[00:00:00]

Luke: You’re listening to a new episode of The Brave Technologist, and this one features Pablo Sella, who’s the founder of opsec, where he and his team run operational security audits and training for digital asset organization and high net worth individuals. OPSEC research shows that 98% of stolen crypto funds come from operational security failures, not from smart contract bugs.

Pablo hosts a blockchain security series podcast and shares security research with his 83,000 followers on x. In this episode, we discussed what operational security means and why it matters more than flawless code for anyone holding digital assets. What founders and higher net worth individuals should stop sharing online to avoid becoming targets?

How state sponsored operatives are getting hired inside crypto companies and surprisingly simple tests that can be used to expose them and which habits every listener can adopt this week to protect themselves online. From the browser and elsewhere. Yeah, this is a really great conversation.

Like it really, we really kind of got into the weeds on [00:01:00] how, just how institutionalized a lot of these, security breaches and, and attacks have become. So I hope you really enjoy it. Uh, uh, now for this week’s episode of The Brave Technologist

Pablo. Uh, welcome to the Brave Technologist. How are you doing today? Hey Luke. Thank you very much. Very good, very good here with lots of work thanks to AI and North Korea. I can only imagine, uh,

I know that you, you, you founded OPSEC kind of to run operational security audits for, for digital asset organizations and kind of high net worth individuals and other clientele.

To you, what does operational security mean in plain English for someone who maybe never heard the term before?

Okay, perfect. Uh, it’s operational security is basically the process of, uh, by which you protect an organization, uh, from the point of view of, [00:02:00] uh, operations, right, and processes and people. It’s mostly focusing in people, like for in what happens in, in mostly in the blockchain ecosystem.

It is that most companies focus in, in code, in smart contracts, in those kind of vulnerabilities. Mm-hmm. But the weakest link in an organization today is people and processes. Right. So we make sure that, uh, you have proper risk management and that all the processes that you’re doing are safe. And all the people have been trained so they know exactly what they do and the operation, uh, remains, uh, safe.

Mm-hmm.

What, what are are, are the most dangerous assumptions that you’ve seen kind of wealthy crypto holders make about their own security?

Well, the, the first assumption is, uh, it’s not gonna happen to me. Right. That’s super common. I always say that it’s, it’s similar to people who text and drive. [00:03:00] Or who eat with too much salt or too much junk food and then they either crash or they have a heart attack and they say, oh, we have to start doing things differently.

So many people think, no, no, it’s not gonna happen to me. I’m fine. Uh, and usually people that think are like this. Are the ones who have the biggest issues, right? Hmm. If we are in an industry where if you are not, uh, paranoid, if you don’t really care about security, you are gonna eventually have a security incident.

And the problem here is that usually this security incident. Happen only once, right? Mm-hmm. Because they basically get all of your money and you are done, right? Mm-hmm. So that’s one of the most dangerous assumptions right now. I already did my stuff. I already have my harbor wallet, uh, with my crypto, so that’s it.

But there are many other things that you have to, to check that they, they basically. [00:04:00] It’s not that they forget, they just know. Right, right. The thing today with cybersecurity is that it’s getting super, super complicated and super sophisticated. Mm-hmm. So it’s not something that you can just handle by yourself.

You need to work with someone if you, or to have someone that is an expert. If you’re holding enough money or data or critical information, or too much digital assets, you are gonna be targeted in a very sophisticated way.

The Brave Technologist is brought to you by the Brave Search, API access billions of indexed web results from a simple API call with the Brave search API join the leading names in AI and tech using the Brave search, API to power Agen Search.

Keep LLMs current with real-time data, train foundational models, and bring the best of the web directly to the leading edge. Get started today at brave.com/api. Yeah, that’s a, it’s a really great point too. And, and, and I like that, like you even mentioned, like, uh, somebody’s thinking, okay, I’ve got the hardware wallet,

So it kind of seems like there’s like a layered [00:05:00] set of threats that that, that people, sometimes they’re aware of it.

