Menu
Sign In Pricing Add Podcast
Podcast Image

Darknet Diaries

144: Rachel

Tue, 02 Apr 2024

Description

Rachel Tobac is a social engineer. In this episode we hear how she got started doing this and a few stories of how she hacked people and places using her voice and charm.Learn more about Rachel by following her on Twitter https://twitter.com/RachelTobac or by visiting https://www.socialproofsecurity.com/Daniel Miessler also chimes in to talk about AI. Find out more about him at https://danielmiessler.com/.SponsorsSupport for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.

Audio
Transcription

0.049 - 20.023 Jack Recider

When I was in college, a scammer called me up. He's like, look, I'm not selling you anything or even telling you what to do. I just have information about a stock and I wanted to share it with someone. And you were just like the lucky guy I found in the phone book. Listen, stock Z is going to go up next week. That's all. I'll call you back next week to prove it.

0
💬 0

20.743 - 43.592 Jack Recider

I was like, all right, that was a strange call. Whatever. And yeah, he calls me back in a week. And sure enough, the stock he told me about went way up. He was spot on. He was all excited about how much money he made. But I told him he just got lucky and he should cash out and take a trip somewhere. He's like, no, no, no, it's not luck. There's an algorithm that can accurately predict this.

0
💬 0

44.252 - 61.927 Jack Recider

And he said he knew which stock was going to go up next. I was like, all right, so which one's going to go up next? And he tells me and says to keep an eye on it. And he's going to call me back next week to prove he was right. So, yeah, another week goes by and the same guy calls me back and he's like, boom, you see what I mean? And he was all excited again.

0
💬 0

61.967 - 78.263 Jack Recider

And I was like, I don't see what you mean, but let me check the price. And I checked the price and again, he was right. And I was like, dang, good job. But I think you got lucky again. He said, no, he's been doing this for a solid year now and he's been right every time.

0
💬 0

78.763 - 94.759 Jack Recider

And he tells me more about this algorithm and how he's analyzing different indicators and watching the stock market extremely close and just has everything dialed in. And he tells me about another stock that he says is surely going to go up. And I'm like, okay, call me back in a week. Let's see if you're right.

0
💬 0

95.379 - 114.465 Jack Recider

And sure enough, after a week, I checked and he was right again, three accurate stock price predictions in a row. And he called me back and he's like, dude. And I'm like, dude. And he's like, you see that? I said, I saw that. How are you doing this? And he's like, I cracked the code. But then, like the snake he was, he tried to strike at me.

0
💬 0

114.925 - 134.077 Jack Recider

He said, listen, the next one is the craziest one I've ever seen. There's this company whose stock price is going to explode. But the best part is they're in the initial investor round. So you can get in on the ground floor if you want. How much do you want to invest? Ten grand? You've slept on three of these. You're not going to want to miss another, right?

0
💬 0

137.667 - 146.869 UnnamedCaller

I'm a college kid, dude. I've got 30 bucks in the bank. I don't have 10 grand. And he's like, oh, crap. He hung up the phone.

0
💬 0

148.29 - 165.715 Jack Recider

But this fascinated me. Who was this guy that was always getting the stocks right? What was his algorithm? So I looked into it. I met with a stockbroker and I asked him, how is this possible? And he's like, oh, that guy was a scammer. And I'm like, duh, I know. But how did he get the stocks right every time? And this guy broke it down for me.

0
💬 0

165.755 - 183.148 Jack Recider

He said, okay, that guy called up a whole bunch of people on week one, told half of them the stock was going to go up, told the other half the stock was going to go down. Then he called back the people who he was right with. And he told half of them about another stock that would go up. And the other half, he would say that stock's going to go down.

0
💬 0

183.709 - 202.7 Jack Recider

And then he did it a third time, calling back the people he was right two times with, telling half of them that the stock is going to go up and the other half saying it's going to go down. So by the time he did that three times, he had this small pool of people who he was right with every time. But really, he was just playing a math game with his victims.

0
💬 0

203.96 - 221.028 Jack Recider

And I think this is such a long but brilliant scam. Seemingly, this guy was golden, perfect, getting it right every time. But what I didn't know is that he was getting his predictions wrong all over town. And I was just one of the unlucky few that saw him get it right every time.

0
💬 0

225.754 - 236.903 Jack Recider

These are true stories from the dark side of the internet. I'm Jack Recider. This is Darknet Diaries.

0
💬 0

253.894 - 270.261 Jack Recider

Support for this episode comes from Delete Me. Feels like a war out there. Companies all over trying to scrape and store all kinds of personal data about me. My phone number, address, family members, where I work, sexual orientation, club affiliations, income level, what kind of car I drive. It's just endless.

0
💬 0

270.782 - 289.621 Jack Recider

And every now and then I Google myself and just get freaked out about the amount of data there is about me out there. This is why I use delete me. I registered there and told them what to look for about me. They were able to discover what sites have data on me and took steps to get that information removed for me. That's my favorite part. It's like getting help in this war.

0
💬 0

289.961 - 306.257 Jack Recider

Their scouts know exactly where to look and they'll tell me what they found about me. And if they can't remove it themselves, they'll give me recommendations on how to get it removed or mitigate it. Take control of your data and keep your private life private by signing up for Delete Me. Now at a special discount for Darknet Diaries listeners.

0
💬 0

306.617 - 336.795 Jack Recider

Today, get 20% off your Delete Me plan when you go to joindeleteme.com slash darknetdiaries and use promo code DD20 at checkout. The only way to get 20% off is to go to Join delete me.com slash dark net diaries and enter code DD 20 at checkout. That's join delete me.com slash dark net diaries code DD 20. This episode is sponsored by Mint Mobile.

0
💬 0

337.115 - 353.249 Jack Recider

With big wireless providers, what you see is what you get. Somewhere between the store and your first month's bill, the price you thought you were paying magically skyrockets. With Mint Mobile, you'll never have to worry about gotchas ever again. When Mint Mobile says $15 a month when you purchase a three-month plan, they mean it.

0
💬 0

353.849 - 372.867 Jack Recider

All plans come with high-speed data, unlimited talk and text, and you can use your own phone with any Mint Mobile plan and bring your phone number along with your existing contacts. To get this new customer offer with your new three-month premium wireless plan for just $15 a month, go to mintmobile.com.com. That's mintmobile.com slash darknet.

0
💬 0

373.348 - 398.307 Jack Recider

Cut your wireless bill to $15 a month at mintmobile.com slash darknet. $45 upfront payment required, equivalent to $15 a month. New customers on first three-month plan only. Speed slower above 40 gigabytes on unlimited plan. Additional taxes, fees, and restrictions apply. See Mint Mobile for details. Gather around. In this episode, we're going to hear stories from Rachel Toback.

0
💬 0

398.647 - 409.96 Jack Recider

And she's one of the best social engineers I've ever met. Let's start with your origin story. As a kid, how did you get interested in this type of work?

0
💬 0

411.301 - 435.491 Rachel Tobac

Okay, my origin story. So... My first time that I ever thought about being any sort of hacker was when I realized that being a spy is a job that people do. And it's a job that girls could do. And I learned this through the movie Harriet the Spy. She goes around sneaking into people's houses, spying. She takes her notebook everywhere.

0
💬 0

436.292 - 448.458 Rachel Tobac

She sneaks through the dumbwaiter in this rich woman's house and gets caught. And I just thought, oh my, I had no idea that a girl could be a spy. So that basically became my personality for my childhood.

0
💬 0

448.698 - 452.8 Jack Recider

Did you get into computers when you were older or still in middle school, I suppose?

0
💬 0

453.522 - 475.218 Rachel Tobac

I did not get into computers. I wanted to get into computers. I went to my guidance counselor in, I think, sixth grade. And I said, hey, I want to take these coding classes. And my guidance counselor, she said, Rachel, you don't want to take those coding classes. Those coding classes are 40 boys. You'd be the only girl there. Just take home ec instead. Wow.

0
💬 0

476.084 - 476.744 UnnamedCaller

Are you serious?

0
💬 0

476.884 - 496.85 Rachel Tobac

I know. And me being a child, I was like, oh, good call. I mean, yeah, I don't want to like blame her for like me never learning to code. I mean, I could have tried later in life, right? People try later in life all the time. But no, I've actually never written a single line of code. I ended up getting my degree in neuroscience and behavioral psychology. I was a teacher's assistant for statistics.

