That time we talked about digital security

This is episode number 4 of The Homeowner Show. Whether you're DIY or looking to hire, we're here to help you find the best information and options for you and your home. My name is Kevin Hackett, and here with me is my friend Craig Williams.

Hey everybody, this is The Homeowner Show. Glad you guys could join us today. I think we have a really cool and exciting topic for you guys today. I'm excited to dig into it. How you doing, man?

I'm doing good. Things are, things are good.

I just, I started, I almost completely forgot about you.

No, I'm over here. Yeah, I hadn't gone anywhere.

Still here.

Yeah, it's fine. I'm doing well. Nothing, nothing super interesting to tell, to update on. Yeah, life's just rocking and rolling. How about you, man? Things going good?

Yeah, things are going really good. Yeah, from a couple episodes ago when we did the, the Ecobee, I decided to brave the turbulent waters of my house and I went and got the thermostat. Did you really? I did. It was a—

Good for you.

Little birthday present to me.

So you were sufficiently convinced?

I was sufficiently convinced that I needed to have my air conditioner work, yes.

Oh, that's good. So how was it? I mean, did you install it yourself? Did you hire someone to do it?

I did. And I know, I think we spent a little time talking about the C wire.

Yes.

And I, I didn't have to even do that. I mean, I was really surprised that I didn't have like gerbils in the walls spinning to provide me power. It was, you know, it was super— it took me like 10 minutes to put the thing in and like another 5 minutes to— with the app. And, um, yeah, went out that evening. I, I think I left the house that evening just so I could play with the thermostat while I wasn't here.

Nice. So it worked.

It worked.

No problems.

It's still currently burning. Yeah, I was afraid the house was going to eat it. It just gave it a little heartburn. It was, it was fine.

That's good, man. I'm glad to hear that it was easy to install and no issues with the app, that it worked well.

Yeah, no, I've got a couple apps playing with it right now.

Okay.

Yeah. The phone hasn't caught any of the house's diseases yet.

Oh, that's good.

Yeah. So, but yeah, so we have a really cool episode and it's a little bit different because I think typically we're gonna be talking about like home repair and home projects and different things that you can do to your home. But this one to me is pretty relevant because we're gonna be talking about the digital security of your home. I mean, like, sort of the Internet of Things and all the devices and, and, and how those integrate in your life and how those can be a risk. And I was gonna say, we have, uh, our good friend Micah in the house tonight. Micah, you can go ahead and say hello.

Hey guys, thanks for having me.

Yeah, thank you for being here, man. We are, we are really excited.

Yeah, hey, you know, I think this is, uh, one of those topics where, um, It can be real daunting to start talking about, uh, security. And, you know, all of our, our, our lives are connected. They're connected to our phones, through our, you know, thermostats, right? Through, uh, our, our gaming systems, through, uh, our doorbells.

Yeah.

I mean, there's so many things that our, that our lives wouldn't run off of these days if we weren't connected to this thing called the internet, the Wi-Fi, right? So, um, yeah, I mean, I'm real interested to talk about—

Did you just call the internet the Wi-Fi?

No, I, I know you weren't even listening. I said connecting through the Wi-Fi.

I got on through the www.

Through the Wi-Fi, man. So yeah, I'm, I'm super interested to see what, what he has to talk about today.

Yeah, and so we've got, uh, let's just kick it off right here. So we've— I've got right here my little, uh, Alexa puck. The Echo, very cool device that is in your home. And so, Micah, why don't you just go ahead and— and so we're talking about devices like this. These are the things that I think are becoming more second nature to everyone in sort of their daily lives and their— I call them interactions, but it's not really with a person, it's with things. Yeah.

Yeah, yeah, sure. So just to kind of give you some background on where I come from, I've spent a long time as a computer programmer. I got a computer science degree in college, and my life's ambition was to go out and create things on the digital landscape that was developing at the time. I actually saw the birth of the internet and the expansion of it in the '90s. So, at that time, security was almost kind of a second thought. Nobody was really worried about security. There weren't that many devices connected. It certainly weren't devices in your home that were connected to it. The internet was built to be more reliable than it was secure. It was designed originally so that if the worst case happened, they could figure

out a way to keep the data flowing, to keep the thing up and running. So that was kind of the mentality that we grew up with and kind of the first introduction to it. Security wasn't really on anybody's mind. But, you know, pretty quickly as commerce started getting on board with the internet, we started really passing around real dollars on the internet and real things, and security suddenly became a really high priority. I started a company kind of early on in my career that developed internet applications and software and integrated them into commercial applications and companies, and that was a lot of fun, but security became kind of an increasing concern as the years rolled by.

And then about 13 or 14 years, I fell into a niche actually in the video game industry in security, trying to make sure that the video games, when you played them online, that you were playing against another person and not against some computer program, right? A hack or something like that. So I spent a lot of time in that arena learning the video game industry, learning about securing that for a lot of different reasons. But it's the same reasons that you secure any sporting event. You know, we had Lance Armstrong and his whole debacle and all of that. So we're trying to protect the integrity of these competitive online sports.

Guys, 5 minutes in and we're already dogging on Lance Armstrong.

Every episode is Lance Armstrong.

I'm surprised it took that long.

Yeah.

And it makes a great example, real-world example for some of the stuff that I went through for, you know, 13+ years on that. So I gained a lot of experience with it, but it's no longer something that we take for granted, security on the internet, because so much of our lives are connected to it and the implications of just ignoring it or saying it'll take care of itself are a lot greater. than they used to be back in the early '90s when we weren't quite so connected as we are today.

