Malcolm Nance Saw the Signals of His Typosquatters

Adam, I don’t know if you’ve noticed this, but you have lost a lot of Twitter followers lately.

Oh, every time Elon Musk says or does absolutely anything, it goes down by a few hundred.

Yeah, you haven’t been noticing, but you’ve lost, you’ve been hemorrhaging. And so have I.

Listen, he’s perfect for my ego. I feel like he’s my PR guy these days.

Now, here’s the thing, he is everywhere. I mean, literally, there are thousands of Elon Musk accounts now. Is Twitter a ship on fire, but the flames are invisible, except we can totally see them and it’s sinking?

Yes, totally. I mean…

Okay.

It’s going to be interesting to see all the new security risks we’re going to be dealing with in the new era of Twitter.

Well, today we have a story with one of your favorite media guys turned Legionnaire. And he’s got a Twitter story, and I think his story that happened on Twitter, nowadays is even more likely.

Welcome to What the Hack, a show about hackers, scammers, and the people they go after. I’m Adam, Cyber Avenger.

I’m Beau, Cyber biting down on a pitless prune, but finding a pit there and breaking your tooth.

And I’m Travis, Cyber… one second. That one was far enough out of left field and I was going to be like, “Cyber defender.”

And today we’re talking Twitter. It strengths, weaknesses, and what happens when intelligence expert in media pundit, Malcolm Nance, is on that platform, while he volunteers to fight in Ukraine.

Malcolm, we are incredibly excited that you’re on the show. We’re incredibly excited that you’re back in the United States, which we’ll get to in a bit. And I have always been a big fan of yours, your books, your appearances on MSNBC, the work you do in counter-terrorism. And so it’s really awesome to have you on the show today. Where are you coming to us from? That’s assuming you’re allowed to tell us where you’re coming to us from.

I can tell you where I am now. I’m in Hudson, New York, which is just up the Hudson Valley, about two hours out of New York City. About 25 miles south of Albany. And I’m finally here, I haven’t been here for 10 months. So if your audience doesn’t know, I left MSNBC and I joined the Ukrainian Army as the member of the International Legion, which is the Ukrainian Army Battalion of foreign volunteers who came to fight Russia.

And what made you decide that?

Before the invasion I spent a month in Ukraine studying the Russian Order of Battles, studying the routes of invasion, formulating my own version of what was going to happen. And I was going on air and telling people.

…I’m going to start with you, Malcolm, because you are in Ukraine. This is not a made up thing. This is really happening. You are there. Tell us what is happening and how the Ukrainians, who you are talking with both military and non, are reacting to all that is going on.

Well, let me clarify some things. I’ve been here a month in studying the Russian Order of Battle and the routes of potential invasion in this country. Fortunately, quite possibly by the time you and I talk again on the next show, we could be moving along with about 5 million refugees away from a Russian onslaught that’s designed to, not just knock down Ukrainian government, but also kill Ukrainian citizens by the tens of thousands. This could be the single largest inland war since World War II.

There was this different picture that was being formulated in US News. And it became very clear to me that they were heavily invested in invasion, and that the Russians would take Ukraine and they were bringing crews in that were setting up in the Intercontinental Hotel. And I had spent that month there, I had gone to the Battlefront [inaudible 00:04:26] with the two commanders at the time of the Ukrainian army.

And this was when you were with MSNBC reporting?

Yes. Right. And this was from last week of January to the day of the invasion, on February 24th.

How would you characterize the difference between the media reports on what was going on, and what you were actually seeing?

MSNBC went to this election day style coverage, trying to do the Steve Kornacki Big Board. And I just literally spent a month analyzing how this would go down, and it’s happening precisely as I had put out on Twitter.