Sometimes the news doesn’t really get that well published. I mean there was also this like supply side thing that came up last week, I think weeks ago, I think with Ledger where with the resellers, right?

, Have you been tuned into that very much? Yeah. Yeah, totally. That’s something that we see, like the physical threat is something super serious. Uh, this year, mostly in France, there have been lots of physical attacks connected to crypto. Most of them are in France, Europe, or some of them in the West coast in the us.

And why? Because people expose themselves too much or sometimes they brag about how much money they have. Mm-hmm. And the problem that you have crypto is that most of these people hold. I mean, it’s good to hold your own, your own assets, right, to have self custody. But if you have immediate access to your funds, if now you are able to, to transfer your funds, [00:06:00] that means that the day that you are physically coerced, they are gonna get everything from you, right?

It doesn’t matter what plan you have. And to make things worse, things that happened were first of all, leaks. As you have been, we have been seen daily. Lots of companies are being hacked, compromised, and then those database leaked in their R web. And for example, this happened to all, uh, Harvard wallets vendors like Reor Ledger, Keystone Wallet, and then things like governments where, for example, in the France government there were, uh, government officials that were leaking information.

From the, let’s say, France, IRS to say, okay, yeah. These are the list of people that have crypto and they live here. So basically you have a mastermind in some our country, they, they, they found, uh, one of these units in, in Morocco who do all the intel and then they, uh, work with some gangs, [00:07:00] right? Uh, in Paris or near places of France who go.

Of course you physically and are with the phone with the Mastermind in some other place and they basically get all of your data. Wow. Yeah. Sorry. Get all of your money, right? Yeah. So we basically like the way to protect from that, number one is keep a low profile. Mm-hmm. And second, something that should become like, uh, and a standard is we should not have direct access to our long-term funds.

If you bought Bitcoin and you’re not gonna sell it in the next five years. Do you need to have your hardware wallet at home? No. There’s no need to do that. Yeah. Uh, you should have it in a bank and that’s it. Or having more security measures, like saying if I wanna make the transaction, I need at least three people to sign a transaction.

And I also will put a time delay right of 48 hours. So after I do this, if it’s a new address, we’ll have to wait 48 hours. Adding all of these [00:08:00] layers make you, , safer.

Yeah. Well that’s a good point too about the low profile. ‘cause like, I even don’t even realize it sometimes. Like I was, uh, a few years ago, I think I was at a dinner in San Francisco and on the way there I was wearing a hat that I’d gotten from Ledger at a conference and somebody’s like.

You’re walking around like with an advertisement for someone to get you over the head with a wrench, you know? And it’s like, oh yeah, I didn’t even really think about that. Like, I mean, most of my clothes are like from, you know, a, a swag from conferences and stuff, or, or brave things. But it, it was just like one of those things where yeah, you, you really do, you have to think about the details with this stuff when, when you’re ing your own funds because Yeah, like you mentioned, it, it, it’s not that far removed,

even when people go to conferences, for example, and they are for one week in a city and everyone is walking around with a bracelet from the conference. Mm-hmm. That is a screaming, I have crypto, right? Oh yeah. Yeah. Uh, so yeah, we, we have to be super, super careful about that. [00:09:00] That’s a really good point too.

Yeah. I mean, I think most people kind of picture crypto hacks as some genius finding a bug in the code.

You know,

you put out research saying that 98% of stolen funds come from something more boring. I mean, is that what’s actually happening? And Wow. I mean, 98% is wild.

Basically 90, 80% of stolen funds, in the last years is operational security issues.

Wow. That ranges from the number one. It is, social engineering is basically. Tricking someone into doing something against their interest and the interest of the attacker, right? Mm-hmm. Basically, you, you get called by someone saying that it’s from Google or that it’s from Ledger, or you are a developer in a company and they offer you a job that is paying a lot of money to work to go towards another company.

