Episode 111 - Losers are Winners: Jeremy Huson on Getting Hacked, Losing Data, & Fighting Back

Losers are Winners

Sep 23

Episode #111 | Losers are Winners | Getting Hacked, Losing Data, & Fighting Back

Jeremy Huson joins Mark for a Losers Are Winners episode full of cybersecurity horror stories, hard-earned lessons, and a few “please don’t click that” moments. From phishing scams and ransomware to AI-powered attacks and the importance of backing up your data, Jeremy breaks down how small businesses can protect themselves before the bad guys come knocking.

About The Curious Builder

The host of the Curious Builder Posdast is Mark D. Williams, the founder of Mark D. Williams Custom Homes Inc. They are an award-winning Twin Cities-based home builder, creating quality custom homes and remodels — one-of-a-kind dream homes of all styles and scopes. Whether you’re looking to reimagine your current space or start fresh with a new construction, we build homes that reflect how you live your everyday life.

Support the Show:

Mark D. Williams 00:00
This episode of the Curious Builder is brought to you by Olivinvine Socials. If you're a builder, a designer, or an architect looking to grow your brand without dancing on TikTok or spending your whole life on social media, listen up. Alvin Vine Socials specializes in Pinterest marketing, blogging, and email strategy for luxury home brands that help you turn your beautiful work into a strategic SEO-driven content that drives real traffic and connects you with your ideal clients without burning you out. Ready to grow smarter and not harder? Visit OlivinvineSocials.com and tell them the Curious Builder set to you. Just so you know, I've been working with Alyssa over at Olivinvine for three years. She helped us launch the podcast. She's helped us grow our brand at Mark Williams Custom Homes. I could not do what I've done without her help.

Jeremy Huson 00:47
We always say that the weakest link in the chain is people. That is generally where most of these compromises happen. You know, you'll see a lot of the things like hackers kind of typing away on keyboards and things. It's usually a lot more simple than that. It's usually like a link in an email. You visit a website that's compromised, and they can steal some information from you.

Mark D. Williams 01:14
Welcome to Curious Theater Podcast. I'm Mark Williams, your host. Today is Thursday, and so we have got our losers, our winners. We're going out to New Jersey, and we have our buddy Jeremy from Cardin Services. Welcome to the show.

Jeremy Huson 01:26
Welcome, thank you. So you were

Mark D. Williams 01:28
just you were just telling me because you've got a sweet accent. Tell me the story about you're in New Jersey, but you're from Jersey off the UK is where New Jersey was named from. That's pretty cool.

Jeremy Huson 01:38
Yeah, yeah. So it's a little island. It's like 150 miles south of England and 14 miles from France, but it's English. I was born there, and I went to the UK when I was 18 to go to college. I met my business partner when I was at college, and we started our company. And about 10, 12 years ago, I met my wife on holiday in a bar in Dubrovnik in Croatia, and we did long distance for two years, and then she kind of gave me a bit of an ultimatum, and I ended up in New York. I try and keep the accent; otherwise, she says she'll deport me back. That's

Mark D. Williams 02:13
that's amazing. I love that you said before you came on that your wife imported you from the UK. I think that's so funny. So actually, because you guys do Marmite, not Vegemite, in the UK, right?

Jeremy Huson 02:24
Correct. And I

Mark D. Williams 02:25
want the reason I bring it up is my son, all my kids, except my middle son, do Vegemite every morning for breakfast on their toast because I have it every single day. I went to school in Australia for a year, and so I picked up the habit. But it's always funny because during COVID, I couldn't get Vegemite, and so I was-I had to get Marmite, and I was like, I don't like it nearly as much as I like Vegemite. I don't even know if there's a difference. I just like it better. And I remember it having to always clear customs during COVID. So anytime I bring on someone in the Commonwealth countries, I always bring up my love of Vegemite. It makes me a instant bond of fellowship.

Jeremy Huson 02:58
I think so. I think so. It's one of those things. You either love it or you hate it. There's now in between.

Mark D. Williams 03:02
What do you? Out of curiosity, do you still take it or do you like it or no?

Jeremy Huson 03:06
I haven't had it in a long time. I think because I don't really find it in the U.S. like where I am. So oh, you got to order

Mark D. Williams 03:13
on Amazon for sure.

