zlacker

He used the CEO’s voice to access AN account, I don’t think it was the CEO’s specifically. But just an account, verified by the CEO’s voice, to his.

>>gabere+(OP)
I doubt the bank’s authentication system is built to allow the CEO’s voice to authenticate a transfer out of any account…

>>jhugo+pC
At Schwab my voice is my password. Is how Schwab authenticates me by voice. That demonstrates to me schwab knows they need a voice passphrase that wouldn't be used in passing or without raising suspicion.

>>detour+PR
This comment is very hard to parse, but after reading it, I feel a general sense of relief that I'll never use Schwab.

>>jhugo+pC
This was a long time ago. It was a small bank. I also heard it through the grape vine and not from him himself. I could definitely be wrong but this is what was told to me by someone who was there.

>>noSync+wU
After over 30 years of perfect service. Schwab has done something so egregious that I’m leaving them. They used to be the best bank I ever used.

Finally I’m know that passphrase is tied to my phone number. Its not perfect but it is as good as any other consumer banks system.

I don’t recommend Schwab but my accounts are as secure as any.

>>jhugo+pC
I doubt it as well. Back in the day, I worked for an elected official who insisted on being a Domain Admin in our Active Directory tree. My co-worker and I used to joke, "think he wants to be a Schema Admin too?"

>>noSync+wU
At first I thought this was a reference to the movie Sneakers (https://www.youtube.com/watch?v=-zVgWpVXb64), but after searching it seems Wells Fargo also does this, https://www.wellsfargo.com/privacy-security/voice-verificati....

>>larntz+861
I just thought it was an interesting contrast to the bank executive story. Which demonstrated how the passphrase may have evolved and that moving money is done by voice authentication today.

Using just ones voice is bad. Using a phrase is better. Using a phrase that is unique and describes its function may set-off alarm bells for some.

I never connected the phrase with Sneakers.

>>jhugo+pC
When you do pen testing you're given a limited list of valid targets.

I imagine that the mission parameters were that he take a check and remove money from the account.

It would also make sense that this is the CEO's account, or one he also controls, because he's in on the test and can give informed consent. Also, probably the CEO doesn't have any special access so breaking into his identity wouldn't impact the bank the way breaking into the IT manager's account might.

If this was a fake account (one with no real user) then they wouldn't have discovered this flaw because Mitnick couldn't have called the user. Having a real person be exploitable is essential to proper discovery of the full scope of the problems.

>>LawTal+4I2
This is probably closer to the truth. That it was a test all along.