You have three different interviews, and in the fourth interview. They make you clone a GitHub repo or, or download some library or there is a [00:10:00] dependency or they make you click some link or download something. They infect you, they get your assets and they get inside your organization, right? So most, like 98% of the cards come from soldier engineering connected to things like malware that is basically virus that is still stuff from your computer sim swaps.

Is basically someone stealing your sim card, that is your phone number doing soldier engineering on the telephone company. , You also have serial d exploits for people that are high targets that allow you to hack a computer or a phone even if they are updated. You have insider threat, like I don’t have proofs, but I also don’t have doubts that.

A good amount of hacks come from employees or ex-employees, right? Mm-hmm. Incentives in the crypto industry, mostly in security, are not well aligned. For example, if I am a developer working in a company and I find the bug [00:11:00] in our code that would allow to steal $100 million, I cannot get about bounty, right?

Pablo: So I should report it. I will not get it back quality. And that’s it. So many people perhaps choose to send that back to a friend who will report it or they choose to exploit it, right? Or also something that is happening, as I was telling you, 98% of staff is breaking people not breaking code.

Mm-hmm.And if you go to bag bounties and platforms, what is the number one thing that is excluded from bag bounties? Social engineering, right? So what is that? Yeah, yeah. How, how are we aligned? Right? Yeah. And at the same time, to make things worse, we are having lots of security researchers that are having a very bad time when they, report vulnerabilities.

Because they do not get paid or they found a critical and they tell them that it’s a medium or they have to wait [00:12:00] 180 days and they tell you no, it’s a duplicate. For example, for us, we reported that super critical vulnerability in Google Workspace and after six months they told us it’s a duplicate.

How? You show me proof that it’s a duplicate. No, I cannot, but we can already fix it. I went and I checked, they can’t fix it and it’s Google. Oh my gosh. I you expect Google. To be serious. Well, they’re not. And what, like, let’s think from the incentives point of view, if you are having security researchers who are good at finding vulnerabilities and you don’t treat them properly, and you don’t pay them when they find the stuff.

What are you generating for the future, right? You are generating black hats, right? That guy, next time, that day, he finds something, he’s not gonna report it to you. He’s gonna sell that vulnerability to the company or he’s gonna exploit it. Mm-hmm. So incentives should change 100%. Yeah. And have you seen that any improvement on that over time?

Or is it still, kind of going in the wrong direction from, from your point of [00:13:00] view? I think that it’s getting worse, in fact. Oh, wow. Okay. Because now with all the AI stuff, what, what’s happening is that now we are seeing like more and more vulnerabilities are being discovered. Why? Because. Some people will try to kill me because of what I’m going to say, but there’s too much code.

There’s too much code out there still written by humans, and that code is full of bug, right? Ai maybe today is not better than humans at coding, but in a very short period of time it will be, right? But what AI is very good at is that finding low severity vulnerabilities. Combining them and when it combines them, it’s able to create a critical vulnerability.

So now the so many things are getting are being found that also oun this platform are getting flooded. Of inbound of vulnerabilities, bug reports. Some of them are real, [00:14:00] some of them are fake. Some of them are poorly created with AI and they don’t work. So they are also having a, a bad time like, managing all of this.

I think that. In the long term, security will be far better, right? But it’ll get far worse between before it gets better, right? Yeah. we are seeing that again. Every day we are seeing a major security incident and they, it’s not news anymore, right? You see, oh yeah, this company got leaked and now 50 million.

Customer data, 50 million people customer data was leaked. Oh, okay. It’s, it’s normal, right? It’s a meme. Right. I mean, people are still kind desensitized to, to that at this point too.

And we have to understand also that I think that every organization and every individual is going to have a security incident in the next year. It’s gonna happen. Mm-hmm.In some ways. That’s a great point. the attack surface is super big.

Think how [00:15:00] many accounts do you have? At least 100 accounts, banks, emails to FA, fintechs exchanges, social media, movies, FinTech, it’s full of stuff. It’s full of very old code too, and some platform is going to be compromised. Or you are going to download something where we have Let’s say that you, you are pretty savvy and you only have 20 apps running in your Macs.

