Professionals hack people, not systems
summary
Claims that ~80% of crypto losses come from ops failures, not smart contracts, and shows concrete attacks: PDF zero-days and malware delivered via fake Slack invites, Telegram proxying that swaps payment addresses mid-escrow, domain hijacks from GoDaddy/namecheap (25%/20% of security vendors), SIM swaps and buyable fake IDs for KYC (~$15), and real-time auth phishing that defeats OTP. Defenses demonstrated: use U2F hardware keys (FIDO2), cold emails, Faraday bags, anti‑tamper seed pouches, antivirus plus TaskExplorer/Lulu/KnockKnock, remove public phone numbers and get premium X verification.
AI-written summary · about
chapters (12)
- 0:00Operational security threats
- 1:05Professionals target people
- 3:55Zero-day exploits and PDF malware
- 6:29Social engineering on fund manager
- 9:23Domain hijacks and registrar flaws
- 12:09Twitter phishing and 2FA flaws
- 16:03Twitter takeovers via social engineering
- 19:36Malware disguised as collaboration
- 23:15Targeted phishing and trusted sources
- 24:40Physical security risks
- 26:45Security tools despite human error
- 27:31Q&A
related talks
55mHacking Humans
16mSecurity, Fraud, and Compliance
52mFlying Under the Radar - New Security Evasion Techniques
56mHacking your Mind and Emotions
55mSocial Engineering: Hacking Humans
35mCYBERSECURITY! The good, the bad, and the hacked
50mHacking Humans : Social Engineering Techniques and How to Protect Against Them
44mHacking Humans: Social Engineering Techniques