Jeremy Huson 03:15
Yeah, yeah. So it's like a treat when I go home.

Mark D. Williams 03:18
That's so funny. Well, enough about our eating habits. We've only got 20 minutes. Give us the two-minute elevator pitch on what your company does because you're a little unique. And then today is really losers are winners.

Jeremy Huson 03:29
Yeah, absolutely. So we're what's called a managed service provider. So thankfully, customers that don't have an internal IT department, they basically outsource everything to us. So be it like your help desk. Like, if you have a problem with your computer, you call us. If you need on-site support, if you need cybersecurity services, and now more than ever, everything kind of AI and everything as well. So, we're there to help everyone and support them and make sure that they're secure for their people and their data.

Mark D. Williams 03:58
Yeah, I mean, wow, that's going to be. We're going to have to have you back on in a year. I mean, right now, if you believe what's in the papers, we're all going to die by Skynet in Terminator Two by AI, which very well could happen. But anyway, why don't we start with what are some recent fail stories or some in your career? Because you've been how long have you guys been in business now?

Jeremy Huson 04:15
Almost 20 years.

Mark D. Williams 04:16
Oh yeah, so a long time. So you got you've got some doozies, I'm sure. What are some good stories? I always find these so cathartic because it's like hearing other people how they've messed up. Usually, it's the simple things like you know. Use one time we sent our AI notes to our client, a part of a private conversation talking about the client. You're like, oh, that's not a good look. And like a lot of them are just you know, some of them are really bad where you just have to figure it out. But what have you got for the audience today?

Jeremy Huson 04:42
Yeah, I think like some of the things is we sometimes underestimate a level of effort involved in a job, and there's one from a few years ago now, but it really sticks in my mind where we had a solicitors like a lawyer's office. That we had to recable, so we were redoing all their network cabling, all their access points, and everything. And it's only once we got in there we realized what a huge task it was. And they'd basically given us from Friday afternoon till Monday morning to cable this thing, and it was three stories the building. And I remember, like, we just started, you know, getting in there, but everything we did was just a nightmare. Like there was no straight wall in the building; everything was crooked. We hit like an old gas main behind a wall. There was-they said they were going to clear out the office, and I don't know if you've ever been into a lawyer's office. They have paper and books everywhere. We spent about half a day cleaning it out, but the guys, we worked probably 20 hours a day for like two and a half days. I remember Monday morning we finished at like three or four a.m. Went home, got a shower, came back. People were just coming back into the office, and we were kind of finishing off, and that was just a very stressful, very stressful time, and then I think as well not necessarily a like a fail on our behalf, but one of the things that we come up against is like if cybercriminals infiltrate a network, they will do something they called like encrypting the devices. So they basically just lock it, and no one can get into it. And really, the only options out are either pay them, in which case you're essentially going to lose your money because they promise to undo it, but there's no guarantee because they're criminals, or you basically have to wipe everything and start fresh again, and that is a huge stress on you. And just you know, you imagine an office with like 50 or 100 computers, and they want it done, you know, yesterday. So it's extremely stressful, and we have to protect 10,000 ways into people's networks, and the attackers only need to find one. And it's usually someone clicking on an email or entering their password where they shouldn't. That's a huge thing. Definitely keeps me up at night. I

Mark D. Williams 07:00
mean, this interview is going to take a twist here pretty quick, only just because what you're talking about is so relevant. About two months ago, I got hacked. I'm I don't recall clicking on a link, but I I was just talking to my team. I hired a new executive assistant, and I was kind of educating her. I mean, it's not that it's always so sophisticated, but it's a little bit like a shotgun. They put so many bullets in the air that eventually they're going to hit something, and you know I don't think we're being targeted because we're special. I think we're being targeted because we just have an email and a website, and we do a lot of marketing. I think the more you market, probably the more you receive. Like I am blown away at how many phishing emails I get through. We have a pretty good funnel system. I don't think an AI bot can go through it. Maybe it can now because they're so good. But like every single one, it's like we ask for a phone number, you can't complete it, and they're always bogus. So there's some pretty telltale signs, like it's a bogus email that you know the ones that are obvious. But with AI scrubbing them now, they're getting I think more about vulnerable adults. I think of like my parents' generation of like 70s and 80 year old people. Like man, I have a team, and I'm used to seeing these on a regular basis, and they're still like, "Dang, is this real or not? Of course, you want to believe, you know, especially if it's too good to be true. It very well likely is. Is usually kind of one of the dead giveaways. But now they're showing up on calendar invites. So, like, if you click on the invite, that is actually a pretty smart way. Kudos to them for thinking of that, because it just shows up in your calendar as an invite, and you're like, "What is this about? And if you click on it to go to the web link, boom, you've just done whatever you've done.

