Rachel Tobac
speaker
124 appearances
1 recordings
1 series
first heard Apr 2024
last heard Apr 2024
Rachel Tobac’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
Didn't realize it was possible for people like me. And now I do this for a living.
So a bank hired me to penetration test them. Effectively, they hired me to hack them. And they told me that I could hack via phone call, email, or chat. And my job was to take over multiple accounts and steal access, effectively steal the money out of the accounts.
Yes. And when we do a penetration test, it's very particular. I don't want to steal money from everyday people. That would be horrible and really scary for bank customers to just randomly have money stolen because of a pen test. So what we do is we create fake bank accounts. We work with the team on the back end so that the support organization, for all intents and purposes, sees a real customer.
but we've created fake bank accounts for me to steal so I don't actually harm real people. But the support team doesn't know they're fake.
That's right. So I started with the chat feature. And I posed as a customer to see if I could take over a customer account with just chatting. So I told the bank support people my sob story. I lost access to my phone, my email, my laptop. I got lost and I had a night out and I'm traveling abroad. I mean, like the whole story, right?
And I really need access to my bank account because I'm stuck and I don't have money. And the first thing that I usually try when I'm trying to do an account takeover is I try to see if I can get them to change the email address or the phone number on the account. Because if I can do that, then I can change effectively the admin on the account.
Just by changing the email address, I can then reset the password or reset to a phone number that I control. There's SIM swapping and all of that that could happen after that. But, you know, that's basically how it works. And they're like, oh, well, we can't do that because we need to only send the password reset to the email address already on your account.
That's exactly right. So good job, bank. Horrible for me as the pen tester. A lot of times I have to play both sides of this game. I have to train the company and update their protocols to prevent people like me from getting in. But when I'm first attacking them, it's so frustrating. So I try chatting with multiple other support people. I'm trying again and again.
They will not make any exceptions for me. It doesn't matter my pretext. That's who I'm pretending to be. It doesn't matter how I contact them, what I say, my story, nothing. So I decide to switch to phone call-based attacking because I tend to be much more successful. So I switched to phone calls. It leaves less of a paper trail. People tend to get less suspicious because I can build rapport.
They can hear my voice. They can hear how trustworthy I sound. And also when I'm calling, I can spoof phone numbers. And a lot of times that helps me gain access.
Yeah, it's kind of wild. In the U.S., right now it's still possible because all of the telcos have to make the same decisions at the same time. And unless all of the companies get together and make the same choices, it's going to be really hard to implement the right solution. So at least in the U.S., spoofing is still really possible for me.
I spoof my phone number. I make it look like Kelly on the account. And by the way, on data brokerage sites, when we're doing OSINT, open source intelligence, typically we can find most people's phone numbers within a minute or two. So when we're searching, we can just know, okay, this is Kelly. This is Kelly's phone number. I'm going to go ahead and spoof that. I set that up.
It usually costs me a dollar or so on the tools that are available on the app store. These are not like heavily regulated. You can just find them on the app store. And I go ahead and I place that call.
You're going to make me act.
Okay. Okay. Give me one second. I got to get into character. I'm going to change my clothes so I can get into character. Here we go. Okay. Here we go. Ring, ring, ring. Oh, wait. We both said ring. Okay.
Hi, I am so sorry. My name is Kelly Smith. So I'm traveling right now and I just lost my laptop. My phone's not working. I cannot get access to any of my funds. I'm super stressed out. Can you please, please help me?
No. So this bank knew that KBA, knowledge-based authentication, things like what's your address? What's the last four digits of your phone number? This bank knows that that information is very easily found online. So they don't use KBA, knowledge-based authentication, to verify your identity. They usually use MFA, multi-factor authentication. Now, this is great. This is exactly what I recommend.
You know, send a code to the email address on file and make them read it out to you rather than going through this process of verifying identity with information that can be found by an attacker in five minutes online. So that's good. But as an attacker, that's going to be a challenge because I don't have access to that email address.
And when I'm spoofing a phone number, I actually can't receive text messages. And if they call back, I'm not going to be the one that answers that phone call. I'm just spoofing. It looks like I'm calling, but I don't actually have access. Now, of course, I could SIM swap and many criminals will do that. But for the purposes of this pen test, that's not what I'm testing. So they say, okay,
We have an edge case here. Let me see if I can talk to my manager and have you send in a picture of your driver's license, your social security card, and a utility bill. And instantly I'm like, okay, bingo. We're in. The other half of social security is my husband, Evan. He does all the technical stuff. I do all the human hacking stuff.
Showing 21–40 of 124 · page 2 of 7
← Previous
Next →