How many dependencies do those hubs have? A lot.

Luke: Right?

Pablo: Right. And many of those open source dependencies are managed, like how the meme says by a random guy in Nebraska. Well, that guy is gonna be phished and now they’re gonna push malicious code into that library and that library is going to be. Then updated by millions of people and apps and everyone wrecked.

It’s, yeah, it’s what, I mean,

Luke: what has been the, scariest scam that you’ve seen this year?

Pablo: [00:16:00] One of the scariest ones that I have seen, which is very, very good, it’s so good, is this one. Let’s say that we know each other from real life, right? We, we trust each other, and then someone comes and says, Hey guys, we, I want to do a deal with you.

We’re gonna do some OTC operation. so they say, okay, Pablo, look,let’s switch to a more secure channel, right? Because let’s say that, Here, this core Twitter or whatever is not secure. Okay, so guys, gimme your Telegram handles, right? So I give them my telegram handle. You give them your telegram handle and here comes the magic.

Instead of creating one telegram group, this guy will create two groups. In one group, he will add me. He’ll add himself and he will add a fake look that it’s him. And in the other one he will add look himself and the fake Paolo. So whenever I send, we think that we’re in the same group, but, but we’re in different groups.

So when I send a message, he will copy the message and he will [00:17:00] send it from the other group. And they’re the fake Paolo. And when you reply. He will copy that and he will send it from India Group from the fake look. So we think that we are talking about something and we are not. And in some moment when the transaction has to be done or something and you share an address and I have to transfer the funds there, they change the address and that’s it.

That scam, that is called real a fake B. It’s one of the, the most sophisticated ones, super difficult to detect and. It’s successful. Most of the times, most people. That’s wild. People do not detect it on time. Yeah. Yeah, and that’s just one example. Another one that is super scary is we used to be used to seeing DPRK.

DPRK is basically North Korea. Hmm. Two have IT workers, right? It workers I are basically North Koreans that work for the, for the government that try to infiltrate companies, right? So they are working for some companies saying that they are [00:18:00] John that lives in Canada or or Japan or whatever, and they work for them.

So then. With time, these people started to be detected after doing KYC, some background checks. So what do they do that now, instead of just going themselves and doing the interviews, they hire someone in the us, a US city, a US citizen, that will do two things. First of all, they have laptop farms, so they have 20 laptops in their living room connected to North Korea.

Through team viewer so that then when you hire them, you say, okay, yeah, this guy is connected from the us. They have A-A-A-L-E-P in the us. Perfect. And what they did after is that now that US citizen guy that they shared. He’s the one that does the KYC and is the one that connects to the interviews that has an script.

And it’s the same one that after you hear him, he goes to the weeklies, he goes to the daily lists, and he has a script. Gosh. So you my think that [00:19:00] you’re working with a guy that you are seeing him daily and it’s not, and that guy, the worst thing is that he doesn’t know that he’s working for North Korea.

He thinks that he’s helping some Chinese guy. Get a job at Amazon that if not, he would not be able to get it. And that’s it.

Luke: That’s wild. Yep. Yeah, that’s like super sophisticated, like, I mean, well ‘cause I remember like a different version of that, right? Where especially on the crypto side, where a lot of you had like defi teams like, in decentralized finance where, you know, the entity, we weren’t the entity.

there’s a meme about it where they were saying like, I think it was FTX, somebody said their, entity was based in the metaverse or something. Like, the entity doesn’t even have like a jurisdiction on planet Earth, right? and then you’ve got all these people where they’re not doxed, so they have these anonymous, you know, contributors, right?

So you never really know. I mean, this was back in the day. I think that they’ve gotten maybe gotten better since then, but it was a real problem where [00:20:00] like you don’t even know really who’s working for you, you know? But it was such a cultural thing too, right. In the space. Yeah. It’s just kind of a tough thing to balance.