0
💬 0

496.91 - 498.77 Rachel Tobac

I never got into code.

0
💬 0

499.691 - 500.511 Jack Recider

Neuroscience?

0
💬 0

501.314 - 522.356 Rachel Tobac

Yeah. So my path to InfoSec and hacking, to the untrained eye, it doesn't make any sense. It's almost completely nonlinear. To me, looking back, it makes a lot of sense. So I got my degree in neuroscience and behavioral psychology. I was doing improv on the weekends. I was a teacher. I then was like, hey, I want to try and get into tech. I moved to San Francisco.

0
💬 0

523.277 - 547.707 Rachel Tobac

I was a community manager at a tech company. I actually ended up leading a UX research team. And then while I was at that tech company, my husband was in security the entire time. I actually met my husband in high school. I met him when I was 15 years old. So my husband was like, hey, I heard about this thing called DEF CON. I think you would get a kick out of it. And I was like, uh, pass.

0
💬 0

547.947 - 549.188 Rachel Tobac

I think I'm not going to do that.

0
💬 0

550.543 - 568.332 Jack Recider

Okay, so DEF CON is the annual hacker conference in Las Vegas. It's wild there. You'll see people walking around with antennas sticking out of their backpacks, talks about how to bypass just about anything on a computer, and tons of villages that focus on specific areas of hacking. The Social Engineering Village is one of the more popular ones.

0
💬 0

568.633 - 574.776 Jack Recider

And when Rachel's husband went into this village and saw what they were doing, he immediately called her up to tell her what he was seeing.

0
💬 0

575.136 - 595.185 Rachel Tobac

They do this thing where... They put you in a glass booth. It's soundproof in front of an audience of 500 people. You call companies and you try and solicit information out of them over the phone. It's the exact same skill that you use every month to get the bill lowered. When you call these companies, you build rapport, you get a deep discount on things like the cable bill. You'll love it.

0
💬 0

595.205 - 598.727 Jack Recider

And she's still like, no, I'll pass. Thanks.

0
💬 0

599.187 - 617.113 Rachel Tobac

He called me back and he's like, I just saw more of these calls, these social engineering calls. You have to come. Like, I promise you, if you don't like it, we'll just go gambling. As an aside, I love gambling. So I was like, okay, fine. I pack my bags. I get the first flight out Saturday morning.

0
💬 0

617.153 - 625.016 Rachel Tobac

And as you know, if you're at DEF CON Saturday morning, it's like DEF CON's like a third over at that point, if not more. So I show up, I see a few calls.

0
💬 0

626.175 - 644.271 Jack Recider

What she's watching was the social engineering contest. There's 14 contestants and they're given the task to basically get enough information to hack into a company all through phone calls. So you have to prepare and figure out who would be an easy target to get information from and what's their phone number.

0
💬 0

644.932 - 658.437 Jack Recider

And you better have backup numbers in case the person you call doesn't answer or hangs up on you. Once you do get someone on the phone, you get points for every bit of security data you can get off them. So if you can get them to tell you what operating system they use, you get a point or a flag.

0
💬 0

658.457 - 673.786 Jack Recider

And maybe from there, you try to figure out what browser they use, information about their security guards, what janitor service they use. You can't just ask these questions directly. It raises suspicion. So you've got to provide a pretext or pretend to be someone else.

0
💬 0

674.467 - 696.447 Jack Recider

Maybe someone who works in another department or someone brand new to the company who doesn't know anything but urgently needs to get a report done today. It's tricky. It's intense. It's high stakes because if you get caught on the phone, you're burned, and now you don't get any points. And the best part is the audience gets to watch all this live.

0
💬 0

696.888 - 704.977 Rachel Tobac

I see a few calls and I'm like, oh my, this is me. Like, I can do this. I was born for this. And my husband was like, I know, right? I told you.

0
💬 0

707.034 - 721.566 Jack Recider

So she immediately is like, OK, how do I compete in this? And yeah, it's a whole process. You need to submit an application, create a video of yourself and stand out from the crowd because only 14 are chosen to compete out of hundreds of people who try out for it.

0
💬 0

722.047 - 737.337 Rachel Tobac

And I was like, oh, I got just the thing. I made this Twin Peaks style video to convince them to let me get in. And somehow they agreed to let me participate. Hundreds of people apply and 14 contestants are selected every single year.

0
💬 0

737.357 - 750.379 Jack Recider

Now, they actually give you the target company that you have to attack ahead of time. So you can do your research on it, a lot of research if you want, because you want to find as much information as you can about this company, like going through Google searches or just looking at public places.

0
💬 0

750.78 - 768.663 Jack Recider

Maybe you get a list of people and phone numbers to call so that when it's your turn to call, you know exactly who to call and what questions to ask. In fact, it becomes quite a lot of work to prepare for that moment for when you're going to call someone. You could spend a solid month learning everything you can about your target company so you can shine when you're in the booth.

0
💬 0

769.103 - 789.97 Jack Recider

It was a major consulting firm is really all I can say. Now, these companies don't know they're about to get hacked. It's really extraordinary to watch. It's basically a live hack with an unsuspecting target. So she gathers as much intel as she can and heads to DEF CON to compete. I get in that glass booth. Now, all eyes and ears are on her.

0
💬 0

790.451 - 801.763 Jack Recider

Not only does she have to trick one person on the phone to give her the information they shouldn't be giving her, but she needs to do it in front of an audience. But she's done improv before and was absolutely ready for this.

0
💬 0

802.324 - 823.135 Rachel Tobac

I contact my target company. I pretend to be an employee who's confused, who's just starting out. And I end up getting flag after flag. And I get out of the booth and I'm like, maybe I did okay. And then there's like a standing ovation. I'm like, oh, maybe I did better than okay. And I ended up getting second place that first time ever hacking anybody.

0
💬 0

823.155 - 826.677 Rachel Tobac

That first time ever hacking somebody happened in a glass booth in front of 500 people.

0
💬 0

828.237 - 840.943 Jack Recider

Dang, second place. Of course, now she's hooked. That was fun as hell. The nerves, the adrenaline, hacking, and social engineering, all of this she was just craving more of. So she applies to compete again the next year.

0
💬 0

841.283 - 845.685 Rachel Tobac

And then I ended up getting second place the second year, and I got second place the third year as well.

0
💬 0

847.586 - 856.33 Jack Recider

Competing three years in a row in the social engineering contest and getting second place all three years, that's what started her career in social engineering.

0
💬 0

856.903 - 880.154 Rachel Tobac

After folks started seeing me get second place at DEF CON, they'd see me on stage, they'd be like, hey, I want to chat with you. Can you come speak at my company about how you hack and how we can catch you? And I live in Silicon Valley, so I got really lucky. that people started asking me to do things that like, are a job, right? Like, I'm like, Oh, I guess I need to make a company.

0
💬 0

880.495 - 897.451 Rachel Tobac

So I made social proof security in 2017. And I mean, I live in Silicon Valley, I was so lucky. Some of my first clients were like Facebook, Snapchat, PayPal, Twitter. And from there, it was like US Air Force, NATO, Uber, Google, Cisco, it's like, Oh, my gosh, you know, I feel like I just got really lucky in this life.

0
💬 0

899.738 - 920.672 Jack Recider

The crazy thing is that I've heard this story over and over. Someone who has no interest in hacking goes to DEF CON, sees the social engineering stuff going on there, immediately wants to compete, does pretty good in the competition, and then decides to do that for a living and start their own company. It's mind-boggling how many lives have changed from people attending DEF CON.

0
💬 0

921.072 - 937.595 Rachel Tobac

Oh, it's totally wild. I mean, if you would have asked me decades ago, like, what did you think you were going to get into? The word hacker would have never even made the top 100 list because I didn't know it was possible, didn't know it could be a job, and I certainly didn't think I would be good at it.

0
💬 0

938.136 - 957.633 Rachel Tobac

When I saw the concept of a hacker in TV or movies, it was usually a guy who wore a hoodie in a basement. I mean, I wear hoodies and basements are fine, but I didn't think that I was going to be good enough. Yeah, you just have to see yourself in the position. And I've had multiple women come up to me and say like, hey, I saw you in that competition.

0
💬 0

958.053 - 963.256 Rachel Tobac

Didn't realize it was possible for people like me. And now I do this for a living.

