5 ms·

How would he have known the CEO's bank account number? Did the CEO write him a check at some point? Or maybe a bank's CEO traditionally gets account number 1…

walrus01 3y ago
Mitnick was exceptionally gifted at social engineering information out of various company departments over the phone.
gabereiser 3y ago
He used the CEO’s voice to access AN account, I don’t think it was the CEO’s specifically. But just an account, verified by the CEO’s voice, to his.
- jhugo 3y ago
  I doubt the bank’s authentication system is built to allow the CEO’s voice to authenticate a transfer out of any account…
  - detourdog 3y ago
    At Schwab my voice is my password. Is how Schwab authenticates me by voice. That demonstrates to me schwab knows they need a voice passphrase that wouldn't be used in passing or without raising suspicion.
    - noSyncCloud 3y ago
      This comment is very hard to parse, but after reading it, I feel a general sense of relief that I'll never use Schwab.
      - detourdog 3y ago
        After over 30 years of perfect service. Schwab has done something so egregious that I’m leaving them. They used to be the best bank I ever used. Finally I’m know that passphrase is tied to my phone number. Its not perfect but it is as good as any other consumer banks system. I don’t recommend Schwab but my accounts are as secure as any.
      - larntz 3y ago
        At first I thought this was a reference to the movie Sneakers (https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64), but after searching it seems Wells Fargo also does this, https://www.wellsfargo.com/privacy-security/voice-verification/ https://www.wellsfargo.com/privacy-security/voice-verificati....
        detourdog 3y ago
        I just thought it was an interesting contrast to the bank executive story. Which demonstrated how the passphrase may have evolved and that moving money is done by voice authentication today. Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some. I never connected the phrase with Sneakers.
  - gabereiser 3y ago
    This was a long time ago. It was a small bank. I also heard it through the grape vine and not from him himself. I could definitely be wrong but this is what was told to me by someone who was there.
  - nobleach 3y ago
    I doubt it as well. Back in the day, I worked for an elected official who insisted on being a Domain Admin in our Active Directory tree. My co-worker and I used to joke, "think he wants to be a Schema Admin too?"
  - LawTalkingGuy 3y ago
    When you do pen testing you're given a limited list of valid targets. I imagine that the mission parameters were that he take a check and remove money from the account. It would also make sense that this is the CEO's account, or one he also controls, because he's in on the test and can give informed consent. Also, probably the CEO doesn't have any special access so breaking into his identity wouldn't impact the bank the way breaking into the IT manager's account might. If this was a fake account (one with no real user) then they wouldn't have discovered this flaw because Mitnick couldn't have called the user. Having a real person be exploitable is essential to proper discovery of the full scope of the problems.
    - gabereiser 3y ago
      This is probably closer to the truth. That it was a test all along.
craftkiller 3y ago
Bank account numbers aren't secret, they're written on the bottom of every check you write. The story lacks the details of how he got his hands on it but its not unreasonable to assume he was able to access such unprotected information.
- randombits0 3y ago
  [flagged]
- deleted 3y ago
  [deleted]
- tomjakubowski 3y ago
  Yeah I know, I wondered in the comment whether CEO might have written Mitnick a check
77pt77 3y ago
> How would he have known the CEO's bank account number? Welcome to the american banking system.
- krab 3y ago
  The european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/ https://www.pre.cz/en/contacts/bank-details/ The account number should be just an ID, not authentication mechanism.
  - oli-g 3y ago
    > The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
    - sclarisse 3y ago
      You send the money to a literal mailbox instead. That’s how. (Using a check, the very infrastructure we’ve been talking about!!)
      - thfuran 3y ago
        But then you've given out your bank account number, so the secrecy is bunk.
        internetter 3y ago
        The US bank security system confuses me. To accept money, I need to give out my routing number and account number. Using those numbers, someone could theoretically withdraw money... Maybe... The whole system is built upon obscurity. Why do some stores need a pin on my debit card, and some do not? Why do online stores need my name and address, but IRL ones do not? How did that one online store charge me without my CVV? How can restaurants swipe my card now and charge me later? I only send and receive money with Google/Apple Pay & PayPal at this point. This flow is reasonable (every transaction is authorised in a trusted location (ie: PayPal). Further transactions are impossible without additional authorization). It boggles my mind that banks & CC companies haven't made some standard for this. Would save them so much money in fraud protection.

walrus01 3y ago

Mitnick was exceptionally gifted at social engineering information out of various company departments over the phone.

gabereiser 3y ago

He used the CEO’s voice to access AN account, I don’t think it was the CEO’s specifically. But just an account, verified by the CEO’s voice, to his.