Jeremy Huson 08:27
Exactly, and I think one of the misconceptions is that these attackers only target large businesses because there's more money. It's just absolutely not true. Like our customers are small and medium, and they are getting targeted every day with these kind of attacks, and with AI, it's becoming so sophisticated as well. And it's also moving on from just your email. You'll get text messages. There's even been instances where people have set up Zoom calls and made fake persons to appear on those Zoom calls to convince people. It's really crazy. You've got to have your wits about you,

Mark D. Williams 09:01
just wild. I, I mean, this episode is going to be about prevention, I guess. What are some common things people can do? I assume double authentication is a big one.

Jeremy Huson 09:10
That's it. So yeah, double authentication is 99.9% more effective than just a password alone. So anything you can turn on for that is is really good.

Mark D. Williams 09:27
We're happy to announce our latest sponsor, Real Wood Floors. What made them to be an ideal partner is the fact that they align so well with our high-end custom homes. They're located in 25 cities across the country. They're probably pretty close to you, and what really drew me to them is the fact that they're vertically integrated. So many times when you're dealing with wood floor, you know, procuring it from different companies, having it go through middlemen, you're either short material, it's the wrong material, and so we are looking forward to leveling up that and buying direct. The other thing that I really love is their floor-made perfect match. I can't tell you how. Times I've had a beautiful wood floor, but the vents don't match. Or I love the wood floor, but it doesn't match my treads and risers. Knowing that they can perfectly match that is something I'm really excited about. Go check them out at realwoodfloors.com and sign up for an RW Pro account. Tell them you heard about them from the Curious Builder.

Jeremy Huson 10:20
The other good one is to get a password manager. So something like Keeper or One Password-they've got like free or paid options, and it just allows you to randomize your passwords. I'm sure so many of your listeners use the same password across so many accounts, and so if one of those accounts gets compromised, they've got a password, or the worst thing is, you know, you use something like chair, and then the next one you use chair number one, chair number two, chair number three, and so again, like the attackers can spot these things, and they'll just keep guessing. So it's really two FA, changing your password, making sure that you're just checking where you're putting your password in as well. That's another key thing.

Mark D. Williams 11:03
What you know, without going too dark here with this AI stuff. I mean, you know, I just saw in the paper, at least locally, and I'm sure you're probably more aware of it because it's your job, kind of predicting where things will go. I mean, they keep talking about how, for instance, is maybe I'll have you explain to the audience if they don't know. I just know a little bit, like a zero-day password, right? Or maybe I'm missing it, but basically, hackers or whoever would find out that there's a glitch in the software. And like I remember famously, right? The Israelis spun up the centrifuges of Iran centrifuges like 15 years ago or whenever it was, and that was a zero-day bug. In my understanding of a zero-day bug, is they find a glitch in the software, but they don't report it, and they either sell it on the black market, or if it's a government entity, you wait and use it as a weapon of warfare, or however you want to use it at that point in time. And I just read in the paper the other day. Now with AI, they're literally finding 1000s. Before it was like really rare to find a zero day bug. Now they're finding 1000s of them. What does that actually mean in terms of the average human, like walking around?

Jeremy Huson 12:06
Yeah, so you're completely correct about the zero days. So it's something that's been found that has been released, but hasn't been reported to the manufacturer, and so it can be weaponized to use against you. For most people, like walking around, it's not going to affect their day to day. It's more about like the companies that they use. So, for example, if they're using Microsoft and a zero day gets found in Microsoft, that could affect 1000s or millions of people. And so, there's nothing that you could do to prevent that. the The thing with AI again is, you know, there are some systems that have been out 1015, years. They get tested 1000s of times a year. Humans don't find them, and then some of these AI models find 1015, vulnerabilities in them, which is wild. But on the flip side as well, like now we as IT providers are being empowered with AI tools as well to fight back, and so now we're literally fighting like AI with AI, which is a little bit surreal, but you know really empowers us to help. And the speed at which we can do things now is much much faster.