0
💬 0

964.818 - 982.706 Jack Recider

Okay, so she started a company called Social Proof Security, which is basically social engineering for hire. And companies were starting to hire her to see if they were vulnerable to social engineering attacks and what they can do to stop them. And of course, I'm fascinated by these social engineering stories. How do you hack into a company with just your voice or your charm?

0
💬 0

983.006 - 1000.101 Rachel Tobac

So a bank hired me to penetration test them. Effectively, they hired me to hack them. And they told me that I could hack via phone call, email, or chat. And my job was to take over multiple accounts and steal access, effectively steal the money out of the accounts.

0
💬 0

1000.261 - 1002.644 Jack Recider

You want to steal money out of customers' accounts?

0
💬 0

1003.244 - 1028.956 Rachel Tobac

Yes. And when we do a penetration test, it's very particular. I don't want to steal money from everyday people. That would be horrible and really scary for bank customers to just randomly have money stolen because of a pen test. So what we do is we create fake bank accounts. We work with the team on the back end so that the support organization, for all intents and purposes, sees a real customer.

0
💬 0

1030.014 - 1038.579 Rachel Tobac

but we've created fake bank accounts for me to steal so I don't actually harm real people. But the support team doesn't know they're fake.

0
💬 0

1039.16 - 1053.488 Jack Recider

Okay, so this company is a bank, and she's told that she can target customer support to see if she can access a customer's bank account. And she's given the options to use a phone call, email, or chat to get through.

0
💬 0

1053.509 - 1076.317 Rachel Tobac

That's right. So I started with the chat feature. And I posed as a customer to see if I could take over a customer account with just chatting. So I told the bank support people my sob story. I lost access to my phone, my email, my laptop. I got lost and I had a night out and I'm traveling abroad. I mean, like the whole story, right?

0
💬 0

1076.977 - 1096.273 Rachel Tobac

And I really need access to my bank account because I'm stuck and I don't have money. And the first thing that I usually try when I'm trying to do an account takeover is I try to see if I can get them to change the email address or the phone number on the account. Because if I can do that, then I can change effectively the admin on the account.

0
💬 0

1096.993 - 1115.539 Rachel Tobac

Just by changing the email address, I can then reset the password or reset to a phone number that I control. There's SIM swapping and all of that that could happen after that. But, you know, that's basically how it works. And they're like, oh, well, we can't do that because we need to only send the password reset to the email address already on your account.

0
💬 0

1116.138 - 1118.119 Jack Recider

Good for them. That's the protocol they're supposed to follow.

0
💬 0

1118.339 - 1138.524 Rachel Tobac

That's exactly right. So good job, bank. Horrible for me as the pen tester. A lot of times I have to play both sides of this game. I have to train the company and update their protocols to prevent people like me from getting in. But when I'm first attacking them, it's so frustrating. So I try chatting with multiple other support people. I'm trying again and again.

0
💬 0

1138.784 - 1162.664 Rachel Tobac

They will not make any exceptions for me. It doesn't matter my pretext. That's who I'm pretending to be. It doesn't matter how I contact them, what I say, my story, nothing. So I decide to switch to phone call-based attacking because I tend to be much more successful. So I switched to phone calls. It leaves less of a paper trail. People tend to get less suspicious because I can build rapport.

0
💬 0

1162.684 - 1173.268 Rachel Tobac

They can hear my voice. They can hear how trustworthy I sound. And also when I'm calling, I can spoof phone numbers. And a lot of times that helps me gain access.

0
💬 0

1174.028 - 1196.346 Jack Recider

Spoofing phone numbers. How is this still possible? You can download an app from the mobile app store, and within a few taps, you can change what phone number you're calling from to have any phone number you choose. So you can make it look like where you're calling from is not actually where you're calling from. Now, when I was young, I used to do this with emails.

0
💬 0

1196.746 - 1204.995 Jack Recider

I would love to send emails to my friends pretending to be from the FBI or the President of the United States. And I'd be like, Bill, you're in serious trouble.

0
💬 0

1205.035 - 1211.102 UnnamedCaller

We're coming to get you. And then my friend Bill would be like freaking out. And it was awesome fun.

0
💬 0

1211.783 - 1227.777 Jack Recider

But then the email protocol got updated. They implemented SPF records somewhere around 2006, and this ensures that the place you sent the emails from is where the emails are supposed to come from. This effectively put an end to email spoofing.

0
💬 0

1228.357 - 1247.173 Jack Recider

Of course, not all companies configure their SPF records properly, and you can still spoof it, but at least the option is there if you want to block someone from spoofing your email. But for phones, which have been around a lot longer than email, it's an unpatched vulnerability in my opinion. You can still spoof phone numbers.

0
💬 0

1247.613 - 1265.809 Rachel Tobac

Yeah, it's kind of wild. In the U.S., right now it's still possible because all of the telcos have to make the same decisions at the same time. And unless all of the companies get together and make the same choices, it's going to be really hard to implement the right solution. So at least in the U.S., spoofing is still really possible for me.

0
💬 0

1266.246 - 1287.596 Jack Recider

Now, since phone companies refuse to fix this, their solution was to help pass a law making it illegal to spoof phone numbers. So for now, it just seems like telephone companies are just relying on the police to help keep people from doing this. But to me, this is an awful way to secure things. Telephone companies can fix this if they want.

0
💬 0

1288.416 - 1307.928 Jack Recider

But while I see this as a vulnerability, telephone companies have historically said, wait, why are you using telephone numbers as identifiers? They were never meant to be identifiers. And they put the blame on us for doing that because for a long time, our phones didn't have screens. So we never knew who was calling until you picked up the phone and said hello.

0
💬 0

1308.608 - 1328.617 Jack Recider

But then telephone companies gave us caller ID where our phones would show who's calling. And so I do blame telephone companies for making us think it is an identifier since they were charging extra for that feature back in the 90s. And mobile phones today all come with this feature. So I say, phone companies, turn caller ID off if you don't want us to use it as an identifier.

0
💬 0

1328.997 - 1348.702 Jack Recider

Otherwise, patch it so phone numbers can't be spoofed anymore. So anyway, Rachel was trying to get into a customer's account. Let's call the customer Kelly. And she figured out what phone number Kelly had. And Rachel spoofs her number to look like she's calling from Kelly's phone.

0
💬 0

1348.962 - 1367.807 Rachel Tobac

I spoof my phone number. I make it look like Kelly on the account. And by the way, on data brokerage sites, when we're doing OSINT, open source intelligence, typically we can find most people's phone numbers within a minute or two. So when we're searching, we can just know, okay, this is Kelly. This is Kelly's phone number. I'm going to go ahead and spoof that. I set that up.

0
💬 0

1367.967 - 1379.299 Rachel Tobac

It usually costs me a dollar or so on the tools that are available on the app store. These are not like heavily regulated. You can just find them on the app store. And I go ahead and I place that call.

0
💬 0

1381.26 - 1383.802 Jack Recider

Can you give me an example of how you sound on these calls?

0
💬 0

1383.822 - 1386.484 Rachel Tobac

You're going to make me act.

0
💬 0

1387.064 - 1387.304 Jack Recider

Yeah.

0
💬 0

1387.584 - 1397.911 Rachel Tobac

Okay. Okay. Give me one second. I got to get into character. I'm going to change my clothes so I can get into character. Here we go. Okay. Here we go. Ring, ring, ring. Oh, wait. We both said ring. Okay.

0
💬 0

1398.732 - 1400.553 Jack Recider

Thank you for calling the bank. How can I help you today?

0
💬 0

1401.694 - 1416.717 Rachel Tobac

Hi, I am so sorry. My name is Kelly Smith. So I'm traveling right now and I just lost my laptop. My phone's not working. I cannot get access to any of my funds. I'm super stressed out. Can you please, please help me?

0
💬 0

1420.215 - 1433.512 UnnamedCaller

That was good. I won't make you do more. Thank you. So, yeah, I mean, they've got a script that they go through where they're just like, okay, well, you know, do you have the last four digits of your phone number or whatever the case is to verify you?

0
💬 0

1433.532 - 1436.336 Jack Recider

Is that how you're challenged or what happened?

0
💬 0

1436.596 - 1460.973 Rachel Tobac

No. So this bank knew that KBA, knowledge-based authentication, things like what's your address? What's the last four digits of your phone number? This bank knows that that information is very easily found online. So they don't use KBA, knowledge-based authentication, to verify your identity. They usually use MFA, multi-factor authentication. Now, this is great. This is exactly what I recommend.

