets that the individual might have and then try to take the cryptocurrency out of those wallets. So the malware has been very, very well designed to identify those accounts of interest, get the information that's useful and pass it back to the bank and now the bad guy is in control of a set of credentials that can be used to log into online banking accounts to e commerce accounts, etc. And they could then proceed to log into those to those accounts and commits a kind of fraud. So, you know, transfer funds out of a bank account using zelly, CH wire, etc, they could log into the person's ecommerce account, and you know, buy goods and shipped them to a different address. So those are some of the things that the malware can enable them to do. Now, one thing that, that people don't always recognize with malware, the malware is not only capturing those credentials, it's also recording information about the device that can then be used in order to bypass anti fraud controls that a lot of companies have. So to give you a simple example, if you log into online banking, chances are especially especially if it's a larger bank, they've got tools that can detect the device fingerprint or the browser fingerprint of the user, and they build a profile of the legitimate user, you're logging in from Denver, you use this type of a computer, this kind of a browser or using this language, these fonts, etc. Well, now we're now when they infect the device, the device is collecting that information of the on the device and that fingerprint, it's loading it into some sort of a configuration. And when the bad guys attempt to log into the victims online banking account, they load that same configuration. So when the login attempt is made, from the bank side, it looks exactly like the legitimate account holder. So the malware is very good at intercepting credentials, capturing all the information needs about the victim. So when the bad guys looking to use it, it looks like it's a legitimate account holder, it's much harder for a bank or you know, even e commerce shop to detect that. Now, to bring it back to the dark web, what happens is a lot of the bad guys who operate the these malware campaigns, they might use that information or that data to go ahead and export those accounts directly. But in many cases, they have too much information, or they have information that they're not necessarily focused on using. So they're going to be selling out or trading on the dark web. And that's where you see large shops and kind of trading platforms where cyber criminals and hackers trade in that kind of stolen data. So you know, if you got if you got on the dark web, I could, you know, show you dozens and dozens of account marketplaces that traffic in this kind of data. So if you're looking for an online banking account, an e commerce shop, whatever it is you're looking for, chances are you're going to find that and you're going to find quite a bit of it in different account marketplaces. So those of you who are listening, it's very easy to get scared by something like this. And it's very easy. I mean, you may be asking yourself, Dave, why on earth are you and Ellie, just giving a masterclass on how to do this? Well, we're going to take a quick commercial break. But when we come back, we're going to explain to you how these types of criminal enterprises operate, and what we're doing to protect you. And then we're also going to give you a couple of things that you can do in order to protect yourselves. So I don't want you to be listening to all this and think, oh, wow, it's so easy. Am I am I at risk? The best defense is educating yourself. And that's what we're going to try to help you do understand what is happening, how it affects you. And ultimately, what are the things that you can do to try to ensure that you were successful just in case someone does try to employ any of these types of techniques to you, so we'll be right back after this quick commercial break. For years, Financial Crimes prevention tools have taken the best offense is a good defense approach, attempting to detect and block malicious activity in real time. Often, that's too little too late. But what if you can take a more proactive approach? What if you can gain timely and actionable intelligence on what the bad guys are planning to enter q six cyber, the leading provider of E crime intelligence to financial institutions worldwide. Q six cyber monitors the digital underground including the dark web, Deep Web, malware networks, fraud and cybercrime infrastructure to proactively identify threats before they materialize into fraud losses and other crimes. Learn more at kusik cyber.com. Welcome back. We're talking with Ellie who's the founder and CEO of Q six cyber, a firm dedicated to monitoring the digital underground, which is a vast universe of online sites, marketplaces, communities and forums, where hackers, fraudsters and cybercriminals can operate and interact. We've been talking about what makes up the dark web, the type of information that's trafficked And how that is used sometimes by criminals of all different levels of sophistication. But we're going to move this conversation a little bit to understanding how the deep web supports financial crime, what companies like ours are doing to make sure that you are protected. And we're going to end with some tips that you can use in order to protect yourself. So as I mentioned in the introduction, the dark web in and of itself is a tool, right? And no tool is inherently either good nor bad. But I can only imagine the type of power that this level of access and anonymity and communication can give organized crime rigs. So can you give us an example of, of how that works, how that's used, maybe maybe an example from your career that you have seen that we are trying to target as, as financial institutions? Yeah, let's talk about new accounts. new accounts have always been around. So maybe just a quick definition, a new account is a a financial account, let's say bank account, that is used to facilitate illicit funds transfer, so fine, a cyber criminal or Foster, and I want to move funds from point A to point z, I might use one or multiple accounts in the middle in order to route the funds and kind of mask the flow of funds in the in the