Rachel Tobac
speaker
124 appearances
1 recordings
1 series
first heard Apr 2024
last heard Apr 2024
Rachel Tobac’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
Yeah. So they wouldn't tell me the names of the companies that were potentially going to be acquired. But I would say things like, I saw a rumor about XYZ company. Is this the type of company that you would be excited about? And then the wink, wink, hand-waving process starts of, you know, I can't confirm it, but we are interested in integrating things like XYZ.
So I was able to glean information such that when I reported it back to the team, they were like, I mean, yeah, you got the right information. Nobody said anything in plain language, but you can get people to say things kind of beating around the bush. So in the end, I got M&A info out of 50% of the interviewers, three out of six. I debrief with the security team.
I ask them when they want to discuss the results with the organization. They say, well, let's just wait up and just finish the hiring process so that it's not a distraction to them. And in the meantime, the next day, I actually get an email that I used to apply for this role, that I was being moved to the next stage of the interview process to get an offer.
So not only did I siphon out the info I needed during the interview pen test, I also got the job, I guess.
I know, I should put PM on there.
They realized that when they explained to people that they were not allowed to say the words of the acquisition, they realized that they needed to be clearer in their communication. That... No, just because you're not saying we are acquiring XYZ company, it doesn't mean that friends, family on social media, people can't glean information to understand, oh, they're interested in AI.
This person's talking about how their role is going to change. They're talking about how much they love this specific technology and they're tagging certain companies on Instagram or Twitter.
They realized that they needed to be much more specific in their protocols and language, saying, when we're planning an acquisition, once we talk about it internally, please do not talk about it even in a hand-waving fashion with friends or family or on social media. Don't talk about how your role is going to change on LinkedIn. Don't talk about what you're excited about upcoming on Instagram.
They had to be really clear about that. And once they did that, those leaks stopped because it wasn't an insider threat. It was just people not 100% getting what an attacker is interested in and how they could find that info.
It did. Yeah, it doesn't necessarily mean that it's coming through the interview process. Now, maybe it was, but it's probably just that people in general at the company didn't understand that when talking in generalities, that can be used by attackers too.
Exactly. And they were like, oh, I get it. So I can't say that we're talking about this technology and how it's going to change my role as a product manager, because that tips off people to understand that we're going to be acquiring XYZ company in the next six months. That's where these leaks are coming from.
Donnie O'Sullivan from CNN.
Yeah, last year or so, I started talking more on Twitter about how I'm seeing AI get used by criminals to trick people. So I'm talking about this, scammers are tricking grandparents out of 1500 bucks, posing as their grandson, spoofing the grandson's phone number, voice cloning, or just like modulating the pitch to sound like the grandson and saying they need money for bail.
Just talking about these examples. 60 Minutes sees this, They email me, they reach out, they say, hey, we want you to do a hack live. It's actually gotta trick somebody. Can you do that with us? And I'm like, I mean, yeah, I can do that, but it's complicated. I've done a lot of these live hacks over the years for large media pieces. You know, I need consent.
Before I do any sort of hacking, I get consent. Like when I hacked CNN's Donio Sullivan, I hacked him through his service providers, and I also hacked him through his leaked passwords.
And I had his consent with a lengthy contracting process and scope discussion before I was able to contact his service providers pretending to be him, before I was able to log into his LinkedIn using his breached passwords and the things that I found online. So I start explaining to them how much consent I'm going to need. And they're like, I mean, well, we'll try.
We'll just try and see what happens. So I start to talk to them about who my target is going to be. They want my target to be Sharon Alfonsi. She's an awesome correspondent for 60 Minutes. Rachel Toback is what's called an ethical hacker. She studies how these criminals operate. So ethical hackers, we step in and show you how it works.
She's got a lot of information about her online, so I do my OSINT.
I determined through OSINT, open source intelligence, that the best way to do this hack was to trick her coworker while pretending to be Sharon. Because sometimes our coworkers have just as much info and access on us as we do about ourselves. So I needed to get consent from the coworker. And here's the massive challenge.
I needed to get her coworker's consent because she was a major part of the hack. This coworker is named Elizabeth. I contacted her. I was like, hey, this is what we're going to do. We're going to do this hack. You need to consent to essentially being part of the hack, but you don't know when, where, or how it's going to happen. You don't know who I'm going to pretend to be.
Showing 81–100 of 124 · page 5 of 7
← Previous
Next →