Security Confidential S13 E1 Chris Rock

Manoj Tandon (00:00.959)
Hello everyone, welcome to another episode of Dark Rhiino Security’s Security Confidential. Today we are honored to have Security Confidential alum join us again, Mr. Chris Rock, fantastic human being. You guys, if you remember the last show, he is a good guy, a cyber mercenary, over 30 years of experience in the field and has spoken at DEF CON, Black Hat. He’s very well known in our community. He really doesn’t need much of an introduction, but we’re still gonna give him one, because he deserves it. And we’re just honored to have him back, and there’s so much to pick up on. Chris, I know it’s early over in Australia. Thank you for joining us. This is a privilege again to have you here.

Chris Rock (00:45.62)
Thanks for having me back. I didn’t get banned, so that’s all good.

Manoj (00:51.675)
No, you know, again, our motto here is education and honesty and you really brought some good things to the table and that’s what this community needs. If we’re serious about cyber, then we’re not gonna sweep things under the rug because it’s an inconvenient truth.

Chris Rock (01:14.018)
I agree. The good and the bad. And the ugly.

Manoj (01:16.391)
The good and the bad. Let’s start with an easy one. Have you seen a change in the demand profile for hiring people? And what does the talent pool look like since we last spoke? Have you seen any movement?

Chris Rock (01:35.778)
Yeah, so I see recruiters now being more frank with candidates. If you’re new to the industry and looking for a job, they’ll tell you that you can’t just come out of university and go straight into a role. You need boot camps, certifications, internships—because it’s a competitive field. In Australia, there were about 600 security jobs in one month, and only two were for entry-level candidates. The rest required five-plus years of experience.

Manoj (02:24.759)
That makes sense, but there’s also room for brilliance. We’ve seen young people with passion and real skills coming in early.

Chris Rock (02:56.842)
Yeah, passion is common. But combining passion with skill—that’s the challenge. A lot of people are eager, but not everyone has the capability yet.

Manoj (03:48.371)
Some of our best engineers didn’t even have college degrees.

Chris Rock (03:52.358)
I agree. The problem is retention. You hire someone at $120K–$150K, train them for two years, and then they leave for $250K–$300K. Skilled engineers are hard to keep.

Manoj (04:50.095)
Are you seeing different types of people entering the field? Maybe from AI or adjacent disciplines?

Chris Rock (05:14.434)
Yes—data scientists are moving into InfoSec. They already understand AI and large language models, so they’re ahead. For someone like me, learning AI takes time. For them, it’s already part of their skillset.

Manoj (06:05.027)
Let’s circle back to AI shortly. Before that, you were researching financial ecosystems—banking charters, hedge funds. Anything you can share?

Chris Rock (06:44.798)
Yes, but it still ties into AI. I’m researching how financial institutions use AI—chatbots, transaction automation, moving money between accounts. I’m building my own models to test weaknesses. I create scenarios, like decision trees or flows, and look for where AI breaks.

Manoj (08:42.443)
Have you looked at how money moves in illicit systems?

Chris Rock (08:49.722)
Yes, but I was advised by lawyers not to pursue certain areas too deeply, especially in the US.

Manoj (09:23.603)
One observation—if institutions move money, fewer questions get asked than when individuals do.

Chris Rock (10:41.387)
You’re absolutely right. There’s a lot happening behind the scenes people don’t see.

Manoj (13:27.571)
Natural language processing has improved phishing significantly. Have you seen that too?

Chris Rock (13:51.39)
Yes. It’s gotten really good. AI can now generate marketing emails, designs—things we used to pay people for.

Manoj (14:28.135)
Can that power be used to automate processes further?

Chris Rock (14:32.05)
Absolutely. Multi-bot systems can automate workflows. For example, scammers can run hundreds of conversations simultaneously using scripts. It’s similar to SDR sales processes—structured, repeatable interactions.

Manoj (16:09.383)
Where does it break down?

Manoj (16:19.491)
In my experience, automation works for commodities and services, but not as well for high-touch experiences.

Chris Rock (17:26.326)
Agreed. AI can handle the initial outreach, but human interaction is still key for closing deals and building trust.

Manoj (18:13.479)
I had an identity theft case—completely automated system, no human interaction. It was nearly impossible to resolve.

Chris Rock (22:17.65)
That’s the risk of fully automated systems—no accountability.

Manoj (23:11.327)
Once you find a flaw in automation, there’s no resistance.

Chris Rock (23:41.266)
Exactly. And instead of exploiting it directly, you can sell access—like ransomware-as-a-service.

Manoj (26:02.387)
It’s a numbers game.

Chris Rock (26:48.235)
Exactly. You only need one success out of many attempts.

Manoj (27:05.311)
AI lets you scale that massively.

Chris Rock (27:33.511)
Yes, and once inside, the damage can be huge.

Manoj (29:38.555)
MFA can still be defeated, especially with SIM spoofing.

Chris Rock (29:48.589)
Yes, SIM swapping is a big vulnerability.

Manoj (30:19.795)
A $20M theft happened through SIM spoofing.

Chris Rock (31:38.958)
That’s crazy.

Manoj (32:06.367)
If a human is the weak link, what do we do?

Chris Rock (32:09.555)
You’re vulnerable either way—human or bot.

Manoj (35:07.418)
Can SOC tools detect SIM swaps?

Chris Rock (35:34.959)
Technically yes, but I haven’t seen it widely implemented.

Manoj (36:19.477)
Passwords on sticky notes still exist.

Chris Rock (36:18.55)
They absolutely do.

Manoj (37:22.259)
Even trash can reveal sensitive information.

Chris Rock (37:20.926)
Huge value in garbage data.

Manoj (39:13.99)
What are shelf babies?

Chris Rock (39:13.99)
It’s creating fake identities at birth and letting them age. At 18, they become usable for loans, accounts, fraud. You can create thousands and use them later.

Manoj (41:49.211)
That’s wild.

Chris Rock (41:40.057)
You can also “kill” them for insurance payouts. It’s all about exploiting systems.

Manoj (44:14.672)
Why aren’t these flaws fixed?

Chris Rock (44:23.926)
If simple issues aren’t fixed, AI won’t be either.

Manoj (45:06.107)
AI is exposing patterns, not creating new risks.

Chris Rock (45:23.926)
Exactly—but it scales everything massively.

Manoj (49:02.419)
Maybe this accelerates human evolution.

Chris Rock (49:04.298)
We adapt well.

Manoj (50:36.631)
Final thoughts?

Chris Rock (51:02.174)
I’m focusing on research this year. Next year I’ll attend conferences across the US to collaborate with others in person.

Manoj (51:35.175)
We’d love to host you.

Chris Rock (51:52.726)
Thank you.

Manoj (52:06.091)
Take care. Thank you.