Mark D. Williams 13:11
Going back to, and I I promised I won't share the name. It's a local Minnesota company. There was a local company that maybe five six years ago had gotten hacked, and they were negotiating, and it was basically pay. I don't remember the dollar. Call it a million dollars, but again, to your point, you couldn't get all your data back, or they could rebuild the whole thing from scratch. And they were losing like 20 to 50 grand a day. It was a, it was a resort community, if you will, and they couldn't. Their bookings, their website was shut down, and they elected to reboot and rebuild the whole system. So they shut the company down for like a month, lost a ton of revenue by doing so. But that was the only way they knew for sure it could be theirs. What I mean, what I'm guessing you, your clients have faced this before. I mean, and maybe some of it you can talk about, some of it you can't. But what education should be out there for the average business owner in terms of what they should do, and if they encounter a situation like this, then what do you do?

Jeremy Huson 14:06
Yeah, so we always say that the weakest link in the chain is people. That is generally where most of these compromises happen. You know, you'll see a lot of the things like hackers kind of typing away on keyboards and things. It's usually a lot more simple than that. So it's usually like a link in an email. You visit a website that's compromised, and they can steal some information from you and things as well. So it's just really all of our clients go through cybersecurity training. So like for example, every month they'll we'll send them fake phishing emails to see who clicks and opens them. Oh, interesting. Yeah, there's definitely Yep, there's definitely some repeat offenders within our customer base. You're like

Mark D. Williams 14:47
Greg. Greg, stop! There's no free cookies. Stop getting the cookie link.

Jeremy Huson 14:52
Exactly, exactly. And then we also do cyber security training every month with them, like about some of the latest threats and what to look out. And the other biggest threat, as well, is just badly configured systems. Like someone who's gone in before has just left something open that they shouldn't have done, or they haven't closed something off that they should have done. That's usually it. The zero day exploits that we talked about before is usually much more specialized, and that's usually used by like government entities or or special hackers. But to go back to what you were saying, when you're dealing with some of these cyber criminals, like if you don't pay, they leverage and they're just going to say we're going to release all your data to the public. And there have been instances where people have paid, they've got their data back, but they haven't closed the original loophole, and so the attackers just go back in and re-encrypt them, and then ask for another ransom. So it's kind of like that. It makes sense that old thing. We don't negotiate with terrorists because, like, you don't really know what it is. Like, how can you? To your point, you're you're trusting a thief. I mean, that sentence alone doesn't really work. Yeah, yeah. I mean, there was one that I went to a conference a few years ago, and to give you a scale about these people, they had there was an advert for someone to create some of these phishing campaigns, and the advertised rate was $750,000 a year salary plus a $250,000 bonus if they could deliver a result within three months, so you know a million dollars a year paid to do this, and that was just one gang. There's a lot of them out there. Wow,

Mark D. Williams 16:30
it's kind of interesting. I'm curious your take on this. I mean, you're in this, you're in the software space, if you will, or in for sure digital. I'm in the home building space, and so it's a very physical thing that you're building. I mean, obviously, we do a lot of AI and our blog writing and research, and like anyone else, you're trying to how can you utilize it to be more efficient, but not overly depend on it, so you lose your voice and authenticity. I've sort of been thinking lately that, at least for me specifically, but I actually think that there'll be a backlash a little bit. I don't know about the whole world, but specifically for those that can afford it in the higher echelon, I do think that there will be a desire for analog in terms of like nostalgia and like authenticity and real. I mean, now the videos are so good, you don't even know if they're real people anymore. And so it's like I think when people lose trust, they start to tune out. I mean, I think it's great for movies. I mean, who doesn't like? I'm watching the Marvel movies with my boys right now. Like, who doesn't want to watch awesome fight sequences? I mean, it's you know, if you're a comic nerd like me, I mean, it's pretty awesome to watch in a movie. But for real life, it's kind of like if I can't touch it, if I can't meet the person, if I don't know the story behind it, it loses so much of what it is to me, it misses the story. I don't know. Do you think that there will be sort of a bit of a backlash in terms of people trying to seek things that they know is real, or will people just continue to do what's convenient and easy and cheap?