jhugo 3y ago
I doubt the bank’s authentication system is built to allow the CEO’s voice to authenticate a transfer out of any account…
- detourdog 3y ago
  At Schwab my voice is my password. Is how Schwab authenticates me by voice. That demonstrates to me schwab knows they need a voice passphrase that wouldn't be used in passing or without raising suspicion.
  - noSyncCloud 3y ago
    This comment is very hard to parse, but after reading it, I feel a general sense of relief that I'll never use Schwab.
    - detourdog 3y ago
      After over 30 years of perfect service. Schwab has done something so egregious that I’m leaving them. They used to be the best bank I ever used. Finally I’m know that passphrase is tied to my phone number. Its not perfect but it is as good as any other consumer banks system. I don’t recommend Schwab but my accounts are as secure as any.
    - larntz 3y ago
      At first I thought this was a reference to the movie Sneakers (https://www.youtube.com/watch?v=-zVgWpVXb64 https://www.youtube.com/watch?v=-zVgWpVXb64), but after searching it seems Wells Fargo also does this, https://www.wellsfargo.com/privacy-security/voice-verification/ https://www.wellsfargo.com/privacy-security/voice-verificati....
      - detourdog 3y ago
        I just thought it was an interesting contrast to the bank executive story. Which demonstrated how the passphrase may have evolved and that moving money is done by voice authentication today. Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some. I never connected the phrase with Sneakers.
- gabereiser 3y ago
  This was a long time ago. It was a small bank. I also heard it through the grape vine and not from him himself. I could definitely be wrong but this is what was told to me by someone who was there.
- nobleach 3y ago
  I doubt it as well. Back in the day, I worked for an elected official who insisted on being a Domain Admin in our Active Directory tree. My co-worker and I used to joke, "think he wants to be a Schema Admin too?"
- LawTalkingGuy 3y ago
  When you do pen testing you're given a limited list of valid targets. I imagine that the mission parameters were that he take a check and remove money from the account. It would also make sense that this is the CEO's account, or one he also controls, because he's in on the test and can give informed consent. Also, probably the CEO doesn't have any special access so breaking into his identity wouldn't impact the bank the way breaking into the IT manager's account might. If this was a fake account (one with no real user) then they wouldn't have discovered this flaw because Mitnick couldn't have called the user. Having a real person be exploitable is essential to proper discovery of the full scope of the problems.
  - gabereiser 3y ago
    This is probably closer to the truth. That it was a test all along.

craftkiller 3y ago

Bank account numbers aren't secret, they're written on the bottom of every check you write. The story lacks the details of how he got his hands on it but its not unreasonable to assume he was able to access such unprotected information.

randombits0 3y ago
[flagged]
deleted 3y ago
[deleted]
tomjakubowski 3y ago
Yeah I know, I wondered in the comment whether CEO might have written Mitnick a check

77pt77 3y ago

> How would he have known the CEO's bank account number? Welcome to the american banking system.

krab 3y ago
The european bank account numbers are often posted publicly. If you are a VAT payer, you're supposed to check that the account you send money to is registered with the business in the public registry. Otherwise you may be held liable for the receiver's tax fraud. Many companies also show them at their webpage to make it easier to get paid. See e.g. https://www.pre.cz/en/contacts/bank-details/ https://www.pre.cz/en/contacts/bank-details/ The account number should be just an ID, not authentication mechanism.
- oli-g 3y ago
  > The account number should be just an ID, not authentication mechanism. Right? One of the many things (and I mean this without any hate whatsoever) I simply can't and will never understand about the US. A bank account number is your mailbox for receiving money. How does that country even operate when they build those mailboxes underground?
  - sclarisse 3y ago
    You send the money to a literal mailbox instead. That’s how. (Using a check, the very infrastructure we’ve been talking about!!)
    - thfuran 3y ago
      But then you've given out your bank account number, so the secrecy is bunk.
      - internetter 3y ago
        The US bank security system confuses me. To accept money, I need to give out my routing number and account number. Using those numbers, someone could theoretically withdraw money... Maybe... The whole system is built upon obscurity. Why do some stores need a pin on my debit card, and some do not? Why do online stores need my name and address, but IRL ones do not? How did that one online store charge me without my CVV? How can restaurants swipe my card now and charge me later? I only send and receive money with Google/Apple Pay & PayPal at this point. This flow is reasonable (every transaction is authorised in a trusted location (ie: PayPal). Further transactions are impossible without additional authorization). It boggles my mind that banks & CC companies haven't made some standard for this. Would save them so much money in fraud protection.