Slashdot Mirror
Ask Slashdot: Favorite Thing Out of This Year's Black Hat?
Nerval's Lobster writes "This year's Black Hat conference wasn't just about the NSA director defending his agency's surveillance practices (and getting a bit heckled in the process). Other topics included hacking iOS devices via a modified charging station, eavesdropping on smartphones via compromised femtocells, demonstrating a password-security testing tools that leverage AWS (and 9TB of rainbow tables) to crush weak passwords, and compromising RFID tags with impunity. What was your favorite news out of Black Hat?"
http://blockwatch.ioactive.com:8888/
It's pretty alpha, and you will need to use IE to install it. This tool compares software in memory against known signatures, allowing you to confirm what's running on the system is really what you think it is. It works with HyperV and VMWare.
It's free. Thanks IO Active!
Just curious, why is the conference even called "Blackhat"?
According to Wiki (a very reasonable defintion): "A "black hat" hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005). Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal". Black hat hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network."
So instead of attending shouldn't the NSA be arresting the participants? Not that I actually favor such an act, but that appears to be the "legal" thing to do. Maybe it's better off called "Whitehat" or maybe "Greyhat" since the conference is partly about revealing new threats that concerned computer security experts can study and defend against?
Hearing about the Snowden "hero or villain" vote, and that it was nearly 50/50. That tells you all you need to know about "Black Hat".
HTTP server on non-standard port with (probably) proprietary freeware that requires IE to work. Sounds genuine to me!
Oh, and make sure you have .NET 4.5 installed. The installer choked on me the first time because I didn't have it. You install it on your host system, and it connects to VMs of your choosing to analyze them.
It's called blackhat, because it's the one time a year they get together and brag about the exploits they've found, after having had an entire year to financially benefit through exploiting them.
As far as the NSA arresting them: They're still backlogged due to the FIFO nature of their legal mechanisms and the fact that the blocking cases involve their own misconduct :)
Fair point, but it's not like getting something from port 80 or 443 really assures safety.
Like I said it's really alpha. I would not run it on any important VMs anyway.
A healthy 35 year old inexplicably dies when he's about to reveal a deadly vulnerability in pacemakers. In his words, the vulnerability allowed the knowledgeable to be able to kill anyone having a pacemaker within 20 feet of the attacker. Was it a horrible coincidence? Hopefully it wasn't pure evil, plain and simple; someone finding the solution too expensive to implement or a sinister organisation wanting to retain their secret weapon.
Thousands of federal employees and federal contractors self-identifying as computer criminals by attending a 'black hat' conference.
I'll take that with a grain of salt. Thank you.
Yet another editor that doesn't know how to post "Ask Slashdot" questions in the "Ask Slashdot" topic. For $deity's sake, is it really that hard to do? This topic exists for a reason. Use it.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
That sounds like tripwire to me.
Plus, that link doesn't lead to information about blockwatch, but instead immediately tries to download a file. Not very friendly.
"Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
I love to play Blackhat Bingo.
Will the presenter die, commit suicide, leave the country, or just appear on a no-fly-list?
Ahh, hacking was so much more fun before they were all terrorists..
</sarcasm>
The deeper problem is that very few of anyone in the security industry is actually a "hacker" in the (not quite, the one right after "maker of furniture with an axe") original sense of "being creative with technology", specifically to the point that people will go "I didn't know it could do that!?!".
People needing epithets like "ethical", "black hat", "white hat", "green hat" to their "hacker" are not hackers. The first buffer overflow or SQL injection probably was a hack, but the 9000th, not so much. And that is more or less all these people are producing.
Worse, it's not helping computer security forward in any meaningful way. Even the white hats are nothing more than the consultants spreading FUD and making good money prolonging the problem. Just look at all those press releases and blogs from the likes of Krebs and Kaspersky, and everyone else in the industry, really. Black hats are possibly more honest; they're part of a criminal cottage industry raking in other people's money--and identity, and banking login data, and anything else that sells. I'm sure most people at this conference won't admit to that, so they're really white hats, muddling the waters.
But they're not really helping anyone, much less meaningfully improving security much at all. All they do is confuse people further about what "hacking" should mean -- it's the uninformed big media "anything vaguely dodgy involving computers somehow" taken to bigger extremes. Down to laws now existing criminalising "hacking", except that nobody knows what really got criminalised. Which is bad law by any standard.
So anybody who's a "something hat hacker" or even an "ethical hacker" really is more of a crook fscking it up for progress. And it shows. What really substantial, structural thing has improved at all over the last few years in computer security? All I see is dabbling in the margins. That, then, is what being a "hatted hacker" means.
So in a sense, this is a hipster term, and these people are all their very own brand of hipster.
There are hundreds of free-for-download Access Control software packages which will read the serial number from a RFID card. You don't need to go through the trouble of building a new package. The hard part is that most good AC systems don't use the serial from a smart card, they use one of the sectors on the chip. This is usually locked with a PKI method of encryption and thus much harder to break. He mentioned HID, which uses their own proprietary PKI (such as Legic does), but there are many standards such as DESFire which are open and manage access to the chip sectors. What the article is really talking about is normal 125MHz prox cards which are not secure and yes, widely used in the USA but not in Europe. The real way to crack even the HID encryption is to get behind the reader and capture the Wigand (text) output from the reader which does the encryption handshake for you. Watch out for tampers, but its not hard in any interior space, just look in the false ceiling for the controller and tap in where the cables enter it. Much easier then all this non-sense.
I liked the pigeons best and the rabbit is still pretty cool.
http://breachattack.com/
No, it doesn't sound like a bad idea in case you trust the service.
Oh wait!
So this "Black Hat Convention" is not for Rabbis? ;)
Easily one of the best technical talks I have ever seen; how timing attacks can be used to break the same origin policy and read the contents of a frame. This talk included demo's of an attacker site loading up a target site in a frame and reading the contents to grab the CSRF token. It was awesome. http://contextis.co.uk/files/Browser_Timing_Attacks.pdf