0
💬 0

1461.333 - 1479.6 Rachel Tobac

You know, send a code to the email address on file and make them read it out to you rather than going through this process of verifying identity with information that can be found by an attacker in five minutes online. So that's good. But as an attacker, that's going to be a challenge because I don't have access to that email address.

0
💬 0

1480.461 - 1501.333 Rachel Tobac

And when I'm spoofing a phone number, I actually can't receive text messages. And if they call back, I'm not going to be the one that answers that phone call. I'm just spoofing. It looks like I'm calling, but I don't actually have access. Now, of course, I could SIM swap and many criminals will do that. But for the purposes of this pen test, that's not what I'm testing. So they say, okay,

0
💬 0

1502.332 - 1522.656 Rachel Tobac

We have an edge case here. Let me see if I can talk to my manager and have you send in a picture of your driver's license, your social security card, and a utility bill. And instantly I'm like, okay, bingo. We're in. The other half of social security is my husband, Evan. He does all the technical stuff. I do all the human hacking stuff.

0
💬 0

1522.816 - 1526.897 Jack Recider

This is great because I need a fake driver's license. So I can't wait to hear how you got a fake driver's license.

0
💬 0

1527.197 - 1541.792 Rachel Tobac

No. Okay. So my husband, Evan, he gets to work editing a driver's license, a social security card, and the utility bill to the exact information that they're expecting for this account, which again, we can find through a data brokerage site.

0
💬 0

1542.833 - 1566.199 Rachel Tobac

So we're hoping that this company does not know the actual driver's license number, the actual social security number, and they're just looking to ensure that the name and address that are on the account match those documents. I can find those pieces of information through OSINT. And a lot of times I've noticed that when they ask for these types of documents, they don't know the right info.

0
💬 0

1566.239 - 1568.68 Rachel Tobac

They're just hoping that it matches and they stop there.

0
💬 0

1569.941 - 1579.625 Jack Recider

So you didn't need a real driver's license, social security card. You just needed a JPEG, right? Correct. And that's the trick there. Photoshop was your friend.

0
💬 0

1579.705 - 1605.715 Rachel Tobac

Photoshop, yes. We spend all night on these driver's license, social security cards and utility bills of the accounts we're trying to hack. I email the bank at 8 a.m. the next day. I tell them my story. I tell them the edge case that we have set up with support. I send them the driver's license and social security card and utility bill. By 9 a.m., I have full admin access to the bank account.

0
💬 0

1606.856 - 1622.487 Rachel Tobac

I have changed it to be controlled by my attacker-controlled email address, and I can steal all of the money in the account. So once I finally get in, I have access to everything. I use the same method again and again. I get access to two more accounts throughout the day.

0
💬 0

1622.507 - 1634.976 Rachel Tobac

I end up spreading out the request so that we're not raising suspicion with the same attack method over and over again, back to back. And in the end, we took over each bank account that we were asked to to hack within two days.

0
💬 0

1636.949 - 1660.94 Jack Recider

It's truly astonishing, the sheer force of the human voice, its ability to persuade, to move, to manipulate, all through a simple phone call. It also reminds me of how vulnerable customer support is to this kind of exploitation. When you're met with a soft voice telling you a sad story, but wrapped in kindness, it tugs at your heartstrings.

0
💬 0

1661.54 - 1676.503 Jack Recider

You find yourself eager to assist, especially if you just got off the phone with a real prick who was yelling at you about overcharging him 10 cents. Contrast that with a kind voice that's truly asking for help. And it really makes it hard to say no.

0
💬 0

1677.273 - 1694.118 Rachel Tobac

I know that in a lot of these organizations, there are edge cases. So I'm helping companies say, okay, we did this pen test. We figured out what the edge case is. We figured out how we got access. How do we make sure we don't fall into this trap next time when the real criminals get here?

0
💬 0

1694.838 - 1714.769 Rachel Tobac

So I then help them with, okay, let's set up some edge cases back to back so that we have something like a callback. That would thwart spoofing. If you don't want to use that, you can use email verification, one-time passwords, you know, sending a code or just a word to the email on file and having them read that out. SMS verification.

0
💬 0

1715.39 - 1732.906 Rachel Tobac

Okay, they claim they're calling you from this phone number, but maybe they're just spoofing it. See if they can read out a text message, callbacks toward spoofing, service codes, PINs or verbal passwords. If it's some sort of internal support ticket, you can loop in a manager.

0
💬 0

1732.986 - 1751.708 Rachel Tobac

There's so many ways to do this right that a huge part of the pen test is not just hacking the company, but helping the company figure out what is a real practical way that we can solve these edge cases in the future to verify identity the right way and make it harder for you to get in that. the next time. Because I'll go in, I'll make it harder for me to get in as an attacker.

0
💬 0

1751.888 - 1760.84 Rachel Tobac

And then the next year, I'm like, oh my, this is so hard for me to get in until the point where I can't get in anymore. And that's when I'm like, okay, you've done the most that you can do.

0
💬 0

1761.561 - 1781.503 Jack Recider

It's time for a sponsor break, but stay with us because Rachel has a few more stories that she's going to share with us. Support for this show comes from Black Hills Information Security. This is a company that does penetration testing, incident response, and active monitoring to help keep businesses secure. I know a few people who work over there, and I can vouch they do very good work.

0
💬 0

1781.904 - 1801.594 Jack Recider

If you want to improve the security of your organization, give them a call. I'm sure they can help. But the founder of the company, John Strand, is a teacher, and he's made it a mission to make Black Hills Information Security world-class in security training. You can learn things like penetration testing, securing the cloud, breaching the cloud, digital forensics, and so much more.

0
💬 0

1801.974 - 1823.002 Jack Recider

But get this, the whole thing is pay what you can. Black Hills believes that great intro security classes do not need to be expensive, and they are trying to break down barriers to get more people into the security field. And if you decide to pay over $195, you get six months access to the MetaCTF Cyber Range, which is great for practicing your skills and showing them off to potential employers.

0
💬 0

1823.402 - 1849.376 Jack Recider

Head on over to blackhillsinfosec.com to learn more about what services they offer and find links to their webcasts to get some world-class training. That's BlackHillsInfosec.com. BlackHillsInfosec.com. On another engagement, Rachel was hired by a company to help them sort out an issue that they kept encountering.

0
💬 0

1849.757 - 1864.051 Jack Recider

It was a large technology company who would sometimes buy or acquire smaller companies. Now, when you're buying another company, you typically want to keep it quiet until the official announcement. It could affect share price or cause panic in the company if things aren't communicated properly.

0
💬 0

1864.591 - 1883.935 Jack Recider

But for some reason, when this technology company would do any merger or acquisition, it would get scooped by some news agencies. The announcement would show up on news sites way before the company was ready to tell the world. So this company was like, Rachel, maybe you can help us figure out how this news keeps slipping out ahead of schedule.

0
💬 0

1884.215 - 1900.719 Rachel Tobac

And so they approached me about doing a pen test to figure out how this M&A info was getting leaked. where they could possibly improve their training, their messaging, their internal protocols to figure out why is this happening? Why are folks being incentivized to talk about this and what can we do about it?

0
💬 0

1900.899 - 1908.062 Jack Recider

When you hear this, what's your mind first go into? Like, you've got an insider threat somewhere. You've got a breach, an active breach.

0
💬 0

1908.282 - 1928.498 Rachel Tobac

Yeah, so insider threats happen. But what is usually most common is people just make a mistake. I kind of live in this world where I assume that people are making mistakes and I try and help them. So we came out with a few different attack methods that might work to uncover where this is happening.

0
💬 0

1929.339 - 1945.924 Rachel Tobac

Number one, I was going to attempt to pose as a journalist and reach out to various team members, asking them via social media DMs, email, text message, et cetera, about their experience in tech and see if I could siphon out M&A info and just see where it goes.

0
💬 0

1946.894 - 1965.536 Rachel Tobac

And number two, I was going to apply to their product manager role, go through the entire hiring process and see if I could extract M&A related info during the question portion of the hiring interview. I did not know what was gonna work and what wasn't, but I just wanted to try both.

0
💬 0

1968.598 - 1981.243 Jack Recider

All right. So if you're going to pose as either one of these people, it sounds like you're going to need a LinkedIn account or at least some online presence. You can't just show up as a nobody, right? Or I mean, at least it helps establish your background and your pretext.

0
💬 0

1981.583 - 1982.124 Daniel Miessler

Definitely.