Well, what you don’t know Malcolm, what you may not know, is I follow you on Twitter, one. Two, I follow everyone you mentioned on Twitter. Now, I swear Twitter knew you were right, because all a sudden all I saw was you in my feed. And what I was seeing in my feed, I just was reliving the whole invasion because I saw you report everything through Twitter. I have to ask, as an intelligence expert, was Twitter the only way you had to actually get the word out at that point?

Yes. I mean, MSNBC had switched coverage and they weren’t listening at all. They were completely and 100% invested in the election day style coverage.

So let’s talk about Twitter because yep, there’s a lot that’s been happening there right now, but it’s also been a very important tool for people like you.

Right, yeah. Unfortunately, if any of you know the myth from Greek and Roman mythology of Cassandra, who somehow pissed off the God Apollo, and he gave her the gift of foresight, where everything she would see would be true. But he also made… because God’s are mischievous this way, made it so no one would ever believe her. So no matter how accurate you were, you were never to be believed. After a while, I started thinking, “What did I ever do to piss off Apollo?”

I mean, I was literally reporting, “Hey, so here is the rate of advance on a T72 column going down from Chernihiv. You have to bypass the city of Chernihiv, because there’s an entire mechanized infantry brigade that will allow them to pass to the west along the reservoir, because it creates this enormous kill zone, right?” And, “We don’t care about that.” So I was putting it out in Twitter like, these guys are going to get slaughtered. I drove that road, it is nothing but a death road. The 40 kilometer long highway, remember that story? They were calling it the 40 kilometers?

Right.

I drove that road. It’s a simple, single strip tarmac that one SUV could get down, and it was in phenomenally horrible shape, there were potholes everywhere. And I thought, “They’re on this road. Are they stupid?”

So there’s a whole part of the war we didn’t even see that was happening online.

As we all know, there’s enormous upheaval at Twitter.

Yes.

Right now.

Mm.

And the jury’s out on how bad or how good this is going to be.

Is it a question?

What? Meaning whatever’s happening, it’s producing some of the highest, most, how do you put it? Some of the most costly jokes.

True.

Oh my gosh.

Big pharma, what did they lose? 5% of their value the other day by a single joke. The prank of giving away insulin, Elon Musk brought this on. So it’s going to be very interesting.

Oh God. It’s like the back alley of a dive bar outside of a clown conference.

Twitter has real consequences.

Yes.

Not too long ago, somebody was impersonating you on Twitter, pretending to raise money for charity, right?

People saw that we were raising money for the International Legion. And what we had was Typosquatting. People had come in, would create a Malcolm Nance, only the first letter L would be the number one. Twitter was a lot more responsive then than it is this week. But we had people coming up and just like, “Yes, you can donate to the International Legion. I take Bitcoin.” It’s like I don’t take Bitcoin for very obvious reasons this week. But there were a lot of opportunists out there who saw Twitter and the people’s need to want to contribute, their belief that they were contributing to a good cause. So there were at least nine fake accounts, not including the ones on Instagram and Facebook, where people came up and did these Typosquatting types of things. One of them had like 300 followers, almost as if I had erased my Twitter profile and started again. And of course we had to go out on Twitter and say, “Hey, I only accept donations at tapstri.org, and I only operate on Twitter. I do not post on Facebook, Instagram, even though I have accounts.”

No. And you have, last time I checked, over 1.1 million followers and rapidly growing.

It’s growing.

How many instances of Typosquatting occurred during that period of time to your Twitter account?

Not as much as many other guys. You had guys like James Vasquez who was a territorial defense guy, American that went out there who was posting videos of his combat. And I will tell you guys this first, people are like, “Well, yeah. You’re not there fighting, where’s your combat footage?” Well, in my crazy world of espionage, one thing we…

You don’t do.

…tell everyone what we’re doing. I think I’ve put out three photos in the entire 10 months that I was there, including that short little video that became famous on Russian television.

Oh yes, you were quoted on Russian TV as I remember.

[Russian 00:10:56]

What now bitches?

[Russian 00:10:59].