Yeah, so that's one of the big questions that I've really got is what are the risks? Because I think normal, just everyday people that are connected to Wi-Fi in their house and they think, okay, now my phone works, now my TV works, I can watch Netflix if I want to, so my life's good. And they don't necessarily think about the risks that are out there. I mean, one of the things that's kind of scary to us with small kids is that we wanted to make sure that the baby monitor that we got was not Wi-Fi enabled because we read online about people hacking into baby monitors and watching your kids. And so it's—

I think there's even been some stories of like guys that like get in there and like start talking, right, to children through those things. I mean, like, it's, it's a serious, serious problem.

Yeah. So, so my question, Micah, is What are some of the risks that we ought to be concerned about?

Yeah, well, it's a really broad question because it could be a lot of different things. And if we're talking about the context of your house and your family, that's kind of a process that you have to go through yourself. And I do encourage that. I do some training on physical security, not just digital security. And when we do the physical security side of things, we do kind of an assessment. We look at what we call our assets and our threats and our vulnerabilities. We kind of categorize those into 3 things and Kevin, what you're talking about is, is our assets. You know, what are the things that are important to us? What are the things that are valuable to us? What are the

things in our house that we want to protect? And our children and their innocence and their safety is certainly, if not the topmost asset in our houses, it's very, very close. It's got to be the top, right?

Yeah, it is.

You may not want to categorize your, your kids or prioritize them, but they're, they're all very top. high-value assets. But underneath that, there are other things that might not be so clear unless you stop and think about it. So, you know, do I have some antiques in this house that are irreplaceable? That might be a high-value asset that you might want to consider. How is it being protected? Do I have a lot of cash hanging around the house? You know, do I have a couple thousand dollars hanging around? That's another asset to consider. Do I have jewelry? Those sorts of things.

Firearms.

Firearms. Yeah, for sure. Lots of value in those sometimes. So, you kind of, you go through that process, you decide what's in the house that's really valuable, that might be irreplaceable or very painful to replace. And then you assess, what are my threats? What are the things that could possibly take these valuable assets away from me? When you talk about a house, the common things are like fire. Fire is a threat, right? So, that's something to consider. Flooding, most recently, even around here in kind of the Houston area, we've had to really consider flooding as an issue. destroy things. Burglary, you know, break-ins— those are certainly things to consider. Our children's innocence is kind of an

asset, so we need to consider what are some of the threats to those. When you are connected to the internet all the time and you have multiple ways of accessing the internet— your children are smart, they're probably smarter than you these days, whether you like it or not. They know how to access the internet, and it's not just a matter of the computer on the desk. It could be the smart TV or the phone that you've left unattended, uh, or the game console, you know, that's, that's sitting over there. Um, so lots of different avenues and, and to consider. Um, and then you have the, the whole vulnerability side of things. So if we go back to the example of the, the fire, um, and maybe an electrical fire,

uh, are my— why is my wiring outdated? You know, is there something wrong with the outlets on the wall? Um, do I have fire extinguishers in the house? Are they charged? Do I know how to use them? That might be a vulnerability. If a fire breaks out, I'm not going to be able to handle it. On the internet, do I have a firewall enabled to prevent people from hacking into my network? Do I use content filtering, you know, to keep websites that I don't want my children, my family exposed to out of the network? Those sorts of things. So we kind of break them up into those 3 different sections, and that gives us a process to work through so we can prioritize how we're going to spend our time and our resources

to kind of secure that because you can't, you can't secure everything all the time, right? That's, that's just impossible. But you do want to make sure that you secure the most important things first.

Yeah. And I think a lot of people's mindset, you know, is, is based around their, you know, their home PC or their, their Mac or like whatever their main computer is. And so, and I, I think some people are like, well, as long as I have like AVG or something like that on there, I'm good. Right. And is that, is that a good baseline or like, are we— yeah, we need to, we need to, we need to up the—

Well, so we can get into the nitty-gritty of what's good and what's bad. And I'll have my own personal opinions. And sure.

And I think maybe what I'm speaking of is, is antivirus software enough? And I think you'd probably say no.

I would say no. In fact, I would prove the point by saying I don't run antivirus software on any of my computers. And the reason that I don't is typically it creates more issues for me in the usability of the computer than it really saves me from doing anything. But I do practice other things that prevent me from getting a virus, and I haven't had a computer on my virus probably for 25 years or better. But I'm maybe a little different just because I'm in the industry, I'm in the space, and I'm kind of comfortable with doing that.

Sure.

But yeah, you know, it's about risky behaviors. You know, you don't go to websites that you know, may be doing something malicious. You know, you don't visit those websites. When you go to your bank's online website, you make sure that, you know, you're doing it over HTTPS, that you have an SSL secure connection, which most web browsers will show you if you're securely connected or not. Try not to access your online banking over Wi-Fi at Starbucks, right? Because you don't have really good control over that network. You're not guaranteed that there's not somebody sitting there in the middle watching everything that you're doing. So, Safe practices, making sure that you don't do something that's risky. Make sure if you're doing your online banking, do it with your own computer. Don't borrow somebody's computer. Don't go

to the library and use a public computer because you don't know what's installed on that. So a lot of precautions that I do that way that you can do irregardless of the software that you have installed on your machine.

Yeah. So clarification here, and really this is because I want to figure out if I'm being stupid, which is usually the case. So don't access my bank accounts via the Starbucks Wi-Fi, which I've never done. So would there be a difference between that and like just my cell phone, its cellular signal?

