Guest Rachel Tobac, a social engineer, shares stories of hacking with voice and charm. AI expert Daniel Miessler discusses AI dangers. Topics include social engineering contests, voice manipulation in customer support, investigating leaks, insider threats, and AI in hacking.
Rachel Tobac shares her journey into social engineering and the importance of identifying vulnerabilities to prevent attacks.
Social engineering tactics exploited by Rachel Tobac emphasize human vulnerabilities in accessing sensitive information and the need for enhanced security protocols.
Discussion on AI-generated voice cloning highlights the challenges posed by deepfakes in verifying authenticity and the evolving security measures required to combat fraudulent activities.
Deep dives
The Lucky Stock Scammer
A scammer randomly calling people, accurately predicting stock price increases using a deception strategy. The scammer claimed an algorithm helped him and aimed to manipulate victims into investing more money. The mystery was unveiled when a stock broker explained the scammer's method of misleading multiple people until a small pool of 'successful' individuals emerged.
The World of Social Engineering
Rachel Tobac, an expert in social engineering, shared her journey from childhood fascination with spies to becoming a social engineer. She highlighted societal perceptions of hacking and how she found her passion in social engineering through competitions at DefCon, starting a company catering to cybersecurity needs, and assisting companies in identifying vulnerabilities to social engineering attacks.
Rachel Tobac's Penetration Testing Stories
Rachel Tobac's experiences in conducting penetration tests showcased her expertise in exploiting human vulnerabilities. From accessing bank accounts through social engineering methods, including pretexting as a customer in distress, to uncovering internal leaks in companies by posing as a journalist or a job candidate, she emphasized the importance of enhancing security protocols to prevent social engineering attacks.
Impersonating a Candidate and Extracting M&A Info
The podcast episode delves into a narrative where the protagonist meticulously prepares for a product manager interview by crafting an elaborate persona on social media. Through this persona, they manage to extract confidential merger and acquisition (M&A) details from 50% of the interviewers during a series of virtual interviews, showcasing the significance of social engineering tactics and social media presence in gaining inside information.
AI Voice Cloning and Implications for Security
The podcast episode transitions into a discussion on AI-generated voice cloning and its potential impact on security. It narrates a scenario where an ethical hacker uses AI cloning to deceive an individual into providing sensitive information. This prompts a conversation about the challenges posed by deepfakes in verifying authenticity and the necessity for cryptographic measures to establish trust and prevent fraudulent activities, hinting at the evolving landscape of security in the face of advancing technology.
Rachel Tobac is a social engineer. In this episode we hear how she got started doing this and a few stories of how she hacked people and places using her voice and charm.
Learn more about Rachel by following her on Twitter https://twitter.com/RachelTobac or by visiting https://www.socialproofsecurity.com/
Daniel Miessler also chimes in to talk about AI. Find out more about him at https://danielmiessler.com/.
Sponsors
Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.
Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.
Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode