Jack Recider

And you better have backup numbers in case the person you call doesn't answer or hangs up on you. Once you do get someone on the phone, you get points for every bit of security data you can get off them. So if you can get them to tell you what operating system they use, you get a point or a flag.

And maybe from there, you try to figure out what browser they use, information about their security guards, what janitor service they use. You can't just ask these questions directly. It raises suspicion. So you've got to provide a pretext or pretend to be someone else.

And maybe from there, you try to figure out what browser they use, information about their security guards, what janitor service they use. You can't just ask these questions directly. It raises suspicion. So you've got to provide a pretext or pretend to be someone else.

Maybe someone who works in another department or someone brand new to the company who doesn't know anything but urgently needs to get a report done today. It's tricky. It's intense. It's high stakes because if you get caught on the phone, you're burned, and now you don't get any points. And the best part is the audience gets to watch all this live.

Maybe someone who works in another department or someone brand new to the company who doesn't know anything but urgently needs to get a report done today. It's tricky. It's intense. It's high stakes because if you get caught on the phone, you're burned, and now you don't get any points. And the best part is the audience gets to watch all this live.

So she immediately is like, OK, how do I compete in this? And yeah, it's a whole process. You need to submit an application, create a video of yourself and stand out from the crowd because only 14 are chosen to compete out of hundreds of people who try out for it.

So she immediately is like, OK, how do I compete in this? And yeah, it's a whole process. You need to submit an application, create a video of yourself and stand out from the crowd because only 14 are chosen to compete out of hundreds of people who try out for it.

Now, they actually give you the target company that you have to attack ahead of time. So you can do your research on it, a lot of research if you want, because you want to find as much information as you can about this company, like going through Google searches or just looking at public places.

Now, they actually give you the target company that you have to attack ahead of time. So you can do your research on it, a lot of research if you want, because you want to find as much information as you can about this company, like going through Google searches or just looking at public places.

Maybe you get a list of people and phone numbers to call so that when it's your turn to call, you know exactly who to call and what questions to ask. In fact, it becomes quite a lot of work to prepare for that moment for when you're going to call someone. You could spend a solid month learning everything you can about your target company so you can shine when you're in the booth.

Maybe you get a list of people and phone numbers to call so that when it's your turn to call, you know exactly who to call and what questions to ask. In fact, it becomes quite a lot of work to prepare for that moment for when you're going to call someone. You could spend a solid month learning everything you can about your target company so you can shine when you're in the booth.

It was a major consulting firm is really all I can say. Now, these companies don't know they're about to get hacked. It's really extraordinary to watch. It's basically a live hack with an unsuspecting target. So she gathers as much intel as she can and heads to DEF CON to compete. I get in that glass booth. Now, all eyes and ears are on her.

It was a major consulting firm is really all I can say. Now, these companies don't know they're about to get hacked. It's really extraordinary to watch. It's basically a live hack with an unsuspecting target. So she gathers as much intel as she can and heads to DEF CON to compete. I get in that glass booth. Now, all eyes and ears are on her.

Not only does she have to trick one person on the phone to give her the information they shouldn't be giving her, but she needs to do it in front of an audience. But she's done improv before and was absolutely ready for this.

Not only does she have to trick one person on the phone to give her the information they shouldn't be giving her, but she needs to do it in front of an audience. But she's done improv before and was absolutely ready for this.

Dang, second place. Of course, now she's hooked. That was fun as hell. The nerves, the adrenaline, hacking, and social engineering, all of this she was just craving more of. So she applies to compete again the next year.

Dang, second place. Of course, now she's hooked. That was fun as hell. The nerves, the adrenaline, hacking, and social engineering, all of this she was just craving more of. So she applies to compete again the next year.

Competing three years in a row in the social engineering contest and getting second place all three years, that's what started her career in social engineering.

Competing three years in a row in the social engineering contest and getting second place all three years, that's what started her career in social engineering.

The crazy thing is that I've heard this story over and over. Someone who has no interest in hacking goes to DEF CON, sees the social engineering stuff going on there, immediately wants to compete, does pretty good in the competition, and then decides to do that for a living and start their own company. It's mind-boggling how many lives have changed from people attending DEF CON.