This document discusses techniques for sourcing talent using unconventional methods. It describes how recruiters and sourcers can leverage publicly available online data and digital technologies to identify and engage with candidates. Some of the techniques discussed include sourcing CVs from Google and social media sites, using location data and WiFi to identify people at conferences, and simulating phone calls and messages to reach targets. The document also mentions potential ethical issues with some of these approaches.

1. A Hacker Guide to
Sourcing Talent
in the 21 Century
Josef “josé” Kadlec

2. BlackHat Conference Agenda
Term: HACK
4x

3. Sourcing Summit 2016 Agenda
Term: HACK
47x ?!?

4. Recruiters Obsessed by HACKING

5. Recruiters Obsessed by HACKING

6. Recruiters Obsessed by HACKING

7. Recruiters Obsessed by HACKING

8. Recruiters Obsessed by HACKING

9. Recruiters Obsessed by HACKING

10. Recruiters Obsessed by HACKING

11. Recruiters Obsessed by HACKING

12. Talent Sourcers are modern
Social Engineers

13. Kevin David Mitnick

14. Who is using it?
The Good
 Social Engineers (yes,
it’s a job)
 Salesmen
 Marketing
 Sourcing/Recruitment
 Candidates (guerrilla
techniques)
 Law enforcement
The Bad
 Corporate espionage
 Organized crime
 Phishers/Vishers
 Scammers
 Hackers/Crackers
 Phreakers
 Script kiddies

15. Publicly Available Data

16. LinkedIn, XING and others have changed
the game of social engineering

17. Sourcing techies on Airbnb
site:airbnb.com/users java prague

18. Sourcing CVs on Google
java OR J2EE intitle:cv OR intitle:resume OR intitle:vitae
filetype:pdf OR filetype:doc OR filetype:docx OR filetype:rtf

19. Sourcing in the WHOIS database

21. (payroll OR accountant OR ucetni) (german OR french) intitle:cv OR
intitle:resume OR intitle:vitae OR intitle:zivotopis filetype:pdf OR
filetype:doc OR filetype:docx OR filetype:rtf site:.cz OR site:.sk

43. Let’s go blackhat...
I TRIED THAT AT HOME

44. How do you SMS from a
telephone number of your
choice?

45. Examples

46. How You Can Do It
The access is available for SOSUDE attendees only.

47. Is it possible to do with
calls as well?

48. Examples

49. How you can do it
SpoofCard
www.spoofcard.com
+ group spoofing
+ background noises
+ change your voice
+ any mobile platform
bitphone
www.bitphone.net
+ pay by bitcoins
+ encrypted communication
+ call directly from your browser
X

50. Possible sourcing scenarios
 Fake number is more effective than a hidden number
 Calling a foreign candidate with a local number
 Overcoming reception to reach a candidate at work by
calling as e.g. an internal employee, branch number, etc.
 Attract a candidate who will Google the unknown
miscalled number back - e.g. from the CEO of some
company (establishing engagement with a candidate)
 and many other bad things: )

51. Copy the voice of anyone (Adobe VOCO)

52. Copy the voice of anyone (Lyrebird)

53. Area Based Sourcing

54. How to crash the party with
pushed SMSes?

55. Why care?
Global Analysis
~ 500+ million LinkedIn users
~ 1,7 billion active Facebook users
~ 3,1 billion people online
~ 4,3 billion unique mobile phone subscribers
Source: Wiki, gsmamobileeconomy.com, internetworldstats.com

56. Why care?
Czech Republic breakdown
~ 10,5 million inhabitants
~ 1,1 million LinkedIn users
~ 4,7 million active Facebook users
~ 7,7 million people online
~ 14 million SIM cards

58. How to approach GSM network

59. GSM Area Mapping
www.opencellid.org

60. NetMonster app for Android

61. Motorola C140

62. How our solution works

66. Possible sourcing scenarios
 Approaching attendees of conferences,
summits and meet-ups
 Approaching employees of targeted companies
 Engage with people passing by your company
premises
 Track habits, schedule and location of
particular people/employees
 Complete GSM stalking and hijack … ouch

68. How you can do it
Bird Catcher
www.toplinkpac.com
www.gammagroup.com
www.neosoft.ch

69. How do you hack radio?

71. Hacking Car Radio

72. How our solution works

73. How do you get your prime time
at the national TV without a
single penny?

77. How our solution works

78. How to gather identities of
any meet-up or conference via
fake wi-fi?

82. How our solution works

83. Possible sourcing scenarios
 Collecting contact information and
identities at conferences and meet-ups
 Sniffing traffic for more data about
connected people

84. www.recruitmentacademy.cz
GoodCall iBeacon Kontakt.io Eddystone beacon

85. What’s next?

88. Average Response Rate on LinkedIn
36,4%

89. Case Study: JavaScript Developer [iBillboard]

90. Video Sourcing

91. Video Job Description
https://www.youtube.com/watch?v=uDOetfwu6Gs

92. Individual Video Approach
Role: ECM Specialist at Tieto
20 qualified candidates, LinkedIn response rate: 100%

93. Virtual Reality Videos
360° AND/OR 3D

94. InCam

95. InCam

96. Live Videos on Steroids

97. How to live stream to multiple channels
Restream.io

98. LinkedIn Live?

99. “We are not going to white collar
resort prison, no, no, no.
We’re going to Federal POUND ME IN THE
^%*&^@ prison.”
-Office Space movie

100. Hacking had a Different Meaning

101. Hacking had a Different Meaning

102. Hacking had a Different Meaning

103. Me Today