Like then you’ve got the other risks that kind of come with docking where like, I’ve always been out there with this stuff and I’m on a token project and, you know, since 2017. And, and so it’s a different, been a different set of circumstances where, I’ve. Myself been targeted a lot for these types of things and had to deal with it because, you know, you’re putting your face out there.

And I would imagine too, you’ve got like, you know, 80,000 followers on X Right. And kind of been personally out there, as a subject matter expert, like how much, do you think that that raises the risk of getting attacked and then, you know, how do you personally decide what you share freely in public versus what stays confidential?

Pablo: Yeah. First of all, this thing of anonymity, I understand it and I respect it. People that want to remain anonymous because we are talking, for example, about people being physically coed, so it makes [00:21:00] you safer to be an anon, right? Totally. But then you tell me, Hey, Palio, would you hire someone that is an anon?

No way. No way. Like all the clients that we have, we only have one exception that they have announced working in their team. But the reason is that really. There is some people inside organization that know them. So I say I could have someone that is an anon in my team, but an anon for the rest of the internet.

I have to know them. I know all my team in person from a long time in person, and we even say, if you’re gonna hire someone, it’s instead of doing background checks and KYC and all of that, things that do not work. Pay them and tell them and fly them in, Hey, fly to this conference, to the us, to Europe.

If you cannot fly to the US or to some country in Europe, that’s a red flag total. Right, right, right. And then regarding, what, what to share and what not. Yeah. First of all, I always say that during the fact that I am dedicated to security. I ha I, I always [00:22:00] make it clear like, Hey, I have a setup that does not allow me to touch money.

If I want to do something, it takes me like five days and different locations and different people. It’s so complicated, right? Yeah. And I make that clear.

what I can say, for example, is, for example, I don’t have one device.

I have four laptops. I have six phones, different brands, different things. One laptop to have this call for you and social media. Another one for signing transactions, another one for verifying stuff. Another one for saving some specific data. A phone here, a phone there, a phone number In some country, a phone number in number one, like it’s very complicated.

We cannot expect. People to do that. Right. but if you wanna be sophisticated enough because you know that you’re being targeted, and I know that I’m being targeted because I see it daily. Right? Sure. You have no other [00:23:00] option.

Luke: Yeah. No, definitely. I mean, and, and I know you’ve mentioned too, in the past that that crypto has some, some of the worst ec, in the entire tech industry.

and some people might hear that and think, oh, well, isn’t it an industry built by people who supposedly care about encryption in insecurity and cryptography and all that? what is that dynamic about to you? Like, why do you think that that is.

Pablo: first of all, the reality is that 99% of people in the crypto industry care about money and that’s it.

Yeah. They don’t care about decent centralization. They don’t care about privacy. They don’t care about cryptography. They don’t care about anything. It’s money. Money. I wanna buy this thing I wanted to pump, and that’s it. 99% of people is that You also have the fact that given like. If you’re a threat actor, in the past you used to do, I dunno, ransomware, and then you had to negotiate to be paid some money.

It’s a lot [00:24:00] of negotiation, it’s lots of issues. Or you steal credit cards. You need to either sell the credit cards or use the credit cards to buy stuff. It’s also too complicated when you steal crypto. Like the best asset in the world to be stolen is crypto. Because it’s permissionless. I, I still eat. Or Bitcoin, that’s it.

No one can freeze it. In fact. When, when some, when some theft happens or something, the amount of crypto that can be frozen, it’s usually 12, 15%. Most of the money is gone. So the incentive is too, if you want, if you’re a protector to steal crypto, that’s the asset to, to steal. So you would say, okay, then the crypto industry should be super safe.

They should care a lot about security. Yeah. Well, they do not. Why? And this is also an issue because there’s no regulation, and I don’t say that we should be regulated, not at all, right? I don’t like regulation, but the fact that we don’t, we are like different protocol of that are not regulated, is that then people [00:25:00] do whatever they think it’s fine, right?