Well, here's the thing is that the transactions are all secured over SSL. So that's a secure way to communicate with any website, even if you're on a compromised— technically, if you're on a compromised network, it could be. It's varying degrees of security. Like, do I want to take a chance that there's somebody in the middle that's really doing something nefarious? Probably not with some of those bigger assets, my savings account, my checking account, all the hassle there. So, if I can limit myself to only doing it on networks that I trust, that have computers that I know I have control over, do that. The apps and stuff that you have on your phone that the different banks

give to you, they will claim that they are secure. Probably for the most part, they are secure.

Sure.

But for me, I just like trying to roll things back and make them— expose myself as little as possible to a possible hack.

Yeah.

You know, as in the security industry, we always try to do the best that we can when we program these things, when we write the source code to make these things secure. But nothing is perfect. You know, we always have something that we've missed or forgotten or that there's a vulnerability. And we see that all the time, you know, announcements of credit cards being stolen from different retail stores or a vulnerability in a browser or this or the other. So the less surface that I can give to my digital life, then the fewer points of contact that I have to protect in order to, to not be compromised.

Yeah, I think today there was a story about Uber that they had to— I think there was a huge fine. It was several million dollars they had to pay for because they— it finally came out that their, their data had been breached and they hadn't reported it and just let that data go without reporting, hey everyone, your information is out in the open.

Yeah, and that actually used to be okay. I mean, that used to be— there wasn't anything illegal about that, but there are actually laws now on the book that if you have a breach of data, you are required by law to notify the customers that that's happened. So, I think that's a benefit. I mean, I want to know if my banking information has been compromised so that I can take actions to shut stuff down and reset stuff to make my assets more secure.

Yeah. You've already answered some questions of mine, but I would venture to guess that a lot of listeners, they probably are more aware of their computer and potential threats with their computer because we were told to install antivirus software. We were told to not go to certain websites or whatever. Or maybe we've gotten a virus before and someone said, well, it's probably because you went to this place or that place. So as we kind of move past computers though, we have to recognize that there are computers in all of these other devices that are connected, but there may not be a web browser connected to your Amazon Echo here, at least physically with a screen connected to it. So what do I need

to be concerned about whenever it comes to some of these other devices?

Yeah. So we live in an age now where every little thing, like, you know, we're looking at the Alexa hockey puck here and that thing is super tiny. I mean, it's no bigger than like the, you know, the stapler that you've got there on your desk. But there's so much processing power in each one of those little devices that they can do things that we never thought we'd be able to do in such a small package before. So that's really tempting for the reasons that it provides a lot of convenience in our life. You know, Craig was talking about He can control his thermostat now from his smartphone wherever he is in the world, which is really handy. We know due to things like

digital locks, Amazon can now deliver things and put them inside our house because they can unlock our front door. They're trying to reduce the number of packages that get stolen off our front doors.

Now, to be clear on that real quick, you have to have a certain setup before Amazon can just deliver inside your house, right?

Sure. It's highly tracked and monitored. There's even a camera that'll show who it was that opened the door.

Okay.

Yeah. So it's not like it's just carte blanche to get in your house and enjoy a glass of milk or whatever. But in the name of convenience, it has opened up another avenue to your house for somebody to exploit. I used to say that it's not going to just be Amazon that gets in your house. Well, if there's an exploit in the code that doesn't work right or a security workaround or something like that, then you've allowed somebody to basically get in your house in a pretty easy manner. So we have this tension between securing our lives and having a convenient life, and it's, it's like 2 ends of a seesaw. You know, the more convenient

things get, the less secure things get, potentially, especially early adopters of technology. So when the industry comes out with some new device that makes your life much easier, I guess we For me personally, I'm going to let that first generation kind of go by and wait until they work the kinks out and let the guinea pigs kind of be the guinea pigs. And I'll come back once it's kind of established and I know the risks. So that's, that's something I kind of personally do. I don't, I don't try to be on the bleeding edge on a lot of that stuff.

You know, I'm with you on that. Specifically, whenever it comes to things like new updates on, on phone software, a lot of times I'll wait till some of the kinks get worked out before I download that new update. I've got an iPhone. I've also got an iWatch, but I waited till the second series of the iWatch came out before I got one. So yeah, I, I'm kind of with you on some of those things. But it's really easy whenever we find a piece of technology that we go, okay, that's going to make my life easier. It's going to make my life more convenient. So I want to go get it. And we do sometimes without recognizing the vulnerabilities that that sets us up for.

Right. So one of the things to kind of work out of your vocabulary is it can never happen to me, or it's not that big a deal, or I have nothing to hide.

Yeah.

All of those sorts of things kind of set you up for a mentality of I can just kind of throw open the gates and it doesn't really matter. You have to kind of think a couple layers deep. Well, if they compromise this device and it's a security camera, I don't really care if they're able to get into my security camera, I'll catch it eventually and, you know, update the software or, or block them or something like that. But this is your family that you're talking about. I mean, you want some unknown guy, you know, looking through your cameras at your family as they're going about their daily business? I— to me, that creeps me out. And thankfully, it creeps my wife out too. So we're both like, no cameras in

the house whatsoever.

She's good with just one guy looking at her.

Yeah, exactly, exactly.

And then sometimes, right?

So So for me, you know, I, I am in the industry, so I kind of have a mindset of thinking second and third layer. Like if this is compromised and they can compromise this, then they can get this information, this data. For the average person, they may not be able to think that way. So I would definitely encourage you guys, you know, to get on the internet to search for some of these cases where people's devices like the baby monitor that, that, that creeps out a lot of people, right?

Yeah.