Which was on the first day of the Kharkiv invasion. And I’ve since had some really crazy things said, they were like, “Oh, you’re supposed to be special forces, but you’re far behind in the rear with the artillery.” Well, in fact, that invasion went so fast, that was around noon or 1:00 PM that day. We had been in the field since four, and the line collapsed so fast that artillery moved up in six hours from its firing positions. They had to move 25 kilometers ahead of where they should have been. And we were, because we were reconnaissance, about to be pulled off the line and then redeployed in a leapfrog fashion about 50 kilometers beyond that.

I have a question about the chances of Russian state actors, these freelancers, being in some way behind the Typosquatting that you experienced it. Is that possible in your mind?

It’s possible. But it’s interesting that when I started getting a higher profile, the people that attacked me the most at first were right wing Americans. And they were really ridiculous lines. When I did my video where I announced on Troy Reed, it was at 2:00 AM during an air raid at night, it was freezing, this is April in Ukraine. And these guys are like, you didn’t seat your AK47 magazine completely. Well, I had just cleared that weapon three times, right? Because I was like, “There’s not going to be an accidental discharge of a rifle on Joy Reed, live from Ukraine.” So take the magazine out, put it in, rack the bolt, clear it, three times. And then two minutes before the air time, I did it again and didn’t seat my magazine in. And then all these right wing crazies are like, “Oh, he’s fake. He didn’t seat his magazine, there’s no magazines in his pouches.” It’s like, “Yeah, that’s true.”

So in other words, these are the same guys who also said that we didn’t really land on the moon, right?

By the end of July. The people that were going, “Oh, you’re uniforms completely clean.” It’s like, I have a photograph, I’m nasty in this photograph. And they’re like [inaudible 00:13:19], and that’s their criticism.

Do you believe that some of the criticism was basically troll farms?

Yes. And that’s what I was going to say. At the end of July, I started seeing random people from Latin America in Sub-Saharan Africa, guys who’ll have like 5, 10,000 followers suddenly criticizing me. They’d be like talking about Korean boy band for most of the post, and then the next one would be, “You’re a larper, your magazine wasn’t seated.” And I’m like, “That was in April, this is July. I’ve got loads of magazines now.” I found paid trolls who were influencers in Sub-Saharan Africa, particularly Nigeria, Mali, some guy in Uganda, who were clearly being paid by the tweet.

And it had nothing to do with everything else that they were tweeting about. They weren’t even tweeting about politics. It was suddenly, “Oh, you are fighting for the Ukrainian Nazis.” And the purpose of that was I had shown up as the most noteworthy of all Legionnaires in the world. I was one of only four, five black guys in the entire international Legion, and had just shown on television in April that I had left news media to join the Legion at a time Russia was pushing the narrative that the Ukrainians were racist because of all the glitches that happened to people that were leaving the country.

We don’t know who did the Typosquatting here. How did you find out that it was happening?

Mainly my followers. You got…

Okay.

… plus followers. People are going to go, “Hey man, are you aware there’s a guy who’s mimicking your name?’ And I was getting a lot of those. And again, these Typosquatters I suspect were the same sub-Saharan African influencers.

Well, I got targeted. So just so you know, I several times was like, “Do you want to follow Malcolm Nance?” And I was like, “I already do follow Malcolm Nance.” And I don’t think that the Russians knocked him off of Twitter so…

No.

Go away.

How quickly did all this happen? Was this over the course of a day, a week, a month?

Well I mean, they were popping up over maybe one or two times per month. Means that the effort… I didn’t think the effort was organic to Russian intelligence. I saw way more effort of Russian intelligence with these influencers.

What did you do to fix or mitigate the Typosquatting?

No one who’s working in the illicit world, whether its hacking, or Typosquatting, or hreaking, whatever your method of attack is. You don’t want day la. And if [inaudible 00:16:19].

Right, Brandeis strikes again.

If there is a thing that I’ve learned in the intelligence community is we do not like daylight.