Many people. When you don’t know about something, you say, oh yeah, no, no, I’m safe. Perhaps someone that has a very shitty security says, no, my security is like an eight out of 10, and maybe me that I’m dedicated to this all day. I tell you, Hey, well maybe my obstacle is a seven out of 10, right?

Because it’s based on what you know. So not having, not having regulation, I think it’s one of the issues.

the most important thing is that many companies that do this stuff, they forget about the most important thing.

That is trading your users, your, your team. Yeah. If you have all these beauty measures, all of them. But I convinced you that you have to do double click here. I invite you to a podcast and I tell you, Hey, no Paolo, to have better quality, please download Riverside because blah, blah, blah, blah. And I give you a different link and you download it.

You do double click. That’s it. And you can have all the tech in the world that you, you want. There’s some stuff that could who stop it, [00:26:00] but you’re done. and that’s, I was telling you also, it’s this thing of being accountable. We see many. Companies that, for example, have their Twitter accounts hacked, and from the Twitter account they start posting scams and phishing and people lose money.

Who’s accountable for that? No one. So they don’t care. They just don’t care. Yeah. We think that we are in, in an industry with people that care about cryptography and the centralization, this and that, but the reality is that nearly 100% of people are digs. And that’s it. Yeah. No, yeah, yeah, I hear you on that.

Um, and, and I, I want to kind of go back to,

Luke: you talked about North Korea for a minute there around like hiring and working and all of that. I mean, we see North Korea as thrown around a lot, right? Like a, a lot of,hacks are attributed to North Korea. they’re kind of one of the biggest players in theft and scammed, you know.

And as, as far as that goes, for, for billions of dollars. I mean, how [00:27:00] much of that do you feel is like legitimately attributed versus just kind of conveniently and what makes North, like what, what’s, has North Korea just been early to scamming on all this? or what is it about crypto? is it that it’s easy to steal, like you’re mentioning, or is there something else behind that?

Pablo: Yeah, well, as North Korea is, is banned right from the world and they cannot get funding from, from our places they found, in crypto, basically, a source of nearly free funding, right? that’s why they are so focused here. North Korea has. From, from the research that we see and that we do, we, they have like two kind of operatives.

Let’s say you have some people that are good at doing social engineering, at getting working companies, treating people into fake interviews, fake podcasts. Take investments, et cetera, and their goal is to infect you. Right? [00:28:00] Then after you have been infected and your computer is, has some malware, they pass that on to someone that is more sophisticated.

And that person will say, okay. I got access to the slack from the company under Google Drive, I will start to, to move laterally or to do privilege escalation, right? So they have, they’re more sophisticated and they have many different units. Trader trade, trader trader, apple juice, well, they have many of them, but they’re, they are very, very sophisticated, right?

And they have resources that is time and they have money and they invest a lot. In fact, it’s. I read some research that said that approximately between 30 and 50%, that is between one third and half of the applications for jobs in crypto, that companies receive R-D-P-R-K. Right. Wow. Wow. And, and you know what, what’s the number one reason why these guys are not [00:29:00] detected?

One is that they work a lot, right? They are very good at what they do at coding. And they do not complain. Right. So, so they, they, they are not detected. Right? Yeah. and then about attribution, I mean, I, I used to think that some people were too fast in attributing stuff to the PRK and said, Hey, come on, this happened.

One hour ago, and you already know it’s North Korea, it’s too easy sometimes, right to But there really, I, I know some of the guys that do most of the, most of these research, like for example, the different groups are t with some people, Taylor, Taylor, Monica, and the people from sil and also our investigators that prefer.

Not to be named. And I speak to them and, and they explain it. And I understand how they do this attribution basically sometimes based on techniques. [00:30:00] Right. And sometimes based on basically where the money’s coming from. And yeah, it, it’s North Korea. I don’t know the percentage now, but I would say that at least half is, Is North Korea. And then you also have lots that are basically. Teenagers In some countries. Yeah. But they learn some stuff and they start breaking stuff and those are the ones that end up in jail. Right. Because most of the times, threat actors or attackers, criminals are good at stealing stuff.