You don't want your newborn baby Um, you know, hearing some, some guy's voice as they're trying to scare him or something like that over the internet. And I think as more of those incidents are brought to light and made public, we are getting more savvy about how we think about that and realizing, oh, okay, if this goes bad, this could go really bad and really have a negative impact on my family. So I'm thankful for that, that that's happened.

Yeah.

Yeah.

And then, well, I mean, not to like completely demonize all, you know, technology and like, you know, create this fear over you know, convenience. I mean, like, they, they have done some good things. I mean, I think I've read some stories about like the Ring actually like either stopping crimes or, you know, being able to report accurately the people who perpetrated those crimes. I know there's a story like not too far from there was a missing girl that showed up on a Ring device that the police were actually able to sort of narrow the search band to look for her. So I mean, they do good things, but like, I mean, I think your point's well taken. Like, you know, we need to assess how much we value that convenience

versus how much we expose ourselves to security threats.

Yeah, sure. I think, I think it goes back to that matrix, you know, of asset, threat, and vulnerability. Those just determining, you know, what am I exposing? What asset am I exposing by bringing this new piece of technology into my house? Really seriously consider that before you go to You know, the Amazon or go to Best Buy or something like that and purchase that, really think hard about if this goes bad, if this is used in a way that I don't intend it to be used, what's the worst-case scenario? And then decide, is that acceptable, or can I put boundaries and hedges around it to make sure that that doesn't happen? If you can't answer those, those questions or find a nerd that can answer those questions for you,

I say just step away from it until you can get those questions answered.

Yeah, and the convenience side of these things, man. I mean, sometimes you forget the way that they try and even protect you from them. I mean, I remember you telling me some pretty scary stuff that Alexa is capable of doing that maybe they haven't necessarily taken advantage of. But like, when you told me some of that stuff, I immediately went and found that little button right there that turns the microphones off. Because what was you telling me, like, they can basically act like— was it like sonar in a room?

Yeah, so there's some research being done where you can actually and it's more for the cell phones, is what I had read. With the sound that gets emanated from the mic or from the speaker on the cell phone and the microphone, they can actually kind of do like an echolocation sort of a mapping of the room. So like my cell phone is sitting here on the table and it could, in theory, map 3-dimensionally this entire room because it works a lot like bats' sense of— Sure. Of perspective of the space that they're in. The array, the microphone array that's in the Alexa devices is far more sophisticated than the cell phone. Most cell phones have more microphones than what you would imagine. You'd think, oh, well, it just has

one microphone, right, to listen to me while I'm making a call. It may have 3, it may have 6, it may have— I think the Alexa, some of the older versions had 9. I think they're increasing that all the time because it allows them to hear better in the room. So even if the device doesn't have an advertised camera, if it has an array of speakers and microphones, it can do some pretty strange stuff with that technology that wasn't maybe necessarily intended by the designer or the guy that was programming the software. But an enterprising hacker could figure out, I could use this for something that wasn't intended, and that could be malicious.

And on top of that, I think the, the crazy thing that most people don't think about is is if you start adding up the number of connected devices you have in your house, I think most people would be shocked to know how many of their devices are connected. Because so, so what that winds up looking like is, um, maybe you've got— let's say you've got 15 to 20 devices. I think that's a minimum for a lot of people. Um, When you're talking about being able to do what you're, what you're saying about mapping areas based on microphones and those sorts of things, you're not just your house, but outside of your house and surrounding your

house and maybe even into your, you know, your yard and those sorts of things. It's unbelievable what is available. And so I think that you're starting to really resonate with me, the precautions that are necessary. And so I'm understanding some of those sorts of things. But I guess the next logical question behind that is, what do I do about it?

Right. So that is kind of a hard thing for any technologist just to give you a flat answer because the landscape changes all the time. That's one of the things that we really love and hate about technology at the same time. The fact that if you don't like it today, well, it's probably going to get better and smaller and cheaper and more useful tomorrow. But at the same time, it makes this kind of rat race where we're always trying to keep on top of things. And the security side of it is no different. You know, the average person doesn't have 3 hours a day to go and read all the tech bulletins that are the exploits for the new digital devices, right? They're just not going to do

that. And your companies don't have really an incentive other than a legal repercussion or a loss of customers to blurt out what went wrong with their device, right?

Right.

So back in the battle days, they just kind of would suppress that as long as they could. They'd even, you know, go through the legal system to try to keep somebody quiet that knew about the exploit. It's a little bit better now than it was, but that, you know, it still happens. It's still out there. My personal feeling is that I err more on the security side than on the convenience side. So I really take a hard look at my life, like, what am I using that I can get by without? It might take a few extra minutes to go and do what I do during the day, But to me, the security is worth dropping that

convenience down. And for, for some of your listeners that have maybe never considered that matrix before, maybe they need to do that. Maybe it's the first step is just sitting down and counting the number of devices in my house, deciding that I can get rid of a couple of tablets or I can get rid of an extra Alexa device, or I can confine all of those devices to one room, or I don't know if I have a firewall on my internet connection. Maybe I should contact my ISP or— the local guy that knows more about computers than I do. Those basic steps, I think reducing the number of devices that you have and then asking a few questions of somebody around you

that maybe knows a little bit more about you, about the technology than you do.

Yeah, Micah. So maybe just give us, for everyone at home listening and kind of going, all right, maybe this is a little bit above my head, it might be helpful just to kind of have a good working definition of like what What is the Internet of Things? It was really helpful for me once I kind of understood what that actually meant.