Mm-hmm.

Right.

So an operation… And this is why I felt that the sub-Saharan African and Latin American influencers were clearly a surrogate operation of Russian intelligence, clearly getting paid by the tweet, because the things they were tweeting blended into whatever the politics du jour was. Ukraine insulted Nigerians and wouldn’t let them leave. And that was a big issue.,I actually had to speak to the foreign ministry on that issue. And then these guys would jump in and start tweeting about that of, “You being with the Ukrainian Nazis you’re a black that’s with Ukrainian racists.” That was intelligence based. Typosquatting I think were those individuals who were like, “Hey, I’ll just try to collect up some of his donor money and buy myself a new Maserati here.” And believe it or not, Jamaica is one of the largest typosquatting, fake news, criminal organizations in the Western Hemisphere now. The number one form of illicit money dealing is no longer marijuana, it’s telephone fraud and cyber fraud against the [inaudible 00:17:48].

Now here’s the thing, whether it’s coming out of Jamaica or Jamaica Hills, Plains, Queens or down in the Caribbean…

Jamaica States, yeah.

Jamaica States where Trump is from. So it doesn’t matter where it’s coming from. I got the sense too that the Typosquatting was more just sort of garden variety fraud and opportunists looking to make a buck off of a situation where there’s some familiarity, they know this is something that people will bite on and so they do it. Now, if we’re talking about protecting ourselves, which is what we do with our listeners and being prepared, I have a hard time thinking about what to tell our listeners when they’re like, “Well, what happens when this happens to me?” And my first reaction is like, “Friend, it’s not going to happen to you. You’re not Malcolm Nance, you’re not a foreign Legionnaire. You’re not going to fight someone else’s war. You’re not one of the only black guys there. You’re not famous. Yada, yada, yada.” What can listeners learn from this?

Well this is just an issue of scale. I mean, obviously big brands, companies, public figures will probably have to deal with a lot more of this, but everyone’s a target. Even though it’s less likely, versions of this happen every day to people like us.

I fired an employee this year and I suspected one of those accounts was that employee.

Whoa.

So…

Inside job.

It’s always room. And it’s a person who used to be a friend of mine.

And if you’re listening today, you didn’t get away with it.

That’s right.

No, they did not get away with it because I had enough early warning out there. Once a week, you should do a search for your name on Twitter, Facebook, TikTok.

That’s great advice.

I had one mimic out there who has literally copied everything, who had three followers, and it was an exact replica of everything that I had on Twitter. Perfect. They took everything and put it up there organically to themselves. I now rotate my photo. First I use the little nafo cartoon character of me, then I put photos that can only be of me. I’m clearly in Ukraine, I’m wearing a durag, right? My US Navy durag. No one could say they took that off of social media. Because another thing that I do is, because I come from the intelligence world, I control all the imagery of me in social media. Good too.

Putting stuff up willy nilly on Facebook and Instagram and TikTok videos, you need to know they exist. If you’re an organization, you need to know what your PR team is putting up there. Carefully curate what’s out there so that wild images of you or your staff aren’t just in a place where they could be manipulated. So your listeners should understand that threat, that it could be a relative, it could be an ex-employee, it could be a competitor who wants to [inaudible 00:21:02] Eli Lilly thing.

It could be your neighbor who doesn’t like the way you keep your lawn.

Total, 100 percent.

So Malcolm, what do you make of the whole verified Twitter thing? I mean, paying 7.99 to keep your blue check. What is that going to do in the future? Because I already follow 29 Elon Musks.

Yeah, it’s awesome.

I hope you found one you like.

I hate them all.

No, there’s some pretty funny ones, which shows you it’s not Elon Musk.

Yeah, exactly.

Okay, but what’s your strategy around this?