Jeremy Huson 17:56
I think there's going to be a bit of a mix. I myself can already feel like the backlash for it, you know. We have a a phrase called vibe coded. So anything that like you know you can make in Claude code is what we call vibe coded. And if you go to a website, you can almost spot it immediately that like this has been made by Claude. And I think a lot of people are going to start to fall into that bucket because they don't know any better. Like you know, if you put bad things in, you're going to get bad things out, and it's these kind of like people that are more specially trained on it and know how to do things that are going to be able to you know make things that are much more particular and better. But at the same time, like I think humans want that human connection, and whilst there's some fun stuff that come out of AI, you know, like a cat playing a guitar or something. There's going to be a real want for that kind of human connection and human kind of touch on some of these things. Yeah, but I think AI is great for being able to make a lever to make you more efficient and output 10 times what you can do today.

Mark D. Williams 18:58
Yeah, I mean, I agree. What are you, you know, going back to the nature of your company, and I just think it's-I mean, it's cool when it's not your problem. But I mean, have you had to negotiate with hackers before with your clients?

Jeremy Huson 19:11
So when it gets to that point, we usually have the insurance company involved. Most of our clients have cyber insurance. We obviously have cyber insurance, and then depending on the scale of it as well, the FBI or the Secret Service, they deal a lot with money coming back and being able to track down money that has otherwise gone. But it does happen. You know, we caught someone the other day where they were wanted to transfer like $187,000. They went through several checks and everything, and it all appeared legitimate. But we managed to get it stopped to the last minute. But it's it's really starting to to get out there. But we get involved with this process, and it is like it's scary for these people. You know, it's once it's gone, it's very difficult to get back, and it's you know hard to earn that money.

Mark D. Williams 20:02
When it comes to quality, craftsmanship, and performance, Pella sets the standard. Whether you're building custom homes or designing a timeless space, Pella offers innovative window and door solutions that blend beauty and efficiency. With showrooms and experts around the country, Pella makes it easy to find the perfect fit for your next project and their team to support it. Build with confidence. Build with Pella. Visit Pella.com to explore products and connect with your local rep today. For more information, you can listen to episode one or listen to episode 109, where we bring on Pella owners and founders at Pella Northland, as well as their innovative team behind the SteadyStat innovation. Well, and especially, I would imagine the volume. You know, you always hear about it, at least from a you know just a citizen's point of view. It's like you know the misdemeanors are calling the police, and I think when there's emergency situations that are big, let's call it like shootings or fires or things like that, I think our system's great at that. I don't think our system's super great at like, hey, there's a car parked out there for a week. Like, can you send the detective over? I mean, it's just like there's so many fires burning that are hotter than that one. So many of the misdemeanors just kind of like get. I have to believe that cybersecurity, considering that it can be, who knows if it's a bot or a person or you know how big these operations are. If you're running a full, I'm sure they're treating it like a full-on business, right? And so it's like I mean, you know, and and and if that's the case, like how do especially if it's out of the country? Good luck being even across state lines, but how do you actually stopping the fraud is number one. But then to your point, like actually seeking retribution-not retribution, but seeking compensation or figuring it out. Like, man, what I just made a note. Like, I better double check with my insurance agent. Like, do I have cybersecurity? Like, I mean, that's the point of having you on these. I mean, everyone listening probably has a different relationship with you know what we're talking about. But insurance is there for a reason, and no one likes paying insurance until you need it. Then I guarantee you're glad you have it.

Jeremy Huson 21:58
Exactly, exactly. But there's also been a big pushback from insurance agencies as well, because starting probably a few years ago, these cyber attacks became more and more prevalent, and so they were paying out hundreds of 1000s and millions of dollars in each case, and they kind of turned around and said, like, you know, we can't sustain this. You have to have controls in place in your business to protect yourself, we're not just you know a free bucket of money. So we're now starting to see a lot of insurance claims being denied because like a company won't take like particular precautions ahead of time, and that's usually as well when we get brought in when something's happened. And whilst we can fix it, then it becomes a difficult conversation about you know how are you going to pay for this when the insurance isn't going to cover it.