Yeah. So the idea is that you can get an incredible amount of power and convenience by having all of your devices talk to each other and talk to you through the internet. So whether that's a toaster that'll let you know when the toast is done or the ability to control a light switch in your house and turn things on and off. Maybe the light bulb itself has that ability to do it. A refrigerator that'll tell you, you know, how much food's in the refrigerator. All of those things as they're connected together, all those little devices become the Internet of Things of all things. So kind of in broad strokes, that's what they mean by the Internet of Things and it's including more and more devices every day, so.

Yeah, so we talked about the Ecobee. So smart thermostats. On my house, I've got smart locks on all of my doors. Um, there's things like the Alexa, Google Home, Apple TV, uh, the, the Ring doorbells. Uh, there's so many, so many things that are Bluetooth enabled, uh, that, that also is included in this category of things. Um, and, and again, whenever you start kind of compiling a list of all your devices, it's, it's massive for the majority of people.

Sure. Yeah. So every device that you talked about there has its own separate connection to the internet, but it's also, you know, we talked about assets and threats and vulnerabilities. It's also a vulnerability. So you might think, oh, well, this is just a one-way street. This is just a device for me to use and communicate to it. But, you know, anything that's connected to the internet can also be used by somebody else if they are sophisticated enough to get access to it. So for, again, from my standpoint, I like to limit the number of devices that I have. in my house to only the necessary things, or only things I deem necessary, so that I

don't have to constantly be worried about other things. We talked about being on the bleeding edge of technology, and I would say the one big exception to that is when the security updates come out. So if, if a company releases a security update, you want to get on that quickly.

Usually there's a reason.

Yeah, absolutely. There's, there's, there's a case where somebody has had that exploit cause a problem, or they've got, you know, some third-party researcher has come out and said, we noticed there's this hole in your device, and they release a patch based on that. So you want to get on top of those really, really quickly. A lot of these devices will have automatic updates, so they do it in the background. You don't even have to do anything. You've probably noticed those on your desktop machines. They'll come up and say there's a new update, you want to apply it, or you can set it to happen automatically. So keeping up on those things is another really good security

tip. Make sure that you are running the latest software for security reasons, the ones that have the latest security updates.

I don't know that I've seen one in a while. I think I'm still running like Windows 95.

You probably are. Okay.

Hopefully you're not connected to the internet with that Windows 95 box.

Yeah. So one of the things that I've seen before, and I'm really kind of blanking on what the name of the company is right now. But there are companies out there that will monitor your, your internet of things for you. Do you know anything about these?

I haven't heard of anything like that specifically. But, you know, that sounds like a good idea. I'm not exactly sure how it's implemented.

But yes, I can watch it. Yeah, exactly. So I, again, I don't, I don't have this at my house. And I I'll do some research and if I can find it, I'll put a link to it in the show notes. But there are companies out there that basically you give access to your network and it knows the device, the devices that you have. And so if something is accessing your Internet of Things that isn't something that you have connected to your personal system, then it knows it's a foreign problem and they will alert you remotely on your phone and shut it down. And so these are, these are, um, they're fee-based companies, and so it may be $30 a month

to get that type of monitoring. But, um, as we're sitting here talking about that, it's something that, that just I remembered in my head that I hadn't thought about recently, that that $30, you know, some people look at it and go, man, for $30 I can, you know, I can get Netflix and Hulu and, and, you know, maybe a new phone that I'm paying, uh, you know, an upgraded cell phone plan to or whatever. But when you start really thinking about it, $30 may be some of the best money you spend when we're talking here about the security of, of your life and people being able to hack into your life.

Yeah, that sounds similar to kind of like those credit watch services that will alert you if somebody is trying to use a credit card.

Absolutely. LifeLock or something like that.

Yeah, yeah. One of those companies. So that, you know, if you're not going to or don't have the ability to take the time to really assess the vulnerabilities that you have in your house, but you're not willing to get rid of all the convenient IoT devices that you have, Maybe, maybe that's an option for you. Maybe you hire a company to kind of do the work for you. So yeah, that, that would make sense to me. You know, it's all based on, on how reputable the company is and how good a job. And speaking of that too, there's kind of one of the things bouncing around in my head is that it's not always the guy in, you know, Eastern Ukraine that's got, you know, a computer and is trying to just get credit

cards to, to go and buy stuff or to get money. Really, really think about the companies that you are allowing into your house. You know, the, the companies sell these devices not just to make your life easier. They sell them because they're collecting data on the way that you live your life and the habits, the daily habits that you have. And they're getting unprecedented access to your daily habits so that they can tailor their products and their services to be more effective, to cause you to use them more often, to spend more money with those companies. And while I'd like to say, you know, our American corporate system is altruistic and they're never going to abuse that data. We have a lot of examples of where they have done that.

So it's not just a matter of, you know, the guy in the hoodie that's, you know, spending, you know, 67 hours, you know, straight hacking into your system that wants to get your credit cards. Think about, you know, do I trust this company to use the data, not only the data that I've explicitly said they can use, but anything else that this device can collect? That's something to really take seriously as well. Don't just trust the companies that you're buying these products from.

And just to be clear now, Mike— Micah has now besmirched the personal integrity of Lance Armstrong and all of Eastern Ukraine, if you're keeping score out there.

I love Ukraine. I've visited Ukraine. It's a beautiful country.

Yeah. So what, in your mind, like, what are some tools like that for you? I mean, like, when it comes to this subject, if you, if you were to walk into someone's home and you see that they're not taking advantage of this particular tool in order to, you know, minimize threats and vulnerabilities, what would some of those be?

