Actually I learned nothing because I wasn’t there. Total calendar fail on my part, as a family vacation was scheduled during Black Hat week. You know how it goes. The Boss says, “how is the week of July 26 for our week at the beach?” BH is usually in early August, so I didn’t think twice.
But much as I missed seeing my peeps and tweeps at Black Hat, a week of R&R wasn’t all bad. Though I was sort of following the Tweeter and did see the coverage and bloggage of the major sessions. So what did we learn this year?
- SSL is bad: Our friend RSnake and Josh Sokol showed that SSL ain’t all that. Too bad 99% of the laypeople out there see the lock and figure all is good. Actually, 10% of laypeople know what the lock means. The other 89% wonder how the Estonians made off with their life savings.
- SCADA systems are porous: OK, I’m being kind. SCADA is a steaming pile of security FAIL. But we already knew that. Thanks to a Red Tiger, we now know there are close to 40,000 vulnerabilities in SCADA systems, so we have a number. At least these systems aren’t running anything important, right?
- Auto-complete is not your friend: As a Mac guy I never really relied on auto-complete, since I can use TextExpander. But lots of folks do and Big J got big press when he showed it’s bad in Safari and also then proved IE is exposed as well.
- Facebook spiders: Yes, an enterprising fellow named Ron Bowes realized that most folks have set their Facebook privacy settings, ah, incorrectly. So he was able to download about 100 million names, phone numbers, and email addresses with a Ruby script. Then he had the nerve to put it up on BitTorrent. Information wants to be free, after all. (This wasn’t a session at BH, but cool nonetheless.)
- ATM jackpot: Barnaby Jack showed once again that he can hit the jackpot at will since war dialing still workss (yay WarGames!), and you can get pretty much anything on the Internet (like a key to open many ATM devices). Anyhow, great demo and I’m sure organized crime is very interested in those attack vectors.
- I can haz your cell tower: Chis Paget showed how he could spoof a cell tower for $1,500. And we thought the WiFi Evil Twin was bad. This is cool stuff.
I could probably go on for a week, since all the smart kids go to Vegas in the summer to show how smart they are. And to be clear, they are smart. But do you, Mr. or Ms. Security Practitioner, care about these attacks and this research? The answer is yes. And no.
First of all, you can see the future at Black Hat. Most of the research is not weaponized and a good portion of it isn’t really feasible to weaponize. An increasing amount is attack-ready, but for the most part you get to see what will be important at some point in the future. Maybe. For that reason, at least paying attention to the research is important.
But tactically what happens in Vegas is unlikely have any impact on day-to-day operations any time soon. Note that I used the word ‘tactical’, because most of us spend our days fighting fires and get precious few minutes a day – if any – to think strategically about what we need to do tomorrow. Forget about thinking about how to protect against attacks discussed at Black Hat. That’s probably somewhere around 17,502 on the To-Do list.
Of course, if your ethical compass is a bit misdirected or your revenues need to be laundered through 5 banks in 3 countries before the funds hit your account, then the future is now and Black Hat is your business plan for the next few years. But that’s another story for another day.
Reader interactions
3 Replies to “What Do We Learn at Black Hat/DefCon?”
@annalie,
There are a couple of folks that I think qualify. Of course, being a total megalomaniac, I’d say I’m a pretty OK speaker. But enough about my favorite topic – me…
Rich is good and I’ve actually seen him tune down the geek factor. Adrian, not so much… 😉 (Have to have my boy Rich’s back).
If you want to consider non-Securosis speakers, I’d mention Chris Hoff, even if his head is in the clouds. He’s entertaining and has forgotten more about security than most of us know. Jeremiah Grossman is also a very engaging speaker, especially when he breaks out his graphics about web application attack vectors. Amrit Williams is also great in front of a crowd, though not sure how he’d going to look in a Big Blue suit. I’d also throw a shout-out to Josh Corman, who always makes me think every time I see him.
There are a bunch of great speakers and a lot of crappy ones. It’s really about understanding your crowd to pick a speaker. Happy to chat off line if you want to discuss more. Send me an email.
Mike.
Annalie – Rich Mogull. Oh, wait, you said “Non” geeky. Never mind.
Thnx for this synopsis- enjoyed it! If you had to pick only ONE speaker as the most entertaining, non-geeky, on the money with his subject matter on Future of Security and EXCELLENT audience engager/ story teller…..in the world…alive today, who would that speaker be?