But they do not have good obstacle, right? They always make some mistake. It’s impossible to, to be 100% anonymous. It’s super complicated. Uh mm-hmm. So in the end, they are cut.

Luke: But I think that what will change is that, Companies are starting to realize that operational security is important. Mostly because they see all the hacks, all the stolen money, and they also see [00:31:00] that the bullets are closer.

Pablo: Right? Yeah. And that it could happen to them. And also because if this doesn’t change, I think that this is the end of, for, it is the end of the industry, right? This cannot keep on, on, on happening. Like last year I think it was. 2024, it was $2.5 billion. 2000? No, two. Yeah. In 2025, I think it was 3.1. And when JP Morgan or BlackRock or, or these organizations see that $1.5 billion were stolen from, because one developer, one developer. Was infected. What do you think? Mm. Are you gonna put your money there? No way. Right, right. Something needs to, needs to change. And what’s happening there that they think that eventually will change too, is that they come and they want to apply the same rules that they have traditional finance here.

So saying, Hey, please do so do or do [00:32:00] I? So, and that’s not enough. Again, they have to understand that, that here the threat, is different. The threat actor works in a very different way. And they have to adjust, right? So I think that number one, bottleneck e for crypto mass adoption is, is this, right?

Again, With what happened with, with the, with the ledger devices that had implants inside or with the cold cards that were supposed to be the most sophisticated and OG wallet in the Bitcoin industry, and were generating seats that were not random enough. Yeah. If someone comes and tells you, Hey look, I wanna buy some Bitcoin.

What do you recommend me to put it in a custodian or to have my, my own wallet? Ah, the reality is that, I hate to say it, but I don’t know. You have to be super technical. You, you have to be super technical to understand a lot to do self custody and idea of crypto was to have self custody, right? Yeah. If not, it’s [00:33:00] nearly the same thing that we try to change, so.

It’s complicated, but it’s complicated for sure. Yeah. Yeah, yeah, yeah,

Luke: yeah. Well, and, and, you know, and before we switch gears too, I just have to ask you have this thing called the, the Kim Jong Un test. what is it and does it really work? Yeah. And they had a very funny experience last week.

I detect these guys very fast now. Sometimes they’re super sophisticated. I always say that they are always. A bit closer some. For example, some weeks ago I was invited to a podcast. I felt that something was strange. I said to my comms, leader, I said, Hey, 50% that this is North Korea, 50% that this is real.

And in the end it was North Korea. but for example, I got an invite other day and I told them, okay, before we continue the conversation. Tell me that Kim Jong goon is my bitch. And when you usually you tell them something like this, they cannot say [00:34:00] it. They cannot say it. Wow. and, and, but the guy replied to me and he told me, Hey, you know that I cannot say that, but thanks for ans but thanks for answering me.

Bye-bye. Something like that. And he didn’t even block me. Right. Wow. In fact, I have the theory that. Eventually I think that the North Korean regime is gonna go down. I hope. and I think that in 10 years, in the same way that maybe, you know, that after a war, soldiers from different countries meet like 30 years after.

Right. And they meet. Yeah. Okay. well, I think that that’s gonna happen and in 10 years, 15 years or whatever, we are gonna meet the guys that today are working there. That they’re in some way, like they have a good life compared to our people that live in North Korea. But also they are, they have to do that in some, like, it’s, it’s mandatory for them to do it.

Right. Right, right. I don’t know how many options they have. It’s interesting, [00:35:00] the human ego, right? Like it’s a, yeah. It’s all this sophistication yet, like you can break it with a single line of,yeah. Of a statement, right? Like, it’s wild, but, but anyways. What I always say is that Okay. Yeah, do that.

