Rachel Tobac
speaker
124 appearances
1 recordings
1 series
first heard Apr 2024
last heard Apr 2024
Rachel Tobac’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
No. Okay. So my husband, Evan, he gets to work editing a driver's license, a social security card, and the utility bill to the exact information that they're expecting for this account, which again, we can find through a data brokerage site.
So we're hoping that this company does not know the actual driver's license number, the actual social security number, and they're just looking to ensure that the name and address that are on the account match those documents. I can find those pieces of information through OSINT. And a lot of times I've noticed that when they ask for these types of documents, they don't know the right info.
They're just hoping that it matches and they stop there.
Photoshop, yes. We spend all night on these driver's license, social security cards and utility bills of the accounts we're trying to hack. I email the bank at 8 a.m. the next day. I tell them my story. I tell them the edge case that we have set up with support. I send them the driver's license and social security card and utility bill. By 9 a.m., I have full admin access to the bank account.
I have changed it to be controlled by my attacker-controlled email address, and I can steal all of the money in the account. So once I finally get in, I have access to everything. I use the same method again and again. I get access to two more accounts throughout the day.
I end up spreading out the request so that we're not raising suspicion with the same attack method over and over again, back to back. And in the end, we took over each bank account that we were asked to to hack within two days.
I know that in a lot of these organizations, there are edge cases. So I'm helping companies say, okay, we did this pen test. We figured out what the edge case is. We figured out how we got access. How do we make sure we don't fall into this trap next time when the real criminals get here?
So I then help them with, okay, let's set up some edge cases back to back so that we have something like a callback. That would thwart spoofing. If you don't want to use that, you can use email verification, one-time passwords, you know, sending a code or just a word to the email on file and having them read that out. SMS verification.
Okay, they claim they're calling you from this phone number, but maybe they're just spoofing it. See if they can read out a text message, callbacks toward spoofing, service codes, PINs or verbal passwords. If it's some sort of internal support ticket, you can loop in a manager.
There's so many ways to do this right that a huge part of the pen test is not just hacking the company, but helping the company figure out what is a real practical way that we can solve these edge cases in the future to verify identity the right way and make it harder for you to get in that. the next time. Because I'll go in, I'll make it harder for me to get in as an attacker.
And then the next year, I'm like, oh my, this is so hard for me to get in until the point where I can't get in anymore. And that's when I'm like, okay, you've done the most that you can do.
And so they approached me about doing a pen test to figure out how this M&A info was getting leaked. where they could possibly improve their training, their messaging, their internal protocols to figure out why is this happening? Why are folks being incentivized to talk about this and what can we do about it?
Yeah, so insider threats happen. But what is usually most common is people just make a mistake. I kind of live in this world where I assume that people are making mistakes and I try and help them. So we came out with a few different attack methods that might work to uncover where this is happening.
Number one, I was going to attempt to pose as a journalist and reach out to various team members, asking them via social media DMs, email, text message, et cetera, about their experience in tech and see if I could siphon out M&A info and just see where it goes.
And number two, I was going to apply to their product manager role, go through the entire hiring process and see if I could extract M&A related info during the question portion of the hiring interview. I did not know what was gonna work and what wasn't, but I just wanted to try both.
So we call these ghosts, we call them SOC accounts. Sometimes they'll be real people, and so we'll fashion them pretending to be a real person. Sometimes they'll be fake people, and they'll just have this full life online.
With the fake journalist, I figured it was going to be a lot easier to pretend to be a real journalist and just not actually be them than create an entire persona of a fake journalist and populate real content. So I built a fake journalist pretext, email, background, and social media based on a real journalist who I'm not going to name, of course.
It's frightening. And I mean, the reality of the situation is that... Anybody can do a full background search in less than five minutes on most people in the U.S. And people don't realize that this information is out there about them. They have no idea that it's being sold. They just don't Google themselves.
Exactly. Or we can reach out over social media DM, you know, DM on LinkedIn or Twitter or Instagram. And I mean, that's the thing. Journalists really do reach out using all of those methods. So it's hard to know what's real and what's fake sometimes.
They let me know some minor details about excitement about potential M&A, but they're not going to confirm any juicy details. And I try to get people on the phone to talk with me, but I think there's just like this inherent distrust of this particular pretext. So I'm like, okay, I got to really go for the big guns here. I want to attack via the hiring process.
Showing 41–60 of 124 · page 3 of 7
← Previous
Next →