Yeah, that's a great question. So, so I'll try to, I'll try to answer that intelligently, as intelligently as I can. But if I was walking into, say, Kevin's house and, and I said, okay, Kevin, I'm here to do kind of a digital security assessment of your house, the first thing I want to know is, is what are your access points for the internet? Okay. Do you have a single ISP? Are you using multiple ISPs? Do you have one router that allows you to get on the internet?

And I think we've said this a couple of times, but just so people know, what's an ISP?

Yeah, so an ISP is an internet service provider. So that would be like AT&T, Verizon, T-Mobile, Comcast. Yeah, okay, any of those companies. That is basically your on-ramp to the information superhighway.

Sorry, go ahead.

Yeah, so that's your ingress and your egress for your data. If it's going to be exploited. If you're going to have somebody exploit your devices, it's going to come in through that connection. So you really want your focus to begin with those points of entry into your house. Things like having a good quality firewall on those, and that can be a hardware device or it can be software. Most of the time we are provided one by our ISPs. They provide us a router. So you might want to ask some questions like, is there a firewall on here? Who's controlling what can come in and out of that router? How do I control what is coming in and out of that router? That's where I'd start to begin with. And then I'd take, take an inventory of all

the devices that he has connected in his home. What are the different devices? And start looking for the age of the software that's on there. Have they done security updates on those anytime at all? Have they done them recently? Do they have any known vulnerabilities that can't be patched? And if you have a device like that where it's just simply too old, then I would go ahead and get rid of it. I wouldn't allow it to connect to my network. Wi-Fi is one of those big convenience things that also opened up a lot of security holes, right? We all love having a wireless device where we don't have to be tethered by a cord. The problem is that early on, those

Wi-Fi devices weren't so good on security. So a lot of, a lot of data was just out in the ether, just out in the air for people to sniff. You could walk by with a very small stubby antenna and computer and listen to all the traffic that was going on inside of that house, every website that they were connecting to, every file that they were uploading or downloading.

Mm-hmm.

It's gotten a little bit better with, with some security protocols, but I would look at my devices and say, can I get a hard line? Can I get a wired line here in place of the Wi-Fi? And that's one less device that's spewing information out into the atmosphere. So I would reduce the number of those. I would look at doing things like one real helpful, easy, easy thing to do for families especially is to go and use something called OpenDNS or a similar product. And what that does is that allows you to, when you go onto the internet and you type in a web address, CNN or ABC or something like that, you have to go out to a computer first of all, and it translates that name back into a number. It's basically

the address of the website, that process can actually be a level of filtering as well. OpenDNS will allow you to not resolve certain websites. So like gambling websites, say for instance, if you didn't want access by any of your computers to gambling websites, you could tell OpenDNS to block those. And then no device that was on your home network would have access to those websites, at least from a DNS perspective. Super easy. It's free. It doesn't cost anything. You set it up and it works for your home system. So I would definitely consider doing that.

But evaluating where all your connections are to the internet, making sure that they have updated software on all your devices, making sure that you have a good firewall on all of those points of ingress, and then wiring those devices that you can, getting as much stuff off of the wireless side of the network is a pretty Yeah, and so on top of that even, you know, a lot of people or a lot of websites, for example, if you need to log into a website so that you can have a username password type of deal to track spending or track, you know, an item that you purchased, a lot of times now you can log in with Facebook. And one of the things that you notice is it says— it takes you to a little page. It

says, you know, this company now has access to your Facebook data, right? And so it's different than just creating a username and password specific to that website. Now you've opened them up to a whole new level of your information. And so I think that's something that sometimes we just blindly click on because it's a whole lot easier than remembering a whole new password, a whole new username, a whole new password, and we just think that's going to be convenient as well, but you opened yourself up to security threats at that point.

Well, it's actually kind of counterintuitive. At first, it seems like you're just opening the floodgates between those 2 accounts, but honestly, that form of authentication can actually be more secure in a lot of ways than the traditional username and password, believe it or not, because you have this trust relationship with these 2 entities. I trust Facebook. and I trust Amazon. Okay. If you have that trust entity with each of them and that is already established, why not just allow them, you know, that same level of trust between the 2 websites? And there's some other technology behind it. It's not like they have carte blanche access. Facebook can't get into your Amazon account and Amazon can't get into your Facebook.

Right.

You have to be there to authorize that sort of a thing. So, believe it or not, authentication schemes like that are traditionally more secure in the wild than some of the older, and they're more convenient. So that's a rare case where you kind of get a win-win on both sides, both security and convenience.

See, that tells you how much we don't know sometimes, which is a lot sometimes. So maybe other than the internet, are there any other vulnerability points outside of the internet coming into your home?

Well, yeah. If you have a wireless network inside your house, then somebody that's sitting within range of that wireless router could certainly see the traffic that's going in and out. There are layers of encryption in there, but we have kind of a poor track record sometimes in these wireless devices because they're all over the board. We have some really good ones that are developed well and others that are kind of fly-by-night hardware vendors that may not do such a good job. So you could Imagine somebody sitting within range outside your house that gets into your router, is able to hack it, and that's a point of ingress, which is why I recommend if you can get away with not having wireless— I know that's probably laughable in today's technology— if you could and just shut off the

wireless side of your router, by all means do that. You'd make security guys like us really happy. Being that that's probably not possible for most people, then yes, that's another point of ingress to consider is just somebody sitting in a car outside your house and hacking on your wireless side of your router.

Wow.

