Evan Tobac retweeted
I used deepfakes & injection attacks to hack an identity verification tool used for remote workforce, helpdesk, & onboarding…until they updated the tool to catch me.
Thank you @IncodeIdentity for having me hack you 110+ times to find the latest vulns and fix them together 🤖🤘
Thank you @IncodeIdentity for having me hack you 110+ times to find the latest vulns and fix them together 🤖🤘
4
27
125
13,123
Evan Tobac retweeted
Be me.
Get invited by @RachelTobac & @evantobac to play craps.
Side note: when the Tobacs invite you to gamble, you go. They are 🔥.
Arrive at Palms casino. Find $5 craps table. Put $100 bill down.
Dealer(?) picks it up and gives it a weird look. Hands it to another dealer. She immediately says "Oh that's fake..."
*gulp*
Wut.
Pit boss called over. Security called over. They take a look at the rest of my money, it's all good.
Take the $100 bill to the cage, tell me to wait. Come back 10 min later. "It's counterfeit, we can't give it back."
Sadge. 😭
They still let me play tho. Still no idea where / how I got it. 🤨
Get invited by @RachelTobac & @evantobac to play craps.
Side note: when the Tobacs invite you to gamble, you go. They are 🔥.
Arrive at Palms casino. Find $5 craps table. Put $100 bill down.
Dealer(?) picks it up and gives it a weird look. Hands it to another dealer. She immediately says "Oh that's fake..."
*gulp*
Wut.
Pit boss called over. Security called over. They take a look at the rest of my money, it's all good.
Take the $100 bill to the cage, tell me to wait. Come back 10 min later. "It's counterfeit, we can't give it back."
Sadge. 😭
They still let me play tho. Still no idea where / how I got it. 🤨
@riskymanag3ment I got a fun story about why cash sucks if you want to hear it.
9
5
87
17,676
Evan Tobac retweeted
The @socialproofsec @defcon 33 Clue Hunt in ON!
This challenge is short, it’s just 1 clue.
Coin & sticker will both be of value.
Intersect to gain the clearest view.
Tell me, @evantobac, or Keymaster the secret word IRL or DM to win a Hacker Buff for you.
Find us at @sec_defcon.
This challenge is short, it’s just 1 clue.
Coin & sticker will both be of value.
Intersect to gain the clearest view.
Tell me, @evantobac, or Keymaster the secret word IRL or DM to win a Hacker Buff for you.
Find us at @sec_defcon.
9
15
79
19,202
Evan Tobac retweeted
I just live hacked @ArleneDickinson (Dragons' Den star - Canada's Shark Tank) by using her breached passwords, social media posts, an AI voice clone, & *just 1 picture* for a deepfake live video call.
Thank you @ElevateTechCA @Mastercard for asking me to demo these attacks live!
Thank you @ElevateTechCA @Mastercard for asking me to demo these attacks live!
14
102
353
74,431
Great writeup of reversing and troubleshooting a malfunctioning Beaglebone Black
Lots of tools and techniques used (UART, JTAG, Saleae, EMIF Tuning, tinySA, ARM Reversing, etc.)
Lots of tools and techniques used (UART, JTAG, Saleae, EMIF Tuning, tinySA, ARM Reversing, etc.)
Finally published my writeup of my reverse engineering the TI AM335x boot ROM. (At least, as far as it served to help me get the boards to boot.) This is the processor at the core of the Beaglebone Black board.
github.com/sjgallagher2/a…
0
0
1
275
For anyone who wanted a key but didn't get one. Now you can print your own!
I've uploaded the keymaster key for the @socialproofsec clue hunt, for the few that asked for it. Looks best with various exotic @ fun PLA filaments. I recommend @Proto_pasta and @Polymaker_3D.
printables.com/model/977932-s…
makerworld.com/en/models/5934…
0
1
6
351
Evan Tobac retweeted
Are you ready to play a game, @defcon? Our 1st Clue Hunt clue is ready for you. Winners get the challenge coin that screws into the custom badge completing a circuit and lighting it up. @evantobac and I can’t wait to meet the winners! The game starts now.