Mark D. Williams 22:45
Well, I think insurances to be clear, insurance companies not in the business to lose money. Like some of the richest people in the world are giant insurance companies. I mean, look at our medical insurance and all that nonsense. But in the U.S. anyway, but where I was going to go with this is it's no different than fires. I mean, look at how much. If you're a home builder in the United States, your premiums for insurance has gone up because I guarantee all the fires that are happening. Like if we're in Minnesota, like Minnesota is amazing. We have 1/5 of the world's fresh water. Shout out to Minnesota. You can't have it. You got to come here. Two. I just heard a real interesting stat. West Virginia, oddly enough, is number one. Minnesota is number two in the United States for people that live here are from here, and what that tells me is Minnesota is a great place to be from, and a lot of people don't like our cold. If you're from here, you love the cold, but the or at least you say you do. But where I'm going with this is my buddy is a roofer out in Bozeman, Montana, and they can no longer do cedar shake roofs anymore because of all the fire claims from all the fires they've had out Westville last call it 15 years that are you know above what has been historically normal, so now it has to be composite metal because insurance companies will no longer insure a wood cedar roof because obviously if you got you know sparks flying in the air it lands on your roof starts your roof on fire you've got a $5 million you know insurance claim on a beautiful home, you know, on a ski slope, and so insurance companies obviously are changing. They're reacting. They're not in this to lose money. It's a little bit like the casino. The house always wins. There's a there's every once in a while when you got George Clooney and Brad Pitt coming in there to steal from the casino. But other than that, they're usually winning, and so anyway, I've got a bunch of stuff I want to talk to you about offline because this conversation has opened up a bunch of questions that I would love to talk more about. Not only stories, but like, what should the average entrepreneur, because that's really who our audience is, what precautions do they need to take? And I don't know if if you guys are into you know blog writing or publishing or or how much you educate the general public, because I think a lot of people they just need to be told what are some simple steps they can do, and I think I'd love to have you back on and just talk about some simple stuff. So, like, how would you go about organizing your life and your company so that you protect yourself at least to the degree that you can?

Jeremy Huson 24:57
Yeah, absolutely. I mean, there's definitely some things and. I think one of the other massive things is you know make sure you back up your data. If you have you know Google or Office 365, like just put it all in there because if you lose your laptop, if it gets stolen, if it breaks, if it you know attackers get to it and you lose all that data, it's difficult to comprehend. You know, I say to people, well, what happens if you came into work one day and you just couldn't turn on your computer? Like, what would you do? And they kind of laugh, but you know, what would you do? You're just going to sit there and you're just going to have to start rebuilding from scratch. Like, it's extremely disruptive to the business.

Mark D. Williams 25:33
Yeah, I definitely we should write something about that because I mean, this literally happened to me 45 days ago. Somehow, my Google, I'm and I unfortunately they got the golden goose. They got the master password because they got mine, and we stopped it within like an hour or two. But one thing that I didn't understand is that they weren't actually that smart. I mean, if you were really smart, you would have sat on that for months, right? And then just waited and waited and just spread it all out. But they went after the classic. They got everyone in your email and just blast everyone with the same nonsense, and so it was just kind of a pain in the butt. But we had to basically our our tech team cut it off, you know, within an hour or two of it, which is great. But then we had to, you know, all my emails, like most entrepreneurs, you know, it's like whatever you're working on, you know, we lost that. But luckily, we had it backed up within six hours, so I only lost six hours of stuff, which is not that big of a deal. But to your point, at least we had it backed up, and they could restore computers to that point. If you don't have that, man, you could really, especially you know, the state of Minnesota, we have to keep carry our financial data for a decade. You know, so it's a it's a big deal. We're up against the time. I'm sorry. I would love you. You're too interesting a person. I got I got to bring you back on. We got to talk more about this. We'll have everything in your show notes. What's what's your guys's website?

Jeremy Huson 26:45
So it's www dot cardon, which is c a r d e n i t services.com.

Mark D. Williams 26:56
Perfect. We'll have it in the show notes as well. And thanks for coming on, sharing your story, Jeremy. I appreciate it.

Jeremy Huson 27:01
Great to be here.

Mark D. Williams 27:04
Thanks for tuning in to Curious Builder Podcast. If you like this episode, do us a favor: share it with three other business owners. The best way that we can spread what we're doing is by word of mouth, and with your help, we can continue to help other curious builders expand their business. Please share it with your friends, like and review online, and thanks again for tuning in.