0
💬 0
0
💬 0

1991.407 - 2004.937 Rachel Tobac

So we call these ghosts, we call them SOC accounts. Sometimes they'll be real people, and so we'll fashion them pretending to be a real person. Sometimes they'll be fake people, and they'll just have this full life online.

0
💬 0

2005.717 - 2026.61 Rachel Tobac

With the fake journalist, I figured it was going to be a lot easier to pretend to be a real journalist and just not actually be them than create an entire persona of a fake journalist and populate real content. So I built a fake journalist pretext, email, background, and social media based on a real journalist who I'm not going to name, of course.

0
💬 0

2027.85 - 2055.175 Jack Recider

Interesting. Rachel tried to be another journalist that actually exists, maybe by doing something like using a similar email address or social media accounts. But the question is, how do you know who to ask in a company to get information about upcoming mergers and acquisitions? These are typically closely guarded secrets, right? But there is a website that's extremely helpful to social engineers.

0
💬 0

2055.956 - 2074.18 Jack Recider

There's a website that lists pretty much every company and most of the employees that work there. And it tells you their job title, role, what duties they have, and full name. The website is LinkedIn.com. And personally, I feel like LinkedIn is a security risk to most companies on there.

0
💬 0

2074.64 - 2097.401 Jack Recider

It makes it really easy for someone like Rachel to go down the list of people who work at a company and pinpoint the exact person to target. Once you have their name, it's probably easy to get their email address. It's usually first.lastname at companyname.com. I mean, not only is there a list of people who work at most companies on LinkedIn, but they like to list their skills too.

0
💬 0

2097.961 - 2119.2 Jack Recider

And if someone says they've worked for a company for 10 years as a database admin, and specifically they say they're excellent at Microsoft SQL Server, Now you can guess with high confidence this company runs Microsoft SQL Server internally, and this person probably has the admin password for it. And we all know how susceptible people are to phishing emails.

0
💬 0

2119.76 - 2140.31 Jack Recider

I mean, my opinion is if you list and stuff like that, you're just putting like a big old beacon over your head saying, hey, I'm the person you're going to want to hack if you want to get in the database of this company. Come at me. Essentially, the private information that should just be kept inside the company is posted publicly for anyone to see on LinkedIn.

0
💬 0

2140.95 - 2164.164 Jack Recider

And I mean, here's a story where the company is wondering, hey, how come the public knows about one of our internal memos? I say start by auditing what your employees are posting to LinkedIn. If the company is totally cool with all this internal stuff getting posted publicly, then maybe that's perpetuating a culture change. That's okay to blab about exciting news to whoever asks.

0
💬 0

2165.806 - 2170.931 Jack Recider

I had someone message me on LinkedIn the other day asking me, hey, how can I get my data taken off the internet?

0
💬 0

2171.812 - 2177.677 UnnamedCaller

Like, is this your photo? Is this where you work? Is this where you went to school? Is that your actual name?

0
💬 0

2178.438 - 2199.924 Jack Recider

And you posted all this to LinkedIn and you're wondering how come the internet knows all this stuff about you? Because the thing is, a lot of what data brokers know about us is from the stuff we post publicly. Data brokers are scouring our social media profiles, our blog posts, and any mentions of us on the internet. And then data brokers store all that information about you that you posted.

0
💬 0

2200.264 - 2215.861 Rachel Tobac

It's frightening. And I mean, the reality of the situation is that... Anybody can do a full background search in less than five minutes on most people in the U.S. And people don't realize that this information is out there about them. They have no idea that it's being sold. They just don't Google themselves.

0
💬 0

2216.301 - 2225.712 Jack Recider

I say we should take our own privacy seriously because the more we don't care about our privacy, the more companies won't care about your privacy.

0
💬 0

2226.849 - 2247.152 Jack Recider

Anyway, as you can imagine, Rachel had this target company and was able to quickly guess at who might know about upcoming mergers and acquisitions and started hyper-targeting them, doing full background searches on them, gathering up their details, and just started reaching out, acting like a journalist, emailing them, wanting to see if she can easily get this information from people.

0
💬 0

2247.62 - 2261.151 Rachel Tobac

Exactly. Or we can reach out over social media DM, you know, DM on LinkedIn or Twitter or Instagram. And I mean, that's the thing. Journalists really do reach out using all of those methods. So it's hard to know what's real and what's fake sometimes.

0
💬 0

2261.931 - 2273.02 Jack Recider

But it didn't work. No matter who she reached out to or how convincing her backstory was, people weren't freely giving her information about upcoming mergers and acquisitions. This method wasn't working.

0
💬 0

2273.527 - 2293.072 Rachel Tobac

They let me know some minor details about excitement about potential M&A, but they're not going to confirm any juicy details. And I try to get people on the phone to talk with me, but I think there's just like this inherent distrust of this particular pretext. So I'm like, okay, I got to really go for the big guns here. I want to attack via the hiring process.

0
💬 0

2294.752 - 2317.204 Jack Recider

Attack via the hiring process? What an interesting sentence to say. I don't think that idea crosses many people's minds, that people applying for jobs might have malicious intent. I've heard of the evil maid attack, but what's this called? The phantom applicant attack? There's a lot of information that you can get just from reading a job posting.

0
💬 0

2317.464 - 2335.314 Jack Recider

Like when a company lists the job duties, it might tip their hand into what endeavors the company is going to do next or expose what technology they have in the company. And these things can be used against the company in social engineering attacks. I think if you read enough job listings, you could probably develop a map of the data center.

0
💬 0

2335.894 - 2357.294 Jack Recider

Hacking into the company through the employment process is actually a decent attack vector. I don't think many companies would expect you to come in through that door. Anyway, what Rachel was going to do was pose as a job candidate and try to get an interview. And in the interview, she was going to see if she could get some insider information about upcoming mergers and acquisitions.

0
💬 0

2358.098 - 2383.664 Rachel Tobac

Something to understand is as an attacker, this is not easy to do. I've never been a PM. So to apply for a PM role takes a lot of background research. I mean, I led a UX research team at a tech company. So I do have a sense of what a PM, a product manager does, but I am in no way prepared for a PM interview. So I have to study for three full weeks for this role. I'm watching YouTube videos.

0
💬 0

2383.704 - 2396.553 Rachel Tobac

I'm doing interview prep quizzes online. I'm taking free online courses like, so you want to be a PM, like the whole nine yards. So I'm building a full persona, a resume, a Twitter, LinkedIn, Facebook.

0
💬 0

2396.993 - 2410.262 Rachel Tobac

All of these stock accounts have photos, thousands of friends, reviews of my work from networking groups on LinkedIn, people I've never met that like you give them a review and they give you a review. All of this stuff is so gameable.

0
💬 0

2411.129 - 2413.75 Jack Recider

I suppose this is stuff you do at Social Proof.

0
💬 0

2415.031 - 2421.194 UnnamedCaller

There's just one person sitting over there like, hey, just keep making sock accounts all day, everything, because I'm going to burn through them so fast.

0
💬 0

2422.295 - 2440.445 Rachel Tobac

Unfortunately, yes. We do change the names of many sock accounts, but then you have to populate a lot of new information. It ultimately takes me about three weeks to build a believable social media account and enough examples of previous PM work to get anywhere near convincible during the interview process.

0
💬 0

2440.814 - 2444.075 Jack Recider

Did you get help at getting your resume to the top of the pile?

0
💬 0

2444.515 - 2446.176 Rachel Tobac

No, I just had to apply.

0
💬 0

2446.196 - 2449.677 Jack Recider

That's not easy. You know, there's a lot of people don't get callbacks.

0
💬 0

2450.958 - 2474.7 Rachel Tobac

Well, during this period of time, the tech hiring process wasn't as bad as it is in this current year. So I apply for the role. I get a phone screen. I am sweating bullets because if I don't get through this phone screen, I will not move on to a full interview process. I'm going to have to do a bunch of work to change my sock accounts on social media to match a new persona.

0
💬 0

2474.72 - 2487.906 Rachel Tobac

It's going to be a lot more work for me. Luckily, it took like 45 minutes. I passed. I get moved on to the next round. The next round has six different interviewers.

0
💬 0

2489.441 - 2490.242 Jack Recider

Is this in person?

0
💬 0

2490.602 - 2491.923 Rachel Tobac

No, virtual, thank goodness.

0
💬 0

2493.424 - 2495.885 Jack Recider

Did you try to gain any information on the first round?

