DEFCON 19: Steal Everything, Kill Everyone, Cause Total Financial Ruin! (w speaker)
Why Hacker News recommends it
It is a repeat pick in 'favorite tech talk' threads as a funny, eye-opening look at how easily physical security and people can be bypassed.
What it is
Jayson E. Street's DEF CON 19 talk shows photos from real security engagements where he was already inside client facilities, illustrating how social engineering and physical intrusion can cause huge losses. For each attack he also explains what defenses would have stopped him.
Recommended by 2 HN commenters across 2 different months, 2017 to 2021.
What Hacker News said
Strong rec nikisweeting · 2018-04 · on “Ask HN: What is your favourite tech talk?”
Jayson E. Street: Steal Everything, Kill Everyone, Cause Total Financial Ruin! [this video] Van Albert and Banks: Looping Surveillance Cameras through Live Editing [LINK] Ken Thompson: Reflections on Trusting Trust [LINK] And of course, Simple Made Easy, Wat, etc.
Strong rec crazypython · 2021-03 · on “Ask HN: What is your favorite tech talk?”
The absolute funniest tech talk I've seen "Steal Everything, Kill Everyone, Cause Total Financial Ruin!:" [this video]
Cites ATsch · 2017-10 · on “Socially Engineering Myself into High Security Facilities”
This something that the speaker in the famous "steal everything, kill everyone..." [1] defcon talk refers to as the "jedi wave" and makes similar remarks about. I think it's a great name. [1] [this video]
Cites brianpgordon · 2019-08 · on “Apple contractors listened to 1k Siri recordings per shift: former employee”
All of that sounds impressive, until you see red team pros talk about how the whole apparatus melts before the gentlest of social engineering- [this video] I'd also be concerned with leaking of mass amounts of records at once due to a security lapse on servers where it's a bit easier for grossly inadequate protections to lurk unnoticed- [LINK] I think I've read that Google doesn't even store the original recordings, but distorts them randomly to make them unrecognizable but still intelligible by their models. That seems like a pretty reasonable way to protect people, provided they're informed and there's no link back to the original account.
Cites will_pseudonym · 2020-03 · on “Vulnerability Reporting Is Dysfunctional”
They do do that, if I understand correctly. Penetration testing handles the physical security of the company. [DEFCON 19: Steal Everything, Kill Everyone, Cause Total Financial Ruin! ]( [this video] ) Social Engineering [Hacking the Wetware: Compromising Companies with Social Engineering]( [LINK] )