racheltobac :verified: :donor: / is on Nostr

Hacker, CEO of SocialProof Security: security awareness/social engineering training, vids, talks, tests, 3X @DEFCON🥈, Chair of the WISP board, Tech Advisory Council for @Cisagov
Donor for infosec.exchange: :donor:

Last Notes

2024-10-16 22:37:38

I just live hacked Arlene Dickinson
(Dragons' Den star - Canada's Shark Tank) by using her breached passwords, social media posts, an AI voice clone, & *just 1 picture* for a deepfake live video call. Thank you Elevate Conference and Mastercard for asking me to demo these attacks live!
https://www.youtube.com/watch?v=ysu7vEkZdN0
What are the takeaways from this Live Hack video with Arlene?
1. Stop reusing passwords - when you reuse your password and it shows up in a data breach, I can then use that password against you everywhere it's reused online and simply log in as you stealing money, access, data, etc.
2. Turn on multi-factor authentication (MFA) - turning on this second step when you log in makes it more obnoxious for me to takeover your accounts. I then have to try and steal your MFA codes from you (or if you use a FIDO MFA solution like a Yubikey etc, I'm likely just plain out of luck and have to move on to another target)!
3. Recognize that AI has made attacks more believable and scalable - will every or even most hacks involve AI? Nope! Most attacks are simple and leverage your breached passwords to log in as you or they attack via phishing over email, text, call, etc.
That being said, it's important to realize that some attackers will attempt to leverage AI, especially if you have an high threat model. Arlene is a star with millions of followers around the world, because of this she has to be extra politely paranoid about those that reach out with sensitive requests!
If someone with a high threat model (in the public eye, job is to wire money, lots of followers on social media, activist/being targeted, etc) receives a call and they're requesting sensitive info or a wire transfer, recognize that the attacker could believably use a voice clone in that call and could even build a believable deepfake for a live video call.
This is not how all attacks work but it's especially important for those with elevated threat models to recognize that AI can be leveraged in attacks to up the believability with voice clones, deepfake video, etc.
What do I mean "be politely paranoid" in this video?
I recommend verifying that people are who they say they are before taking sensitive actions.
- If you have a high threat model and someone calls you and asks for a wire transfer, use another method of communication to confirm it's them before taking action. Chat them, signal message, email, call them back to thwart spoofing using the number you have on file. This catches me 9 times out of 10 when I'm hacking! This is relevant for your work, when you're buying a house, pretty much anytime you need to send money!
- If you receive an email from a board member asking for a copy of a sensitive document, verify that board member is who they say they are with another method of communication before sending over a document with sensitive work details listed on it.
Stay politely paranoid, folks!

2024-08-14 04:01:14

- reply

@npub178r…qekt ugh im so sorry, thru your elastomeric mask and everything, thats so frustrating. Thinking of you right now and glad you’re on paxlovid! I recommend cinnamon altoids to remove the metallic taste.

2024-05-29 17:22:32

Who wants to increase representation at DEF CON and Black Hat this year with WISP (Women in Security and Privacy)!
Each $1,000 donation sends 1 scholar to Hacker Summer Camp w/ a free pass, travel stipend, & team to support on the ground!
Match my $500 donation (we're currently at 1.5 scholarships funded as of right now) to help us send at least 20 scholars to Hacker Summer Camp this year: https://wisporg.app.neoncrm.com/forms/hackersummercamp24

2024-02-09 22:09:58

Working on a live hack right now.
This is a PSA: don't tie your phone number to your password manager.
I don't want to be able to SIM Swap you and gain access to your entire vault of passwords.

2024-02-08 20:09:27

Whoa the FCC has recognized the risk of AI voice cloning in robocalls & scam calls! Video demo below.
- New FCC fines, more than $23,000 PER CALL
- Now gives call receiver right to take legal action and potentially recover up to $1,500 in damages per call
https://apnews.com/article/fcc-elections-artificial-intelligence-robocalls-regulations-a8292b1371b3764916461f60660b93e6
https://infosec.exchange/@racheltobac/110415331029231207

2023-10-11 15:27:05

- reply

@npub1lgy…aefg @npub1rv5…z2l6 @npub1l9m…5t7u that’s dope, totally up to you if you would like to!!

2023-10-11 14:14:00

Finally wrote a book -- well, an eBook!
Called: The hacker's guide to securing your organization
All my security recommendations based on my hacking expertise (how you can stop me in the act).
Partnered with
@npub1rv5…z2l6 to write this free resource for you!
https://bitwarden.com/how-to-stop-cyber-criminals/?utm_campaign=%5BGM%5D%20Rachel%20Tobac%20eBook&utm_source=all-tobac
It was so fun working with
@npub1rv5…z2l6 my team, and my designer to build this book for you! I get asked often “Have you written a book? I want to get it for my team!” and now I can finally say yes and give folks a *free* book. How fun!
I cover a lot in this eBook!
- The principles of persuasion
- Manipulating urgency: exploiting time pressure to hack
- How to protect your organization and yourself including: how to create a strong first line of defense, creating security 1st culture, using unique passwords and password managers, the right MFA for your threat model, and how to Be Politely Paranoid
- How hacking works: OSINT, password dumps, phishing, social engineering (to name only a few points of entry)
- Threat modeling 101: VIPs and beyond
- How AI has changed how we hack and how to protect against new methods
- The passkey revolution and more!
Also enjoyed covering emerging hacking methods — like the use of AI in hacks like this: https://x.com/racheltobac/status/1660432071003881474?s=46&t=NyA6Hhhifs99eqUAKlHl2Q
What may surprise you is that attacks using AI can still be thwarted using similar defense methods: long, random, unique passwords stored safely, the right MFA for your threat model, and being politely paranoid (using 2 methods of communication to confirm people are who they say they are)!
Also exciting to cover passkeys! We’re right at the start of the passwordless revolution and it’s so cool to see the world start to move toward passkeys — funny enough, I’m currently on the front page of @npub1l9m…5t7u right now because Google just turned on default passkeys for Gmail and folks want to learn more!
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/216/802/613/630/520/original/089bbe09a20635b6.jpeg