0
💬 0

2497.386 - 2498.647 Rachel Tobac

No, not during the phone screen.

0
💬 0

2499.187 - 2501.689 Jack Recider

Because you were like, I'm going to wait for the right time.

0
💬 0

2502.549 - 2524.075 Rachel Tobac

Yeah, I was terrified that they're going to be like, this person's a weirdo, like, let's not move them forward. So I waited until the actual official interviewers arrived. And it's going to be a packed day of interviews. I have six interviews back to back all day. These interviews are conducted over Zoom. I get all dressed up in my interview clothes that I haven't worn in years.

0
💬 0

2524.175 - 2542.259 Rachel Tobac

I'm prepped with all my anecdotes, my strengths and weaknesses, my KPIs and success stories. And a lot of these examples I'm using are heavily focused on UX research because if you remember, that's something I used to do. And many PMs do have advanced UX research skills. So I'm just like hoping that they don't think that's weird.

0
💬 0

2543.399 - 2555.933 Rachel Tobac

So I get to the first interviewer and the interviewer is like, okay, asking me all these questions. I seem a little nervous, but they're like, oh, you know, don't worry about it. It's going to be fine. We go through all the PM related questions.

0
💬 0

2556.073 - 2559.277 UnnamedCaller

You're nervous for all the wrong reasons. That's what's funny here.

0
💬 0

2560.178 - 2561.419 Rachel Tobac

I know, but I have to pass.

0
💬 0

2562.287 - 2562.567 UnnamedCaller

Yeah.

0
💬 0

2562.968 - 2563.768 Rachel Tobac

So I'm going through this process.

0
💬 0

2563.788 - 2570.854 UnnamedCaller

I mean, they're used to people being nervous. And so I could see them saying, oh, it's fine. You're doing great. Don't worry about it. And you're like, oh, thanks, because I'm trying to hack you.

0
💬 0

2571.274 - 2588.986 Rachel Tobac

No, see, the funny thing is when you're hacking people, a lot of times it makes sense for your pretext to match how you're actually going to feel when you're hacking. And a lot of times you are nervous when you're calling support because you can't gain access to your bank account. You are uncomfortable during an interview. These are normal human emotions.

0
💬 0

2589.026 - 2616.213 Rachel Tobac

And so it's okay to not be way too overconfident. Sometimes that can even read as strange. So yeah, I mean, I'm sweating bullets. It's clear I'm nervous. We finally get to the end and the interviewer says, so do you have any questions for me about the role? I have never been sweatier in my life. This is it. If they get suspicious during this moment, all of my work is for nothing. So I say,

0
💬 0

2617.951 - 2636.464 Rachel Tobac

I am so excited about this company. I hear there's a lot of opportunity for growth. I did a bunch of research. I did find a few news stories that mentioned XYZ potential merger. I know you can't confirm anything, but I just want to understand what an integration process looks like at your company during an M&A.

0
💬 0

2637.204 - 2662.682 Rachel Tobac

I know you can't confirm anything again, but I just want to understand how my role could potentially change over time. The interviewer takes a beat and says, you're right, I can't confirm anything. And my heart sinks. I'm like, no, this person's trained. And then they go, but just because I can't confirm doesn't mean I can't talk in generalities, right? And winks, actually winks.

0
💬 0

2662.702 - 2671.186 Rachel Tobac

I'm like, oh, this is going to be so good. So there's a lot of hand waving and, you know, I can't confirm, but throughout the rest of these interviews. But

0
💬 0

2672.086 - 2693.263 Rachel Tobac

It seems that everyone at this company knows you're not allowed to say information in plain language about M&As, but that doesn't mean that I can't glean pretty serious details about the upcoming acquisition plans that have been clearly discussed internally. By the end of this day, I got M&A info out of three of the six interviewers. So 50%.

0
💬 0

2694.534 - 2695.955 Jack Recider

What kind of info are we talking?

0
💬 0

2696.395 - 2723.185 Rachel Tobac

Yeah. So they wouldn't tell me the names of the companies that were potentially going to be acquired. But I would say things like, I saw a rumor about XYZ company. Is this the type of company that you would be excited about? And then the wink, wink, hand-waving process starts of, you know, I can't confirm it, but we are interested in integrating things like XYZ.

0
💬 0

2724.325 - 2748.827 Rachel Tobac

So I was able to glean information such that when I reported it back to the team, they were like, I mean, yeah, you got the right information. Nobody said anything in plain language, but you can get people to say things kind of beating around the bush. So in the end, I got M&A info out of 50% of the interviewers, three out of six. I debrief with the security team.

0
💬 0

2748.847 - 2768.876 Rachel Tobac

I ask them when they want to discuss the results with the organization. They say, well, let's just wait up and just finish the hiring process so that it's not a distraction to them. And in the meantime, the next day, I actually get an email that I used to apply for this role, that I was being moved to the next stage of the interview process to get an offer.

0
💬 0

2770.137 - 2776.6 Rachel Tobac

So not only did I siphon out the info I needed during the interview pen test, I also got the job, I guess.

0
💬 0

2777.315 - 2779.056 Jack Recider

Well, congratulations. I hope that goes on your resume.

0
💬 0

2779.156 - 2781.077 Rachel Tobac

I know, I should put PM on there.

0
💬 0

2781.577 - 2791.742 Jack Recider

So she meets with the security team and explains to them how she found out about all this upcoming mergers and acquisitions. And together they had a chat about whether this was just an obscure edge case or a bigger problem.

0
💬 0

2792.082 - 2820.075 Rachel Tobac

They realized that when they explained to people that they were not allowed to say the words of the acquisition, they realized that they needed to be clearer in their communication. That... No, just because you're not saying we are acquiring XYZ company, it doesn't mean that friends, family on social media, people can't glean information to understand, oh, they're interested in AI.

0
💬 0

2820.115 - 2828.959 Rachel Tobac

This person's talking about how their role is going to change. They're talking about how much they love this specific technology and they're tagging certain companies on Instagram or Twitter.

0
💬 0

2829.81 - 2851.508 Rachel Tobac

They realized that they needed to be much more specific in their protocols and language, saying, when we're planning an acquisition, once we talk about it internally, please do not talk about it even in a hand-waving fashion with friends or family or on social media. Don't talk about how your role is going to change on LinkedIn. Don't talk about what you're excited about upcoming on Instagram.

0
💬 0

2851.528 - 2863.579 Rachel Tobac

They had to be really clear about that. And once they did that, those leaks stopped because it wasn't an insider threat. It was just people not 100% getting what an attacker is interested in and how they could find that info.

0
💬 0

2864.54 - 2866.101 Jack Recider

Oh, so it did solve the problem.

0
💬 0

2866.241 - 2880.434 Rachel Tobac

It did. Yeah, it doesn't necessarily mean that it's coming through the interview process. Now, maybe it was, but it's probably just that people in general at the company didn't understand that when talking in generalities, that can be used by attackers too.

0
💬 0

2881.391 - 2887.553 Jack Recider

Yeah. And then you probably had recordings to show concrete proof of, when you say this, I'm hearing this.

0
💬 0

2888.014 - 2904.26 Rachel Tobac

Exactly. And they were like, oh, I get it. So I can't say that we're talking about this technology and how it's going to change my role as a product manager, because that tips off people to understand that we're going to be acquiring XYZ company in the next six months. That's where these leaks are coming from.

0
💬 0

2906.983 - 2921.334 Jack Recider

So, you know, you came on my radar because you sometimes just create these crazy viral instances online where I've seen you hack a... Who's Donnie from?

0
💬 0

2921.555 - 2922.896 Rachel Tobac

Donnie O'Sullivan from CNN.

0
💬 0

2923.596 - 2943.668 Jack Recider

From CNN. So I've seen you hacked a CNN correspondent. I've seen you hack voting machines before. I've seen you do all kinds of crazy things that suddenly you've got like a million views on this thing. And I'm just like, well, there she is again. Rachel's out there doing things. But one thing was interesting was when you went on 60 Minutes.

0
💬 0

2944.288 - 2965.052 Rachel Tobac

Yeah, last year or so, I started talking more on Twitter about how I'm seeing AI get used by criminals to trick people. So I'm talking about this, scammers are tricking grandparents out of 1500 bucks, posing as their grandson, spoofing the grandson's phone number, voice cloning, or just like modulating the pitch to sound like the grandson and saying they need money for bail.