And we could talk about physical security because that's a whole other topic outside of digital security. But yeah, your phone might be another point of ingress because it can be set up to use your local Wi-Fi in your house. And if it can't reach that, then it's going to use the cell data network. Right. So that's another point of ingress to consider, and that's a point of ingress on every single device that you have hooked up to the cell network. So your phones, your tablets that are cell-enabled, cell data-enabled, all of those will be additional points of ingress. So even if you secure your main ISP connection to the house, those devices can still reach out to the internet. So that's— those are other points to consider as well.

Even the watches now, because they have the cell signals inside of those as well. So, and so like when we say like they're vulnerable, I mean, could Could potentially someone hack into the cell network and access the microphone on my watch or something like that? I mean, like, that's, that's a real possibility, right?

It is. Um, in terms of mobile devices specifically, it's usually the applications that you have to really be careful of.

The ones that you allow access to those things on your phone.

Exactly, exactly. Yeah, so if, if there's some new game out there that your, your kid is clamoring for you to, to download on their device, and the programmer has put something malicious in there to send data back to their server, you may not know that until it's too late. And the people that are in charge of kind of protecting the integrity of the app stores out there, they may not catch it quickly enough either, and the damage is already done. You know, you've, you've had information stolen off of there, you've had your privacy invaded. There could be other things. We even have examples of companies that have done that they've, you know, in their policy say we're collecting data only for these particular reasons. And then you find out later they're collecting a whole lot more about

you.

Selling it.

Yeah. Yeah.

And selling it to whoever.

Yeah.

Yeah.

Well, I think, I think before the show you were talking earlier about you have some things that you store digitally that you never expose to any sort of network or anything like that. You kind of keep them in a safe place. What are some of those things that you, you have a high level of concern that you're going to never expose to any, you know, like what Like, are these like wheels, different things like that?

Yeah, some of it is, is from a privacy standpoint. Some of it is just from a redundancy standpoint. We have the cloud now, which is supposed to take care of all of our storage concerns, right? We're supposed to be able to store it in the cloud and it's going to be there until our great-great-great-grandchildren need it someday, which, you know, it's proving more and more reliable. But there are just certain things for personal reasons that I don't want connected to any network at all. And so for those things, I'll store them on a burnable media like DVD or a thumb drive or something like that, and I'll put them in a fire safe or put them in a safe deposit box in a bank somewhere, something that has physical

security to it. And then there won't be a copy of it anywhere else other than, you know, maybe a duplicate or triplicate copy in a physical location separate. This was kind of born out of the corporate industry and software to have backups in case everything, you know, went south at the office, all the servers got compromised, or a fire broke out in the building, we'd at least have a starting point to rebuild the business back from. So some of it is stuff that I don't ever want anybody to have access to. Other things are just if everything gets destroyed, I want to have some base copy that I can start my life over with.

So are there like, are there some particular personal documents that people should be Cautious about getting exposed?

I think that's—

In your opinion?

Yeah, I think that's something that everybody needs to decide. You know, is it something that worst-case scenario, this computer that I think is the most secure device in my house gets compromised and gets leaked? How devastating is that going to be to my life? And if that's, you know, just a matter of cleaning up a couple of bank accounts and shutting down some credit cards, maybe that's not a big deal. But if it's, you know, I lose my business because my corporate secrets are on my home desktop, that's a little bit bigger of a deal. You know, if I go out of business and can't provide for my family, that's a much larger sort of thing at stake. So it's hard to answer that generically.

Sure.

It's going to be different for everybody. But again, it goes back to changing your mindset. Don't have a mindset of that it's on the computer, it's safe, it's secure. I never have to worry about it. Nobody's ever going to hack into it. That mindset just needs to go away because it's possible. It could happen.

Yeah. Well, we're creeping up towards the end here. We probably need to, to head into our very now world famous— what is it, Kev?

The Final Four.

Final Four. My, one of my favorite sections. So these are the same 4 questions we ask all of our victims. I mean, guests every, every week. So do you want to go first? You want me to go first?

I'll go first. So Micah, Um, what's the must-have tool that you won't leave your house without? So, so if you, if you were going to a job or going to a site somewhere where you're going to be working on something, what's that one tool that, that you would not leave your house without?

That's— it's really hard to, to answer because guys like us are a collection of tools that we use pretty frequently and daily.

So I think you're just called a tool.

Yeah, he called you a tool.

So it's a hard one to answer. Just, just one favorite one. I guess professionally, you know, internet access is pretty important. I can only store so much up in my brain, so much information, and it's getting less and less as the years go by.

So it's already full.

Yeah, for sure. And the recall is getting much slower. But if I—

elderly fella, that's right.

I typically, if I'm walking into a scenario that I don't, I don't know exactly what I'm going to need, I could need a little bit of everything. I take, I take my laptop and my laptop's got a version of Linux on it. It's Ubuntu, which is a kind of an offshoot operating system. Not a lot of people probably listen to this will know what it is, but it's not real vulnerable to exploits. So I can drop it in a dirty network and be reasonably assured that it's not going to pick up something. Plus it comes with a whole suite of tools that I can use, everything from assessing network health to monitoring data coming in and out of devices. And, you know, it does, it does all sorts of things. So that is my toolbox, would be my laptop

with Ubuntu on it.

It's the only laptop he'll bring over to my house.

Won't risk anything else.

He's gonna catch something, he's gonna catch it over here.

That's right.

I actually don't have my notes in front of me.

Okay, well, I'll keep going. I got number 2.

That's right. I'll just, I'll just provide the color commentary.

Okay.

All right. All right.

Number 2, you ready for this one? What's a job that you walked away from?

