Rachel Tobac - CEO of SocialProof Security & White Hat Hacker, Technology Keynote Speaker

Rachel Tobac is a hacker and the CEO of SocialProof Security where she helps people and companies keep their data safe by training and pen testing them on social engineering risks. Tobac was also the 2nd place winner of DEF CON's wild spectator sport, the Social Engineering Capture the Flag contest, 3 years in a row.

Tobac has shared her real-life social engineering stories with NPR, Last Week Tonight with John Oliver, The New York Times, CNN, NBC Nightly News with Lester Holt, and many more.

For more info or to book Rachel for an upcoming event visit us at https://hubs.la/Q02rJ8290


Transcript below:
Donie: You have stolen about, two and a half thousand dollars worth of hotel points. And, worst of all you have put me in a middle cease.

Rachel: On a five-hour flight.

Donie: Oh my God, and they just let you do it?

Rachel: Yeah.

Donie: Damn. So, I am here in Las Vegas. For two of the world's biggest hacking conferences and some reason, I have agreed to be hacked. I'm meeting Rachel Tobac who's specialized in a special form, called "social engineering". And I'm very nervous.

Rachel: I feel like, I know pretty much everything about you.

Donie: I instantly, don't trust you. So, am I gonna be safer today? Thanks to you.

Rachel: You and every other customer will be safer today. Thanks for what you're willing to let me do.

Donie: Well, that's a good start, I guess.

Rachel: Okay. So you want to assume that everything that you put on social media is public information that can be found in places like this? It can be used to authenticate you with different companies. Do you remember this tweet?

Donie: Yeah.

Rachel: I use this, to gain access to your current address.

Donie: What?

Rachel: So what I did is, I called up this furniture company right here, and I said, "Hey, we're gonna buy another one of these pieces of furniture, but I need to make sure that I don't accidentally have the wrong information on the account", and they said, "No, I mean your ordered something a while ago, but the thing you ordered we ship to this address." Yeah, I think I got his updated address, which is pretty scary. Because it happens in 30 seconds. I got your current address. I got your birthday from Twitter. I called like pretty much every business that he ever listed that he used on his Twitter and Instagram. Wait you have to understand is when you do that, I now know which companies you used. I know which companies took all as you.

Donie: What did you get from the boutique hotel?

Rachel: Your phone number and your key address.

Donie: They gave you my phone number?

Rachel: So, I'm going to be doing these phone calls. I'm going to be live hacking. So, when I call, your phone number is going to display on their caller ID. [phone rings] This is Donie O'Sullivan.

Donie: Who are you?

Rachel: No, this is, this is Donie O'Sullivan. I can tell you my address, phone number, and date of birth. Whatever, you need to know to verify that, that's me.

Donie: That's wild. [phone rings]

Rachel: I am on the road right now and I'm having trouble getting access to my internet. But, I need to transfer points to my friend for our bridal shower. Hopefully, you can help me out over the phone. I have all the information. I have 90 thousand, is that correct? So, the first and last name is Rachel Tobac. Oh, they've been transferred. Okay. Fantastic.

Donie: They're gone.

Rachel: Thank you, have a great day. Bye bye. Are your points gone?

Donie: They're gone. That is crazy. When you call this Airline, it's gonna be coming from my number.

Rachel: Yes.

Donie: As you know, I've a flight Leaving in Vegas.

Rachel: I'll put you in the middle. [phone rings] I'm trying to do this, like, personal essay thing. So, can you move me to a middle seat, kind of in the back of the plane? Then you know, you probably don't get that request a lot. Oh, perfect. Okay. So, it's a row right before the last row and it's in the middle seat. [inaudible] You're in the back of the plane, middle seat.

Donie: I had an exit, aisle.

Rachel: I know, he picked it up saying "Mr. O'Sullivan, how can I help you?".

Donie: If I was not sitting here with you and didn't know. They say, "Well, Sir, you called up and requested this". I would flip. [laughs]

[END]