0
💬 0

2965.412 - 2989.917 Rachel Tobac

Just talking about these examples. 60 Minutes sees this, They email me, they reach out, they say, hey, we want you to do a hack live. It's actually gotta trick somebody. Can you do that with us? And I'm like, I mean, yeah, I can do that, but it's complicated. I've done a lot of these live hacks over the years for large media pieces. You know, I need consent.

0
💬 0

2990.658 - 3000.342 Rachel Tobac

Before I do any sort of hacking, I get consent. Like when I hacked CNN's Donio Sullivan, I hacked him through his service providers, and I also hacked him through his leaked passwords.

0
💬 0

3000.942 - 3020.652 Rachel Tobac

And I had his consent with a lengthy contracting process and scope discussion before I was able to contact his service providers pretending to be him, before I was able to log into his LinkedIn using his breached passwords and the things that I found online. So I start explaining to them how much consent I'm going to need. And they're like, I mean, well, we'll try.

0
💬 0

3020.972 - 3045.548 Rachel Tobac

We'll just try and see what happens. So I start to talk to them about who my target is going to be. They want my target to be Sharon Alfonsi. She's an awesome correspondent for 60 Minutes. Rachel Toback is what's called an ethical hacker. She studies how these criminals operate. So ethical hackers, we step in and show you how it works.

0
💬 0

3047.259 - 3068.707 Jack Recider

So the mission was to use AI to somehow trick and scam the host of 60 Minutes while on the show. But the problem is the host needs to consent to being targeted, which if she knows she's going to be scammed while on her show, it'll really put her guard up, right? So this was going to be tricky. How do you trick someone who's asking you to trick them?

0
💬 0

3069.047 - 3072.168 Rachel Tobac

She's got a lot of information about her online, so I do my OSINT.

0
💬 0

3072.847 - 3084.698 Jack Recider

Because the host of 60 Minutes has been on TV for years, Rachel realized there is a lot of audio of Sharon talking. And this might be useful. Maybe she can somehow use Sharon's voice to do something.

0
💬 0

3085.179 - 3109.399 Rachel Tobac

I determined through OSINT, open source intelligence, that the best way to do this hack was to trick her coworker while pretending to be Sharon. Because sometimes our coworkers have just as much info and access on us as we do about ourselves. So I needed to get consent from the coworker. And here's the massive challenge.

0
💬 0

3110.4 - 3131.274 Rachel Tobac

I needed to get her coworker's consent because she was a major part of the hack. This coworker is named Elizabeth. I contacted her. I was like, hey, this is what we're going to do. We're going to do this hack. You need to consent to essentially being part of the hack, but you don't know when, where, or how it's going to happen. You don't know who I'm going to pretend to be.

0
💬 0

3131.795 - 3147.37 Rachel Tobac

You're not going to know the method of the attack, whether it's going to be a phone call, email, text, contacting your service providers, pretending to be you. Elizabeth is awesome. She's like, that's fine. That's like completely fine. I'm really excited. And I'm like, okay, let's do this.

0
💬 0

3148.413 - 3174.459 Rachel Tobac

So I decided that I wanted to do a phone call because I wanted to clone Sharon's voice and spoof Sharon's phone number to Elizabeth and trick her during a phone call to reveal some sort of personal information to me. Now, Sharon is a famous reporter, so her voice is everywhere. I grabbed about five minutes worth of samples of her voice just from YouTube videos from 60 Minutes.

0
💬 0

3174.979 - 3191.345 Rachel Tobac

I put her voice into my voice cloning tool. I start tweaking the tool. There's voice clone settings for things like clarity, voice stability, style exaggeration. And I finally get the settings tweaked to a point where I feel like it's going to be credible at all during a phone call, but it's not 100% perfect.

0
💬 0

3193.14 - 3212.215 Rachel Tobac

And I do my open source intelligence to find the right phone numbers to spoof and the right phone numbers to call. Like I said, data brokerage sites have personal contact details for almost everyone. And I need to find the right details to use during the hack, like upcoming travel, the right information to try and siphon out for the demo.

0
💬 0

3212.576 - 3233.362 Rachel Tobac

You can find most of this stuff through social media when people talk about their lives. The only issue. Now, I'm going to have to somehow get Elizabeth to participate in this hack without her realizing it's the hack itself going down. How am I going to do that? She's already consented to this and she knows it's coming.

0
💬 0

3234.437 - 3246.54 Rachel Tobac

So I figure the only way that this is going to work is if it feels natural within the filming day. Otherwise, how is the film team going to catch the hack live so that anyone in the audience can watch it?

0
💬 0

3247.4 - 3253.462 Jack Recider

So they've got the cameras on you. They've got you in the studio. They've got Sharon there.

0
💬 0

3254.702 - 3275.563 Rachel Tobac

Not yet. Let me tell you these details. So I get my hair and makeup done for 60 minutes, right? I'm doing my vocal warmups. I'm like, la, la, la, la, la, la, la. I'm getting ready for recording. Sharon's still in her room prepping for the day. The light and the sound crew are getting the gear ready for the shoot. Elizabeth shows up. She's getting ready.

0
💬 0

3276.384 - 3294.085 Rachel Tobac

I pull aside the head of the sound and lighting crew, and I let them know that I think the only way they're going to be able to catch this hack on camera live is this. I'm going to go out into the hallway with my computer and phone. You, the camera crew, cannot follow me because it'll be way too obvious to Elizabeth if you follow me.

0
💬 0

3294.725 - 3313.23 Rachel Tobac

And it really shouldn't matter anyway because it will be me on the other end of the phone call. So you should catch the interaction from her end anyway. So you, the crew, must ask Elizabeth to stand in for Sharon so you can get lighting, sound, everything prepped so that when Sharon finally comes down, she can just slide into the shot and we can get started.

0
💬 0

3313.911 - 3318.876 Rachel Tobac

That way, when I start the hack, you'll be able to actually see and hear Elizabeth and be able to catch the attack in motion.

0
💬 0

3318.896 - 3320.878 Jack Recider

Wow.

0
💬 0

3321.078 - 3346.243 Rachel Tobac

The crew is like... What did we sign up for? This is ridiculous. I am so nauseated by this plan. Like I'm so freaked out by this because if this doesn't work and Elizabeth is like, sure, crew, I'll stand in for Sharon and immediately realizes what is happening. Then this entire shoot, all 15 members of the 60 Minutes team, the lighting crew, sound, hair, makeup, everybody's here for nothing.

0
💬 0

3346.364 - 3365.675 Rachel Tobac

And I will just have to basically demonstrate what I would have done. That's not going to be fun for anyone. And now, mind you, it's like 7 a.m., so this feels like the crack of dawn for all of us. People haven't even had a cup of coffee yet. So people are like, okay, Rachel, sure, we'll do that. So I walk over to my hacker laptop.

0
💬 0

3366.196 - 3382.106 Rachel Tobac

I announce to the room that I need to go help my team with something back home. So before we get started for the day, everyone get your coffee, whatever, set up. They say, no worries. I step out into the hallway. I've got my laptop and phone. I can't hear anything that's happening in the ballroom now where we're filming.

0
💬 0

3382.126 - 3402.123 Rachel Tobac

I just have to hope that the sound and lighting crew have successfully gotten Elizabeth into the, quote, stand in position with the sound and lighting on, because otherwise they're not going to catch this. And like, I'm not going to fake it for them later. It needs to be real. So I'm just like praying this works. So I open up my voice cloning tool in the hallway.

0
💬 0

3403.124 - 3425.323 Rachel Tobac

I type in my opening line into the voice cloning tool. And to be clear, this voice cloning tool, I cloned Sharon's voice. I can then type in any words and it will spit out those words spoken in Sharon's voice. So I type in my opening line. My opening line is, Elizabeth, sorry, need my passport number because Ukraine trip is on. Can you read that out to me?

0
💬 0

3426.471 - 3440.899 Rachel Tobac

It has to be short and sweet, direct and to the point, without requiring a lot of follow-up because the issue with these tools is there's a delay in me typing it into the voice cloning tool and when it spits out the words in Sharon's voice.

0
💬 0

3441.4 - 3465.247 Rachel Tobac

I'm also holding my phone up to the computer, so there's like kind of a strange audio vibe going on with this phone call, and I just want to minimize it and make it happen as fast as possible. So I open up my spoofing tool on my phone. I type in Sharon's number to spoof. I type in Elizabeth's phone number to call. I hit go. It is 100% silent. I hear Elizabeth's phone.