Well, it’s very simple. I mean, I have 1.1, 1.2 million followers, so I’m doing nothing. My strategy is to keep putting information out. I retweet a lot and I actually had people complain, “Hey, you don’t tweet enough.” No. What I’m retweeting is the data points that I use to analyze intelligence of whatever the subject is. So you should pay very close attention to what I’m retweeting. The people who do have all day to put tweets out on willy nilly. But the whole, “Is Twitter about to collapse?” It is a private business, he can do what he wants. I’m going to stay on board to watch this ship sink by the bow and break in half if that’s what [inaudible 00:22:26].

But you never know, I mean he may go into bankruptcy, sell it, and Twitter may go back to its fundamentals. People want influencers to go to Mastodon, they want influencers to go to other areas. And I’m just not… anything that’s as developed as Twitter. It’s just that now Twitter with no guardrails for 7.99. And it’s possible Malcolm Nance clones could pop up there, but that’s the sort of thing that you have to be on guard for. They would happen anyway.

No, and you should be looking at Mastodon now for your supposed account there. And Mastodon isn’t that… It’s not just you but everyone. And it’s also not that simple. If you’ve signed on to Mastodon, you know there’s different channels, there’s different places you can be, there’s different communities you can be a part of. And so, staying on top of it for an influential such as yourself starts to look like a full-time job.

Well, it is a full-time job. I’m not doing it myself, of course.

Right.

And in fact, anybody out there, I’m looking for a new webmaster and a social media director. But it’s just one of those things where if you value your brand, you need to know what’s going on out there.

I know we’re wrapping up, but is there any scam or hack that you see that you’re afraid of, that you sit there going, “I worry for our country, I worry for consumers, I worry for businesses.” Is there anyone in particular that really scares the hell out of you?

Or, “I worry my new social media director is not going to be able to not fall for this?”

To be quite honest, now that Elon Musk has removed all these guardrails, you do have a multiverse of imposters that could come up. And as you saw what they did to pharma the other day cost real money. Eli Lilly wasn’t the only company that took it. All pharma companies went down, they lost value, I think some $5 billion or something like that.

All over a fake price man.

On the basis of a single sentence.

Amazing.

Amazing.

Lockheed Martin announced that it was going… or a fake Lockheed Martin announced that it was going to stop all sales to Israel and Saudi Arabia. It lost market share.

Now you see here an opportunity for boiler room type operations, mafioso whatever. Sorry, mafioso. I like you. And you don’t exist. But you see an opportunity for people to short the market or do all kinds of crazy things.

Absolutely. And people have done that before, and they have a role model. Elon Musk himself has shorted [inaudible 00:25:26] on the internet by pumping up currency, by coming out and making statements about his activities. Now he’s seeing how the other side that some guy who’s in a basement… and it may not be about Eli Lilly, it may be some fifth, sixth tier subsidiary that could lose [inaudible 00:25:46]. And he’s been sent to make sure they lose their shirt at being paid 5, 6,000 bucks.

Oh, a hundred percent. And also all the people who during the Trump’s four years where it looked like every day he was telling a different friend what thing to short.

Yeah.

Oh, I certainly felt that.

Now note all you defamation lawyers, I said looked like, seams. I did not say did.

That is correct.

Everything that I did when I was at NSA and the other A’s in the US intelligence community, I always looked for whatever system de jour, whether it’s a cruise missile or whether it’s cyber warfare or propaganda. How is it… weaponized is not a good word. All right. Weaponized means you’ve just turned it into some sort of device. In my world, the phrase is target tiering. All right? How do I select that weapon to be applied against whom, when and how?

And when I look at what’s going on in the present world, real damage, real cyber damage that we thought was going to be done through hacking electrical companies, can happen when there’s a real event or even a minor version of an event. And then these weaponeers who have target tiered a particular industry, a branch of government or a state actor, and then flood the zone with disinformation and misinformation. Good example, this is what I’m waiting for, I’m waiting for some event to happen. And somebody somewhere comes out 20, 30, 40 different news organization mimics, that’s the word that I hear is a mimic. Those mimics come out and say a nuclear weapon has been detonated in Kiev, Ukraine.