final destination. Mutual accounts are really critical to money laundering and other types of financial crimes. The the dark web has made it a lot easier for for bad guys to to traffic in your accounts. And let me explain why recruiting and managing meals is a pretty complicated business. criminals who recruit news, usually do it in two ways. One, they will create fake companies or fake advertisements for for jobs. And they will manipulate people into believing that those are legitimate companies applied for positions there. People get hired, they get paid a salary. And once they're on board on these on the fake company, they're asked to move funds and, and participate in new operations. In some cases, people discover quickly that they were duped In other cases, it takes a little bit of time. But But recruiting and managing mules is a complicated task, because you've always got to keep the pipeline going, eventually, people are going to realize that they're doing something that they shouldn't be doing. And they drop off. And so you've got to keep the machine going. You got to keep the engine going. But constantly recruiting us for like a court. Exactly, exactly. In other cases, there are folks who knowingly participate as mules saw, obviously, the recruitment for those folks is a little bit simpler because they know what they're coming into. But you know, that's not enough. And so new operators, have now used the dark web in order to scale their operations. What do I mean by that? You've got Ellie, I'm sorry, do you mind if we just take a quick pause here because something this is really important for people to understand. And and one of the purposes of this show is to help help the average individual who isn't deeply rooted in financial crime to understand how this affects them. The mules that Ellie is speaking about, we've spoken about on this show, those who are fans of the show have probably heard this conversation in different contexts before. But essentially, even though he and I are speaking about financial criminals and enterprises and these vast different networks, the mule is you, you, your sister, your brother, they need you in order to move the profit from these illicit gains from the United States to somewhere else, or from the UK to somewhere else to a different jurisdiction, that it's impossible or very difficult to to reach them from a law enforcement perspective. So when he speaks about murals in this way, and this idea of gathering groups of them to move this money around, this is a lynchpin. There is a reason we focus so hard on the prospect of moving money out of the the host country that it was stolen from. So when when you hear Ellie speak about these groups of mules, think about your neighbor who was laid off because of COVID. And now all of a sudden, found online, a job that pays 15 $100 a week and all All they need to do is just accept the money in and then transfer it to an account that they've been given. And then they keep a piece off the top. And the things that that you know are going to be a trigger is the company hasn't been around particularly long, they're paying you for a skill set that is completely unrelated to the job that they're talking about. Or even if you get further along, if they start saying things like, don't tell anybody else that that I'm involved, just tell them that you have a rich aunt that sends you money, or things of that nature, if they're trying to hide their identity, or masks the fact that they're involved, these are things that you need to be aware of, because that is what a mule scam is a mule moves things from one place to another. So so I really I didn't want to I hated breaking because I loved what you were talking about. But I think it's really important for the average person to understand that this is not some Phantom 2000 miles away, this is the person who lives next door. This is the you know, the person who's bagging their groceries, they're trying to make extra money, not realizing possibly in the beginning, that they're being caught up in this criminal enterprise. So I'm sorry. So now that we said that the meal thing, please continue with where you're going. You're absolutely right. And just to add to that, these these new operators, the bad guys who are recruiting the meals, they're advertising these postings on monster.com, and indeed.com. So for your friend or your neighbor, it's difficult to figure out that this is something that is not kosher, that is not legitimate. And so it takes a little bit of time to understand that you're dealing with somebody who is very different than who they claim to be. And it's hard because they're they're preying on people's emotions, make money fast, get that new job, you know, you've been out of work. And just, it's, it's one of those things like, you know, for people like me who are in this, who are dealing with financial crime and fighting it, this is the stuff that pisses us off, because these are the things that really affect average people. And it's illegal. So you're the ones that got caught, not them. So and that's where the intertwine between this, and the dark web becomes vital. Right. So I mean, to give even even more color into it, what they'll do is they'll they'll set up a website that looks very, very legitimate, you know, pretending to be a company could be real estate agency, just as an example. logistics companies with elaborate websites very well designed. So they look like very legitimate, and in some cases, even really good companies. The interview process is quite robust. And so it feels like for the people who are applying for these jobs, they're really fake jobs. The interview process seems very legitimate, you know, you've got a video conference with somebody who pretends to be your manager, eventually, if you do get an offer, it comes on a on a company letterhead, you've got to submit references and other documents as you would for a legitimate company in a legitimate job. And so they've taken that recruitment process, and they're mirroring what's happening at a regular company. And so again, for your neighbor, for your friend who might be caught up in something like this, it's very difficult to to identify that something like that is really going on behind the surface. So anyway, you