That kind of hits close to home because it just, it just recently happened, unfortunately. And I can't, I can't tell the specifics, but it was, it was pretty much a dream job. It was right in the industry that I, that I've been working most of my life in, was with a phenomenal company in a really cool cool industry. Like, I would have been cool dad of the rest of my life probably had I accepted the job position, but it required a physical move to the other side of the country. And I just, after assessing the pros and cons and all of that, I just decided that I'd have to pass on it. And there was no

option to work remotely. So, yeah, it was kind of a challenge, but it would have been in security and it would have been working with, with a new level of people, and I think it would have been a lot of fun, but just too many sacrifices to move out of this area where we're in.

Well, and let's not take away from it that you would have had to pass on this interview. I mean, like, that, that definitely went into the equation.

Yeah, I don't know if that would have been motivation to go or stay, which way that would have cut.

Oh man. Well, yeah, I went, and, you know, personally, uh, you're, you know, Craig and I are friends. of yours and you're a friend of ours, so we're selfishly glad you didn't go. But we, you know, we know sometimes we do have to pass up opportunities like that.

It was the right decision. No regrets.

Yeah, cool. Okay, so the third one.

I remember the fourth one, by the way, so I'll grab it. You go ahead though.

You finally found it in your brain.

I'm catching up. I'm catching up. I got a little mica brain.

It's funny.

Welcome to my world.

All right. Number 3 here, how do you wind down at the end of a long day? I mean, I can imagine just as a programmer. In fact, I don't even know if you realize this, but as I went into college, I went into college as a computer science major myself. I remember sitting behind a computer for hours and hours behind a screen just typing code and revising code and learning the code and the things like that. And man, my, my brain was just wiped at the end of the day. So, so how do you just wind down at the end of a long day?

Yeah, that sentiment that you experienced and expressed there is, is very real. Um, and I, for all those guys listening that do this professionally, I totally empathize with that because you're not— it's not physical, physically demanding. You're not out there, you know, putting a new roof on a house. You're not out there laying tile, but It's hard to put 2 thoughts together at the end of a really long day when you've just been mentally focused on a problem trying to solve it. So for me, it's the same answer as when I go on vacation. I get as far away from technology as I can. And it's a very different answer from when I was younger. I'd spend some time pursuing this or that or the other outside of

office hours. But anymore, it's how can I forget my cell phone somewhere? Can I get out of the office? Can I unplug from everything? Sometimes it even goes to TV. Like, I don't want to look at another illuminated screen until I have to go back to work the next day. So anything that gets me far away from technology is a pretty good thing. I'm not a good fisherman, but I'll go fish with my kids or go run or, you know, do some physical outlet because it's hard on your body sitting in an office chair for 8 to 10 hours a day. You know, it's physically hard on us. So yeah, anything that gets me unplugged, that's, that's good.

Ah, running. The days when I could run. I'm getting there, Craig. I'm gonna, I'm gonna heal this knee before you know it. All right, you got number 4, don't you?

I got number 4. So what, what is one of the best pieces of wisdom someone ever gave you?

I have been blessed to be given many pieces of good wisdom.

So again, Lord knows you needed them.

I, I I don't know where I'd be without some of them for sure. So that question is kind of like the tool question. Choosing just one is kind of tough, but from a professional standpoint or a business standpoint or a financial standpoint—

Whatever you want, man.

So one of the best pieces of advice I got was from one of my accountants who is also one of my dear, dear friends, good family friend. And back kind of in the early 2000s when I had my own company and things were doing really, really well. I was making more money than I'd ever made before. I brought home a pretty good-sized paycheck at the end of the year one year, and I was talking with this accountant friend about what should I do with it. And, you know, my friends are putting it into the stock market. The technology boom is really big. You know, companies are doing IPOs and just blowing up all over the place. You know, I'm kind of thinking about this company or that company.

And he spoke into my life and he said, you know, What I would do is I would take that big check and I would send it all into the house that you don't have paid off yet and get that house paid down as quickly as you can. Because, you know, at the end of the day, regardless of how tough that day has been, you're going to go home to a house and a piece of property that you own that nobody has any right to or any ties to. And that's going to give you a great sense of peace. That's going to give you some freedom in the future to take some more chances and some more risks.

Because, you know, at the end of the day, You're coming home and that home is yours. And I thought about it for a long time. It wasn't real snazzy. It wasn't something that I was real super excited about, but I decided to trust him because I just had a lot of faith. I still do have a lot of faith in this guy. And that has paid dividends many times over, over the years. I come home at night, I know my house is paid for, and that just, that gives me a level of security. So I like that. I like that piece of wisdom.

That's awesome. Yeah.

Well, this is, this has been a great episode, man.

Yeah, it has. I appreciate you coming on, Micah, and talking about some things that we all need to be concerned about. So appreciate you joining us.

I think we could have probably talked for another hour or so about some of this kind of stuff because, I mean, it can just go— we can go deeper and deeper down the rabbit hole. And so we've already had a conversation about having him on again and talking about some other security issues. Yeah. So, but if you have any questions about any of this kind of stuff, you can always write into the show at info@homeownershow.com. You can find us on Facebook, Instagram, YouTube. Please subscribe to the show. Please leave a review. That's always really helpful. Helps us improve the show, do things better. And anything else you got, Kevin?

That's all. Thanks for joining us for this episode, and we'll see you next week.

See ya.

I'm already seeing the downside here. He's got a way manlier voice than we do. I know.

It's a problem.

I could talk a little bit like this, but I'm glad I captured that just now. Me too.