0
💬 0

3466.168 - 3485.219 Rachel Tobac

It's audibly ringing inside of the ballroom. And I'm just hoping she like goes over and picks it up, right? My stomach's in knots. I am sweating profusely. And then I hear her go, hello? Sharon. Like I hear it through my phone and I can also hear it in the ballroom. And I'm like, oh my God, she can like hear out here. So I hit my voice cloning play button.

0
💬 0

3486.22 - 3488.841 Rachel Tobac

It starts playing Sharon's voice asking for the passport number.

0
💬 0

3489.281 - 3493.422 Elizabeth

Elizabeth, sorry, need my passport number because the Ukraine trip is on. Can you read that out to me?

0
💬 0

3494.663 - 3518.896 Rachel Tobac

And then silence. Silence. For what feels like hours, I am sick to my stomach. My hands are shaking. This forever silence that I was experiencing was Elizabeth holding her phone in her hand, looking at the caller ID during the call to ensure it really does say Sharon because the voice sounds weird. I mean, I'm voice cloning plus spoofing.

0
💬 0

3518.976 - 3526.449 Rachel Tobac

So it looks like it's calling from Sharon, but it sounds kind of far away because I'm holding my phone up to the computer. Elizabeth finally responds.

0
💬 0

3526.91 - 3530.478 Elizabeth

Oh, yes, yes, yes, I do have it. Okay, ready?

0
💬 0

3531.36 - 3551.928 Rachel Tobac

And then she reads out the passport number I just asked for. I'm like, let's just get off this call as soon as possible. So I say, thank you. She starts asking me questions. You know, when am I going to be down for the shoot? Do I need anything else? And I have to deal with this delay back and forth typing in my replies. So I'm just thrilled that by this point, I like siphoned out information.

0
💬 0

3552.369 - 3566.343 Rachel Tobac

And I just wanted to get off this call as fast as I possibly could. So I said, I'm just coming down. And I end the call. I walk into the ballroom. Elizabeth is sitting under the lights with the mic pinned on her. And I'm like, oh my God, it worked.

0
💬 0

3567.483 - 3582.348 Rachel Tobac

All I have to do now is do the interview with Sharon and explain the mechanics of the hack to her live and make sure that Elizabeth knows that anyone would fall for this style of hack because most people don't realize it's possible yet. I wanted to make sure she didn't feel like horrible about it.

0
💬 0

3583.072 - 3608.519 Jack Recider

And yeah, she did the interview and explained what just happened, how she tricked Elizabeth into giving Sharon's passport number. But after listening to this story... I got really curious about this voice cloning tool and wanted to try it myself. So to clone someone's voice, you give it a bunch of audio of them talking, and using some advanced AI, it will get to know that voice.

0
💬 0

3609.119 - 3629.895 Jack Recider

And whatever you type, it'll say it in their voice. I spent a few hours playing around in this tool, and I cloned my voice. I think it's really interesting. Okay, I want to show you. I'm going to play two clips for you. I want you to listen and try to figure out which one is AI-generated. Ready? Here's clip one. Hey, this is Jack Recider.

0
💬 0

3630.155 - 3654.197 Jack Recider

This morning I had a peanut butter and chocolate smoothie for breakfast. Okay, here's clip two. Hey, this is Jack Recider. This morning I had a peanut butter and chocolate smoothie for breakfast. Okay, punch in your votes. Ready for me to tell you? Both clips were AI-generated. In fact, what you're hearing right now is AI-generated too. I switched to having AI talk for me a few minutes back.

0
💬 0

3654.637 - 3678.675 Jack Recider

I just type whatever I want, and it'll narrate it for me. It's really wild. It even adds in breaths like this. Listen. And sometimes it'll even add plosives, like how the P sounds in nope. It's crazy how good this sounds. Huh. Okay, okay. I'll switch back to my normal voice now. There is... I'm using my real voice now, okay? The future is going to be weird, isn't it?

0
💬 0

3679.115 - 3697.923 Jack Recider

Okay, so I just saw this article the other day on CNN's website. And it said there was this guy working for a company in Hong Kong who controlled the finances for that company. And he got invited to a video call with the CEO and a few other colleagues that he recognized. And he saw them on the screen. He heard their voices. And he was positive it was the CEO and his colleagues.

0
💬 0

3698.664 - 3720.498 Jack Recider

And they were telling him there's this new deal that just finished up. And they wanted him to send $25 million to another company. So he did. But the problem was the video and the voices were all AI clones. Scammers tricked him into thinking he was on a video call with the CEO. And our future is almost surely not going to be what we think it's going to be.

0
💬 0

3721.139 - 3725.943 Jack Recider

I have a feeling we're going to have a hard time knowing what's reality and what's fiction.

0
💬 0

3726.844 - 3749.916 Daniel Miessler

Yeah, it's a good point. Hey, Jack, can I jump in here? Yeah, who's this? This is Daniel Meisler. Oh, hey, Daniel. Yeah, what do you have to say about this? Yeah, so what I find fascinating about this whole story is that there's a very early concept in security about how do I know it's you, right? And we normally don't have to worry about this with video because seeing has always been believing.

0
💬 0

3750.836 - 3776.78 Daniel Miessler

And the same with hearing for audio. But now with deepfakes for both video and audio, we need a whole nother layer. So what I actually expect to see here is products coming out that are basically like, how do I establish like early trust? Like as soon as you join a company, you'll probably establish like keys across like all of Slack or across like all of Microsoft Teams or something.

0
💬 0

3777.3 - 3779.162 Daniel Miessler

And that's like your predetermined channel.

0
💬 0

3779.778 - 3799.791 Jack Recider

Hmm, I think this is a good idea. If you can cryptographically sign something, then that'll prove the message or video came from you. So I imagine this could cut down on people falling for fakes. If it's not actually signed by the person who sent it, don't trust it. Initially getting your key would be interesting though. You still have to prove who you are at the beginning, right?

0
💬 0

3800.372 - 3819.289 Jack Recider

And one way to do that is to verify who you are in the meat space, the real world. When you're face-to-face and in person, it's still a valid verification technique. that you are you. But with everyone having their own cryptographic keys to prove someone is real, the threat then moves to securing the key.

0
💬 0

3819.85 - 3827.038 Jack Recider

If someone else grabbed a key, they could make it look like you sent something when really you didn't. They just signed it using your key.

0
💬 0

3827.89 - 3844.265 Daniel Miessler

Yeah, yeah, absolutely. We're going to need something like that for all remote calls, essentially, because it's like, first of all, the AI can copy both of our voices because we have our voice out there and that's easy to copy. But very soon, like, I won't know, honestly, if this is you right now on this call. Yeah.

0
💬 0

3845.155 - 3853.661 Jack Recider

I just imagine like making a whole CAPTCHA network for everyone I know, right? So my dad calls me on the phone and it says, before you can connect to this party, please solve this CAPTCHA.

0
💬 0

3854.102 - 3861.227 Daniel Miessler

Exactly. Exactly. There's going to be some sort of challenge or like predetermined like key exchange. Yeah. Oh, my gosh.

0
💬 0

3861.687 - 3890.42 Jack Recider

I personally am excited about our future. We are smarter than ever and more advanced than ever. And it feels like the human race is going through a Cambrian explosion of sorts with all new technologies and advancements popping off almost daily. We're living in the exponential era. Time will move faster from here on out, and we get to witness it. We have tickets to watch the birth of Human 2.0.

0
💬 0

3892.363 - 3920.374 Jack Recider

How special is that? Whatever comes next will surely be exciting. A big thank you to Rachel Toback for coming on the show and sharing these stories with us. She wrote a free ebook on social engineering, and you can find a link to it in the show notes. Besides doing social engineering for companies, she also does security awareness training.

0
💬 0

3920.734 - 3941.135 Jack Recider

And in fact, she started a whole video production company where she creates fun and entertaining training videos. You can learn more about what she's doing by visiting socialproofsecurity.com. Also, thanks to Dan Meisler for giving us some insights into AI. This episode was created by me, the backseat rider, Jack Recider. Our editor is the gourmet sorbet, Tristan Ledger.

0
💬 0

3941.215 - 3952.786 Jack Recider

Mixing done by Proximity Sound, and our intro music is by the mysterious Brickmaster Cylinder. How does a computer get drunk? It takes screenshots. This is Darknet Diaries.

0
💬 0
Comments

There are no comments yet.

Please log in to write the first comment.