And not 1, 20. 30. People claiming that on NBC News Lviv, we’ve lost all communications with blah, blah, blah. The panic that would set in. Zelinsky on TV would not be able to stop that panic.

They we’re talking about essentially what happened on radio with War of the Worlds.

War of the Worlds. Yes. Good example. Only problem is it would really start looking like Tom Cruise’s War of the Worlds right? Bodies…

Yes.

So I worked in some of the more critical components of the United States government. I pulled a short tour at a national nuclear command post, and as we’re sitting there, you can imagine the watch sitting there looking up at the Big Board, going to watch officers around the world, nuc det, because we have the capacity to see a nuclear detonation. And aircraft would have to be launched and scrambled to quintuple check whether this is a lie or not. Cabillions could be spent and lost with a concerted effort of 7.99 clones of half of Europe’s major news agencies pushing out a false story.

Thank you. Actually, I’m going to say this. This was the equivalent of eating the hottest salsa, like drinking it down right before bed. I really appreciate that. Thanks. It’s going to make for a great night’s sleep.

Malcolm, we could go on forever because this is fascinating stuff. I can’t thank you enough, first for coming on, and secondly for giving beau super hot salsa for his late night burrito.

My burrito of… like an existential burrito.

And now it’s time for the tin foil swan.

Our paranoid takeaway for listeners.

So what is it this week, Travis?

Well Malcolm did talk about Twitter scammers using Typosquatting to fool people online. So let’s talk about that.

Okay. So all right, just in case it wasn’t clear, what is Typosquatting?

It sounds like an exercise you do in your office.

Mm-hmm. Okay, Adam, but I noticed you didn’t say, it sounds like an exercise that you would do in your office.

Obviously.

Typosquatting’s a scam that uses the URL address to trick people into a visiting a spoofed site where they can further trick that user to handing over sensitive information.

The URL is the address box up top on your browser.

10 points for Adam.

It can also focus on social media handles. For instance, a Typosquatter might spell Malcolm Nance, substituting a one for the first L, and a lot of people won’t see that.

So it’s a social engineering technique.

Yep. And since we talk a lot about Russia in this episode, it’s fairly common for a Typosquatter to use a letter from the Russian alphabet.

Cyrillic?

No thanks, I already hate.

Anyway. Yes, the letter A in the Cyrillic alphabet looks similar to the A in the Roman alphabet.

So what can people do to avoid being tricked by that?

Just check for spelling errors.

That seems too easy.

Browsers use easy to read fonts for accessibility, but they’re very small. What you’re looking for is a number or letter that looks a little smaller, maybe italicized.

So I guess pretend you’re a mouse checking out a snack during trap season. It sounds not that easy.

It’s a lot easier to see an error in a fancy font. So definitely look closely at lengths on the sites you visit, particularly if they aren’t high traffic venues. Right, Beau?

Well, yeah. But also go slow. If you’re in a hurry or not paying attention, a misspelling or an out of place letter may not stand out to you, but it will if you go slow enough. So do that. That’s my best advice.

Absolutely. Especially if you’re going to be sending money. Look, Malcolm’s stories remind me how unnerving the situation in Ukraine is for anybody following the news. People want to help. And that’s where scammers move in.

And they don’t need to be all that cyber savvy either.

Not at all.

And that’s this weeks tin foil swan.

Yep. Slow and steady wins the race.

Hey, it really does help people find the show if you rate and review it. So wherever you go to get your podcasts, hit the five stars and say something nice about the show. And if you don’t have anything nice to say, don’t say anything at all. Thanks. What the Hack with Adam Levin is a production of Loud Tree Media.

It’s produced by Andrew Steven.

You can find us online at adamlevin.com and on Instagram, Twitter, and Facebook at Adam K. Levin.