Rachel Tobac
More info
- Country
- United States
- Known for
- SocialProof Security, DEF CON SECTF
American social engineer who demonstrates, preferably on camera, how few phone calls it takes to take over someone's accounts.
Tobac came to security from UX and neuroscience rather than programming. She placed second in DEF CON's Social Engineering Capture the Flag three years running — the contest where competitors sit in a glass booth and phone real companies to coax out internal details. She then co-founded SocialProof Security, which trains staff by doing to them what attackers would.
She is best known for live demonstrations: with their consent, she has called carriers and support desks posing as journalists and taken over their accounts using a bit of open-source research and, in one notorious case, a recording of a screaming baby in the background. The lesson never changes — MFA and verification procedures only help if support staff are allowed to say no.