Rachel Tobac
@racheltobac
Hacker & CEO @SocialProofSec security awareness/social engineering training, videos, talks | 3X @DEFCON🥈 | Ex Chair @WISPorg | Ex @CISAgov Technical Advisory Council under Director Jen Easterly
The new “⚠️Seems like AI slop” button on LinkedIn is sending me into orbit lmao
This year WISP is sending 41 Scholars to @defcon.bsky.social / @blackhatevents.bsky.social to find their community, new skill, or next job! I just donated $1K to cover 1 scholar’s WISP support team, swag, events, community room, etc. Who’s matching me! wisporg.app.neoncrm.com/forms/wisphsc26
WHOA Google let me know they saw my tweet last year & built a tool to defend against the exact call spoofing + AI voice clone attack! As of *today*, fake call detection on Android alerts when someone is impersonating your contact. Thread and demo below:
I used deepfakes & injection attacks to hack an identity verification tool used for remote workforce, helpdesk, & onboarding…until they updated the tool to catch me. Thank you @incode.bsky.social for having me hack you 110+ times to find the latest vulns and fix them🤖🤘 Full vid: youtu.be/pAegYkwWIgE
Whoa, Instructure (who owns Canvas) says they came to an agreement with the cyber criminals (typically this means a ransom was paid) in exchange for the stolen data being deleted instead of leaked and criminals ceasing all extortion requests from customers. Huge development.
Canvas is hacked and stressing out 230+ million students, teachers and staff during finals. What does this mean and how do we stay safe? What are the next steps for the 8,800 affected schools during finals. Answered below in my video:
Want my thoughts on Anthropic's Mythos risk vs hype, how I use AI to bypass identity verification systems now, & more? Tune in for my Rapid7's 2026 Global Cybersecurity Summit keynote panel 5/12 with Graham Cluley, Raj Samani, Brian Honan! Join me here: rapid7.brighttalk.com
If you’re an activist, journalist, exec, or have a high threat model for any other reason, I do recommend using all tools to protect against spyware including Apple’s lockdown mode and WhatsApp’s new Strict Account Settings. Thanks WhatsApp for the partnership to get the word out to folks.
The repairable, customizable, build-it-yourself, physical webcam & mic kill switch, Linux compatible, port swappable @frame.work laptop has hit the SocialProof office 🤖🤘
Live from New York it’s hackers at Nasdaq! Great to go live with @davegerryjr.bsky.social @bugcrowd.com in Times Square today to talk ethical hacking, security and AI!
Today at #GRCConf I show up to tech check for my keynote at 7 am and Jackie Burns (the longest running Elphaba from Wicked) is there and that’s the moment I realized the opener before my keynote was Elphaba singing Defying Gravity. I’ll never be the same lol
Join me and 1Kosmos on 8/20 for a live hacking demo and fireside chat! I'll show how I use AI to bypass traditional defenses in Hiring, Support, Service Desk & more. You’ll see attacks used in the wild & actionable steps to catch them! Register to join: us02web.zoom.us/webinar/regi...
AI voice clones have hit the White House AGAIN, now impersonating the Secretary of State to other Gov officials to try to steal secrets/access. Here is a video of me live demoing how quick (2 min) and easy it is to clone a voice to hack and how to catch AI voice clone attacks in action!
I got my start hacking in the booth at @defcon.bsky.social. It changed my life. Now I'm a *Judge* for the NEW Social Engineering Community Village AI-powered hacking competition where teams use AI agents for live phone call attacks on DEF CON Sat! Apply to compete: www.se.community/battle-of-th...
Thrilled to have worked closely w/ the Google team over the past year to share my expertise on how to programmatically catch and shut down the latest phone call scams (including AI/synthetic audio). Thanks Google for sponsoring our collaboration & congrats on the launch, team! youtu.be/ZSbrP-ckTfU
Find yourself fixing the family printer today?🎄 We get hit with tech requests & our folks don’t realize they are most at risk bc they reuse their password everywhere! Thanks @techcrunch.com @zackwhittaker.bsky.social for chatting about how to help our fam at home 💻 techcrunch.com/2024/12/25/h...
Who else used to play the game Snood constantly? So many of my friends have never heard of it!
Fun to work with Google on their latest Security white paper! My fave quote: “Folks throw money at a super expensive platform, but then don’t have a password manager for the team! It’s like spending money on ballistic windows but your door is wide open.” services.google.com/fh/files/mis...
Welcome, former Twitter users! Enjoy this non-rate limited post of my dog, Snugs. Other cool thing: you can post a picture of your favorite animal in response without being rate limited (please do).
Flew 26 hours to give a keynote in Australia and it was a great idea. #AusCert2023