2023-10-11 14:14:00

2023-10-10 18:49:32

Let's discuss the 23andMe data leak -- what happened & what can we do about it?
*What happened in this data leak?*
Cyber criminals were able to find passwords that were involved in other breaches online and use a method called “credential stuffing” to attempt those previously breached and reused passwords on 23andMe to login as other users.
Unfortunately, most folks reuse their passwords across many sites and apps and when those passwords are stolen they can be used to gain access to your account anywhere else the password is used online.
The attackers took the passwords from other breaches, stuffed them into 23andMe and then used an opt-in feature called DNA Relatives to enumerate genetic data of similar groups.
23andMe doesn’t yet appear to be hacked itself, rather the formerly breached passwords reused by the 23andMe users allowed the attacker to gain access to user accounts by logging in as the user and stealing sensitive genetic data.
*What can organizations proactively do to prevent similar intrusions?*
Companies have options to help their users avoid account takeover.
First, haveibeenpwned.com allows for integrations with sites to warn users if their password is reused and findable online in a previous breach. This helps prevent users from reusing their passwords on a website. I highly recommend that companies use the haveibeenpwned integration to prevent password reuse on their own site — because remember, everyday folks don’t understand the difference between a credential stuffing attack that leads to account takeover and data leaks vs the site itself being hacked/breached with malware, etc. It’s in an org’s best interest to prevent password reuse on their site to avoid the negative impacts of data leaks no matter what (because a data leak will impact a brand regardless of the attack method in use).
Second, using a website without MFA on should feel like driving a car without your seatbelt on — obvious and with a clear next action. If your users don’t have MFA on, make it extremely clear and easy to turn MFA on. I thank Jen Easterly & Bob Lord for the seatbelt analogy.
*What can individuals do to limit their risk of account takeover on sites?*
1. Avoid password reuse. Use long, random, & unique passwords on each site, generated and stored by/in a password manager. Or use passkeys anywhere they’re offered to avoid passwords altogether.
2. Use the right MFA for your threat model/digital literacy on every site & tool you use. For many people, that’s at least app-based MFA. Even SMS 2FA is better than nothing for many credential stuffing focused attacks. FIDO solutions are a great match for many people — I personally enjoy using Yubico YubiKeys.
3. Sign up for haveibeenpwned.com to get alerts when your usernames, email addresses, or passwords turn up in a breach, then change those passwords immediately and ensure MFA is on those accounts.
Thanks @npub1f6g…mr6z @npub1lt9…f6eq for discussing this with me today: https://techcrunch.com/2023/10/10/23andme-resets-user-passwords-after-genetic-data-posted-online/

2023-08-27 18:48:06

In case you missed me live hacking using an AI voice cloning tool on 60 Minutes last time, it's reairing tonight at 7 PM Eastern! https://twitter.com/60Minutes/status/1660428419438354435?s=20

2023-05-23 01:10:45

Here’s how I used AI to clone a 60 Minutes correspondent’s voice to trick a colleague into handing over Sharyn's passport number. I cloned Sharyn’s voice then manipulated the caller ID to show Sharyn’s name on the caller ID with a spoofing tool.
The hack took 5 minutes total for me to steal the sensitive information.
So, how do we protect ourselves, our loved ones, and our organizations?
1. Make sure the people around you know that caller ID is easily faked (spoofed) and that voices can also be easily impersonated.
2. If they receive a dire call from “you”, verify it’s really you with another method of communication (text, DM, FT, call, etc) before taking an action (like sending money). Kind of like human MFA.
Some suggest setting up a secret “verification word” with their folks ones so that if someone impersonates & demands money/access etc you can ask for the verification word to see if it’s a real crisis. This won’t work for all people but could work for some. If it’s a match, use it.
In general, I recommend keeping advice simple: if premise of call is dire use a 2nd method of communication to confirm a person is in trouble before taking action (like wiring money or sensitive data). Rapid text, email, DM, have others message repeatedly — before wiring money.
Bottom line is:
Scammers use urgency & fear to convince victims to take actions (like sending money, data, etc).
If premise of a call, text, email, or DM is too dire (or too good to be true), that’s a likely scam.
Use a 2nd method of communication to check it’s real before taking action!
https://www.cbsnews.com/news/how-digital-theft-targets-people-from-millennials-to-seniors-60-minutes-2023-05-21/
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/415/329/179/205/865/original/f3202e262068a2c8.mp4

2023-05-20 00:57:35

My latest live hack demo using AI to clone a voice in a phone attack is airing on 60 Minutes this Sunday. Hope this message gets to the folks most commonly scammed using this method and stops at least one future attack.
Here’s the preview: https://youtu.be/lDCXHG2l3Es