Evan Tobac

Security Researcher, Maker | Co-Founder, Head of Research & Tech at @SocialProofSec | He/him |

[Evan Tobac @evantobac]

We just hacked @donie (with his consent) and here's a breakdown of how we cracked his password. At a high level, we used a data breach site, the password cracking tool @hashcat, and a custom wordlist and ruleset. This is how it went down.

[Rachel Tobac @RachelTobac]

I used deepfakes & injection attacks to hack an identity verification tool used for remote workforce, helpdesk, & onboarding…until they updated the tool to catch me.
Thank you @IncodeIdentity for having me hack you 110+ times to find the latest vulns and fix them together 🤖🤘

[Tib3rius @0xTib3rius]

Be me.

Get invited by @RachelTobac & @evantobac to play craps.
Side note: when the Tobacs invite you to gamble, you go. They are 🔥.

Arrive at Palms casino. Find $5 craps table. Put $100 bill down.

Dealer(?) picks it up and gives it a weird look. Hands it to another dealer. She immediately says "Oh that's fake..."

*gulp*

Wut.

Pit boss called over. Security called over. They take a look at the rest of my money, it's all good.

Take the $100 bill to the cage, tell me to wait. Come back 10 min later. "It's counterfeit, we can't give it back."

Sadge. 😭

They still let me play tho. Still no idea where / how I got it. 🤨

[Evan Tobac @evantobac]

@mrjhnsn @RachelTobac @defcon Really enjoyed our conversation. Great meeting you in person!

[Rachel Tobac @RachelTobac]

One of my favorite people in the @defcon universe is @_MG_
Go buy his hacking tools, you’ll have a blast.

[Rachel Tobac @RachelTobac]

The @socialproofsec @defcon 33 Clue Hunt in ON!
This challenge is short, it’s just 1 clue.
Coin & sticker will both be of value.
Intersect to gain the clearest view.
Tell me, @evantobac, or Keymaster the secret word IRL or DM to win a Hacker Buff for you.
Find us at @sec_defcon.

[Rachel Tobac @RachelTobac]

I just live hacked @ArleneDickinson (Dragons' Den star - Canada's Shark Tank) by using her breached passwords, social media posts, an AI voice clone, & *just 1 picture* for a deepfake live video call.
Thank you @ElevateTechCA @Mastercard for asking me to demo these attacks live!

[Evan Tobac @evantobac]

Very cool, portable tool to get insight into USB cables from @alvaroprieto .

[Evan Tobac @evantobac]

@MakeItHackin @PCBWayOfficial We are living in the future! Thanks for the explainer video!

[Evan Tobac @evantobac]

Great writeup of reversing and troubleshooting a malfunctioning Beaglebone Black

Lots of tools and techniques used (UART, JTAG, Saleae, EMIF Tuning, tinySA, ARM Reversing, etc.)

[Sam Gallagher @analog_sam]

Finally published my writeup of my reverse engineering the TI AM335x boot ROM. (At least, as far as it served to help me get the boards to boot.) This is the processor at the core of the Beaglebone Black board.

https://t.co/LOOaPHAF5a

[Evan Tobac @evantobac]

@rekdt

[Evan Tobac @evantobac]

For anyone who wanted a key but didn't get one. Now you can print your own!

[Chris O'Rourke @RsThrive]

I've uploaded the keymaster key for the @socialproofsec clue hunt, for the few that asked for it. Looks best with various exotic @ fun PLA filaments. I recommend @Proto_pasta and @Polymaker_3D.

https://t.co/GaMXNO6Vk6

https://t.co/UKpYid4swj

[Evan Tobac @evantobac]

@alvaroprieto @digikey @MouserElec @JLCPCB Hey! This is really handy and compact! Super cool work

[Evan Tobac @evantobac]

@rekdt @defcon I see a fully assembled badge coin combo next to the key

[Evan Tobac @evantobac]

@thatstraw Not seeing enough love for Plan 9's Sam editor

https://t.co/T7lsfMyWSt

[Evan Tobac @evantobac]

@JoshHyde9 @d0nutptr Agree. This is how we learn binary, hexadecimal, and even decimal. It's how we write it out by hand.

[Evan Tobac @evantobac]

@_sn0ww @TheDukeZip @jaimefilson @SecureAerospace It was awesome hanging out in the merch booth with him!

Happy to talk badges any time. ☎️🖥️🤖

[Evan Tobac @evantobac]

@VillaRoot @_nextjenn @RachelTobac

[Evan Tobac @evantobac]

@_nextjenn @RachelTobac You are an incredible social engineer yourself, @_nextjenn! Glad we got to hang out in @sec_defcon this year!

[Evan Tobac @evantobac]

What's the fair market value on goon money these days?

[Evan Tobac @evantobac]

@UCantS33ME @RachelTobac @socialproofsec @defcon @sec_defcon Congrats again!