Our @socialproofsec @defcon Clue Hunt is starting tomorrow & it’s bigger than ever before!
Our 1st clue & Keymasters will be at @sec_defcon starting Friday (you get the 1st clue in line)
Teaser of prizes below — our challenge coin completes a circuit on our badge, lighting it up!
2
12
60
57,524
Evan Tobac retweeted
Our @defcon Clue Hunt is starting soon & it’s bigger than ever before!
1st clue & Keymasters at @sec_defcon starting Fri.
Teaser of prizes — challenge coin completes a circuit on our badge, lighting it up.
@RachelTobac @EvanTobac are so excited to see all the Clue Hunt winners!
1st clue & Keymasters at @sec_defcon starting Fri.
Teaser of prizes — challenge coin completes a circuit on our badge, lighting it up.
@RachelTobac @EvanTobac are so excited to see all the Clue Hunt winners!
0
10
25
6,145
Evan Tobac retweeted
*Sizzle Reel + Ransomware Song Debut!*
We just hit 500,000+ users for our @socialproofsec security awareness training video library 🤯🤘
To celebrate, here's a sizzle reel of our latest Spoken and Music Video content with the DEBUT of our Ransomware Song in the background -- somware Song out soon (and the lyrics are below).
We just hit 500,000+ users for our @socialproofsec security awareness training video library 🤯🤘
To celebrate, here's a sizzle reel of our latest Spoken and Music Video content with the DEBUT of our Ransomware Song in the background -- somware Song out soon (and the lyrics are below).
6
20
73
29,446
Evan Tobac retweeted
Here’s how I used AI to clone a 60 Minutes correspondent’s voice to trick a colleague into handing over her passport number. I cloned Sharyn’s voice then manipulated the caller ID to show Sharyn’s name with a spoofing tool.
The hack took 5 minutes total for me to steal the info.
The hack took 5 minutes total for me to steal the info.
60 Minutes hired an ethical hacker to show how easy it is to be scammed. She conned our unsuspecting colleague using artificial intelligence. cbsn.ws/3MOhmia
209
5,271
16,961
5,104,859
Evan Tobac retweeted
60 Minutes hired an ethical hacker to show how easy it is to be scammed. She conned our unsuspecting colleague using artificial intelligence. cbsn.ws/3MOhmia
144
1,561
4,900
6,362,573
Evan Tobac retweeted
*Our Music & Spoken Security Awareness Videos are now on (almost) every continent🤯 - Demo/Update*
Here are more sample snippets of our Video Library all in one place! Blows my mind these videos are now live at orgs on every continent (except Antarctica lol maybe one day).
Here are more sample snippets of our Video Library all in one place! Blows my mind these videos are now live at orgs on every continent (except Antarctica lol maybe one day).
5
23
99
71,206
For no particular reason, I have decided to create a Mastodon account.
Come say hi at infosec.exchange/@evantobac
Come say hi at infosec.exchange/@evantobac
0
0
2
Evan Tobac retweeted
Great overview of the dangers of password reuse due to data breaches by @RachelTobac, @evantobac
* Find email addresses via OSINT
* Password breach databases ➡️ plaintext passwords, hashes, and hints
* Customized wordlist + ruleset ➡️ hashcat
Be safe: Password manager, MFA
* Find email addresses via OSINT
* Password breach databases ➡️ plaintext passwords, hashes, and hints
* Customized wordlist + ruleset ➡️ hashcat
Be safe: Password manager, MFA
*New live hack demo video*
CNN’s @donie asked me to hack him again at @defcon — hacked him last time thru service provider call center attacks, but this time I intruded using the easiest method: reused passwords found in data breaches.
Here’s the breakdown.
1
7
32
Example Hashcat rules might be adding special characters to the beginning or end, incrementing numbers, or converting words to leetspeak (e.g. p4ssw0rd). Rules can basically automate most of the superficial changes many people make to their old passwords.
1
1
5