know, that's how they're, they're tricking or attempting to trick people in recruiting these meals. But what the dark web enables them to do is now focus on recruitment, and then make those meals available to all sorts of cyber criminals and fraudsters. So for your average cyber criminal fraudster who may not have the infrastructure, they know how to recruit and manage meals on an ongoing basis at scale, they don't have to worry about that anymore, they could just go to the dark web, go to one of a couple of a couple of dozen different platforms that they can access and choose the meals that they want, if you're looking for a meal in a given state, or even in a city. And or if you want a meal in a specific bank or a credit union, you could go to the dark web app to some of those platforms, identify the mule that you want, and then you pay the new operator, either a percentage of the transaction or a fixed fee. And you can move your money through that mule. And so you know, the dark web has enabled new operators, they guys are in the business of managing new networks, recruiting them to really scalar operations and make that available to local Fox or so that's been a an enabler in the growth of mules in the last couple years. As Dave mentioned, COVID has been a big part of it to not just in the US, but around the world people. Many people were laid off furloughed, you know, financially squeezed so people have to take on jobs that seem to be well paying jobs. And so the the growth in new recruitment and new operations is in very, very significant in the last 12 months. So one of the things that I want people to really understand is, the entire purpose of this conversation is not to scare you, I want you to focus on the fact that not not about the intricacies and the ease of which all of this is happening. But think about the conversation that Ellie and I are having. Think about how much we know about this, there's a reason for that. We're getting very good at money management, money flow, following that trail. And as anonymous as someone tries to be one of the things like law enforcement that I've worked with over the years, various different compliance professionals, one thing they say constantly is that a criminal has to be lucky every single time. But we need to be lucky once. And we know what to look for. So Ellie, could you give an example of the technology has changed for these criminals throughout the years that has made some of these enterprises more effective, it has made breaking into these enterprises, that barrier to entry, almost insignificant. And yet, the technology that we have created as an industry worldwide, has followed suit. So just as sophisticated as these criminals are getting so away, so can you give just just a little bit of peace of mind? What are the types of things that we are targeting, aside from, you know, looking for this mule type of behavior, right, we're looking for these people who all of a sudden have dozens, if not hundreds of financial transactions being wired in and wired out. That one's a pretty significant example that we've done for years. But But what is something either new or novel, or really effective, that we've been doing to combat some of these enterprises? So first, I'll start with this. The the positive side or the silver lining, and everything that I talked about is the dark web is, is out there for us to view for us to track and to monitor. So right hidden in plain sight, exactly. You know, everything that we talked about, you know, we, and there are other folks out there that are actively on a 24 by seven basis tracking and monitoring the activity on the dark web. So we've got some great visibility into who these bad guys are, who are they targeting? What kind of tools and tactics they're using? What are the latest schemes that they're planning? What data or access have they already been able to compromise. So we've got our fingers on the pulse. And that really enables us to then develop and think about the tools and technologies, the controls that we can implement in order to prevent these attacks from being successful. And that's really the key, I think, Dave, what you're getting at what, what the dark web monitoring and intelligence so we can gather from the dark web, what that enables us to do is to be much more proactive. So instead of waiting to see, you know, various types of financial crimes and fraud, a fraud campaigns playing out looking at those signals, and then using those signals, to create new tools are new technologies to defeat fraud, we can now be a lot more proactive. So we can see these campaigns or these ideas in the earlier stages. And then we can think about what is it that we can do right now in order to preempt them in the first place. So that's really the overarching message that, you know, Dave, I want to leave everybody with, there's a silver lining to all this. And the ability to monitor and track these activities on the dark web is very, very powerful, and can really help to feed the problem for the bad guys is they still need to communicate, they need to exchange information, they need to traffic and buy and sell data. And so they need a platform like the dark web to do that they can't do without it. Now, obviously, they can. They can adapt, they can move, they can try to hide and you know, obviously we're always chasing them. But the idea is they need a platform like that. And by definition, that means that we've got a place or set of places that we can go and try to stay at least one or many steps ahead of them. So really, that's, you know, that's, I think, overarching message that I want to leave people with, you know, to give you you know, maybe to talk about a specific example, let's let's use an easy one. I think a lot of people are familiar with, you know, payment card fraud where you've got a merchant that gets hacked or gets compromised and as a result payment card information gets exposed. And then ultimately, there are fraud, fraudulent charges on those payment cards that have been exposed? Well, one of the things that, you know, dark Web Intelligence and dark web monitoring allows us to do is to identify merchants that are being targeted, or merchants that have been compromised in the very early stages. And then you can