Person
person:rachel_tobac
Also: Rachel
Social engineer and penetration tester featured in the episode.
Social engineer and penetration tester featured in the episode.
“In this episode we’re gonna hear stories from Rachel Tobac”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | social engineering | Explicit | 144 |
| outgoing | USES | Pretexting | Explicit | 144 |
| outgoing | USES | Account takeover | Explicit | 144 |
| outgoing | USES | Open-source intelligence | Explicit | 144 |
| outgoing | USES | phone-number spoofing | Explicit | 144 |
| outgoing | USES | Voice cloning | Explicit | 144 |
| outgoing | USES | Phantom applicant attack | Explicit | 144 |
| outgoing | USES | Knowledge-based authentication | Explicit | 144 |
| outgoing | USES | Email spoofing | Uncertain | 144 |
| incoming | INVOLVES | Social Engineering Contest | Explicit | 144 |
| incoming | DEVELOPED_BY | SocialProof Security | Explicit | 144 |
Social Engineering Contest INVOLVES Rachel Tobac
Rachel participated in the social engineering contest and competed for three years.
Explicit Confidence 99% · Jack Rhysider EP 144 Details
“Competing three years in a row in the social engineering contest”
Rachel Tobac USES social engineering
Rachel performs social engineering as her professional specialization and in penetration tests.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I do all the human hacking stuff”
“I’m one of the best social engineers I’ve ever met”
Rachel Tobac USES Pretexting
Rachel uses pretexts, including posing as a confused employee, journalist, customer, or job applicant.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I pretend to be an employee who’s confused, who’s just starting out”
“I built a fake journalist pretext”
Rachel Tobac USES Account takeover
During an authorized bank penetration test, Rachel attempted to take over customer accounts and obtain administrative access.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“my job was to take over multiple accounts and steal access”
“I have full admin access to the bank account”
Rachel Tobac USES Open-source intelligence
Rachel uses open-source intelligence and data-broker information to identify phone numbers, personal details, and target information.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“when we’re doing OCINT, open-source intelligence”
“I can find those pieces of information through OCINT”
Rachel Tobac USES phone-number spoofing
Rachel spoofed a bank customer's phone number during the authorized penetration test.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I spoof my phone number. I make it look like Kelly on the account”
Rachel Tobac USES Voice cloning
Rachel cloned Sharyn Alfonsi’s voice and used it in a phone call to Elizabeth as part of an authorized live demonstration.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I wanted to clone Sharyn’s voice and spoof Sharyn’s phone number”
“I put her voice into my voice-cloning tool”
Rachel Tobac USES Phantom applicant attack
Rachel used a job-application and interview process as an attack path to obtain merger-and-acquisition information.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“I was going to apply to their product manager role”
“I want to attack via the hiring process”
SocialProof Security DEVELOPED_BY Rachel Tobac
Rachel says she created SocialProof Security in 2017 after companies began asking her to speak and test their defenses.
Explicit Confidence 99% · Rachel Tobac EP 144 Details
“So, I made SocialProof Security in 2017”
Rachel Tobac USES Knowledge-based authentication
Rachel discusses knowledge-based authentication as an identity-verification method that attackers can find information to defeat; she does not present it as the bank’s preferred method in this test.
Explicit Confidence 86% · Rachel Tobac EP 144 Details
“knowledge-based authentication, things like, what’s your address? What’s the last four digits of your phone number?”
Rachel Tobac USES Email spoofing
Rachel describes email, phone, and chat as possible channels for account-takeover testing, but the episode’s successful test used phone-number spoofing rather than email spoofing.
Uncertain Confidence 70% · Rachel Tobac EP 144 Details
“they told me that I could hack via phone call, e-mail, or chat”