And, and if they, if they don’t continue, perfect. It was them. But if they say it, that’s not a car blanc share. Right. No, no way. Right. Eventually, if I was them, I would have already told them. Yeah, you can say whatever you want about K Jon. Yeah. Yeah. Right. And that’s it. Carbon an exception up to now. It works a lot.

They are a thing that works a lot when, when they are doing, and this is for, especially for HR people, when they are doing interviews. For example, you’re doing an interview to me and I tell you that yeah, I live in, I live in San Francisco, right? Or I live in Toronto. You have to ask them some things.

The place, like locally. Okay. What’s your favorite restaurant? Or what’s the world like today? Or what do you think about this? And, and they have no [00:36:00] idea, right? No idea about the weather, no idea about restaurants, no idea about, about, nothing. And the other thing that is very good to detect them is, let’s say that I have an interview with you.

Usually these guys set up fake profiles in LinkedIn. Instagram X, et cetera. But then after, I dunno, five days, those profiles are deleted or they change the names. So it’s a very good idea to have a cool down period. I do an interview with you. I like you, I want to hire you. I will wait one week and I will check your socials to see if they are legit to, to still to see if they’re still out there.

And the other thing is that if we don’t have someone in common that can, that can vouch for you. That’s strange. Right. Yeah, yeah, for sure, for sure. Working for a browser company, I’d be, I’m obliged to ask, right, like, um, you know, the browser’s kind of this gateway to the web and to digital life and all of that.

Like from an [00:37:00] OPSEC perspective, like your OPSEC perspective, where does the browser sit in the threat model for crypto users? And do you think that this TA attack surface gets underestimated, by a lot of people? Yeah, totally. Like the web browser, we are, we are doing things in the internet mostly through the web browser, right?

And so one thing that I tell everybody is that every time that your browser tells you that you have to update it, you have to update it, and that’s it, right? Because in the past, perhaps every time that you had an update, they were fixing four vulnerabilities. Now, every time that you have an update, it’s like 200 liabilities.

So if you missed the last four updates, you have 800 different doors open right there. Wow. So it’s a very big reason. So number one, always update your browser. I like brave, but I think that it’s also a good idea to use different browsers, right? One for this, one for this [00:38:00] other thing, but then one of the most important things is.

Not having too much extensions, right? Yeah. Yeah. And browser extensions are an issue. Sometimes we give them too much access, right? Mm-hmm.Number one, updating the browser. Number two, deleting extensions that we don’t use, and then also knowing that because, because an extensions has, 10 million downloads, it doesn’t mean that it’s okay because maybe the extension is legit.

Someone from their team is infected, right? They push malicious code into the, into it, and that’s it, right? And then the other thing is comparative mentalization. If you can have different profiles. So I have a brave profile to work, a very, a brave profile for social media, a brave profile for banks.

And this stuff that’s also better because if something happens in this, in this profile, it won’t affect the R one. That makes a lot of sense. No, and you know, I know [00:39:00] you’ve been really gracious with your time, Pablo. I have really enjoyed the conversation today. where can people find you online? if they wanna follow your work and see what you guys are, are, are up to.

Yeah, my Twitter is at Pablo, right? Which two B And in in X at my company where we do operational security audits and training for digital assets organizations and high net worth individuals is OPSEC with a K, opsec with a K do io. And there we have our blog where we, where we publish lots of research weekly.

And also in Twitter, I write lots of stuff. I publish lots of content for free for, for everyone. Yeah. Excellent man. Well, Pablo, yeah, thank you again. I really appreciate you making the time today. Um, and love to have you back too, to, to check back in on the threats out there and, and get more of your, your point of view too, in the future, man.

Really appreciate. Totally comes with me. Thank you very much for inviting me. [00:40:00] Yeah, yeah, no problem. Take care. Thanks for listening to the Brave Technologist Podcast. To never miss an episode, make sure you hit follow in your podcast app. If you haven’t already made the switch to the Brave Browser, you can download it for free today@brave.com and start using Brave Search, which enables you to search the web privately.

Brave also shields you from the ads trackers and other creepy stuff following you across the web.