proactively say, Okay, well, if this merchant has been compromised, or is being targeted, how do we protect the portfolio of cards that were transacted on that merchant in the last 90 days or 180 days? So we can be proactive in identifying those cards that are possibly compromised? Or might be compromised in the future, and then take action in order to prevent any sort of fraudulent charges on those cards? So that's one Exactly. Yeah, but really, if you think about all the financial crimes that we see day in and day out, if we can see the early signs, that's when we can be proactive. And that's when we can move very quickly to mitigate and preempt those activities. And I want to echo, I want to echo something for the audience that you just mentioned. So this free flow of information, it works both ways. Okay, yes. These large databases, as he said, Could have been hacked, and you get a bunch of credit card numbers or whatnot. But that, that dark web, we know how to access it, we know where the information is, we know where the information flows from. So whereas I mean, when he and I started in this business, if you could imagine, there, you were working off of Excel spreadsheets, with 20,000, something lines, like I remember, I think I was 24, when I found out that Excel had a limit. And, you know, and you, you basically, it's like throwing darts at a dartboard. But now, you have just a sophisticated technology where you could take these large swaths of data, and start looking on the dark web for it. And as you said, Take that proactive approach. So if any of you have ever received a text message, or an email, or a pop up in your banking app that says, your credit card may have been compromised, please go in and change your password. don't delete that, read it, listen to it. Don't necessarily take it on face value either. So one of the things and I'm gonna throw this back on you a little bit on how people can protect themselves. One thing, I am constantly constantly constantly trying to pound into anybody who's listened their head, trust, but verify. If someone calls up from your banking institution and says there has been a breach great, get their number, get their name, call the bank back, and make sure that this person actually works for that institution. If you get an email address that says change your password, click this link. Okay, there's multiple ways to change your password, you don't necessarily have to click the link that's embedded in there. Go on to your account, make sure everything is copacetic, called maybe a customer service rep, and have them help you walk through this process. Trust the information that's being given to you in terms of fraud prevention, but verify it that is a huge way to protect yourself. And then Ellie, just based on your experience, and based on fighting crime and the dark web, what is something that people should either be very cognizant of, or what are ways that they can do in order to protect themselves once information is leaked? I think one, one simple thing that can reduce any individual's exposure is using a dedicated device for certain types of financial or other sensitive transactions. So imagine, if you've got a computer at home, that is dedicated just to do online banking, brokerage, whatever it is that's most sensitive, and you're not using that device, you're not using it for email, you're not surfing the web with it. That is an excellent way of protecting at least your financial accounts or other sensitive accounts, because then the likelihood that that device is going to be infected or compromised by malware, or credentials are going to leak out that likelihood is extremely low. So that's a kind of a low tech way that we tell a lot of folks to do. Now, obviously, you know, people today like to do a lot of stuff on mobile devices, using apps, so that might be less convenient. I think the good news is mobile malware still largely ineffective, despite all the hype that you read. So if you are using your mobile phone to do many sensitive transactions, the risk again is significantly lower. And if you are using a desktop, I would recommend get a brand new computer doesn't have to be an expensive They want to cheat compute a cheap computer, use that solely for financial and other sensitive transactions. If you do that, you dramatically reduce the risk of any exposure. So that's a, you know, the first half. First person that's ever actually told me that and you could even use an old computer just wipe it clean. Yeah. And you know that one laptop that really just isn't good for surfing the web anymore. But that that's a perfect use case for it. And right. Well, David goes back to what you said, you mentioned, you know, getting an email or you know, a text message. Still, today, the majority of people get compromised through social engineering. So you're going to get an email, you're going to click that link or you're going to go on a site, and you're going to download malware or something like it. If you have a device that is just dedicated to, you know, financial other transactions, but you're not using it, there's no chance that you're going to contract malware that way. So that's a kind of a low tech way to to reduce the risk very, very significantly. That's awesome. Elliot dominance is the founder and CEO of kusik cyber, and he crime intelligence company that monitors the digital underground like we've been talking about. Ellie, can you please tell people how to get in touch with you or to learn more about your company? Sure. Go on our website. It's q six cyber.com. So it's the letter Q the number six cyber comm or email us at info key six cyber comm we'd love to hear from you. Yeah, the irony is not lost on me. The cybercrime expert just told you to go to his website after talking about the dark web 30 minutes. So thanks again, for listening. Please don't forget to subscribe if you have an idea for a show or if you're even interested in being a guest, we'd love to hear from you. So drop us a line at podcast at nice, atomized calm. Don't forget we have bonus content for every episode, including this one available at atomized, nice calm forward slash podcast. I want to thank Ellie again for being with us and we will see you on the next episode of what stocks in Chrome