It’s an open secret: For years, hackers and feds have been strange bedfellows in the mission to defend military networks. Three-letter agencies set up recruiting booths with schwag at security conferences like Black Hat, and feds party it up with the computer nerds at the so-called “underground hacking conference” DefCon after enlisting intelligence help.
Darpa, with the help of former hacker Peiter “Mudge” Zatko, wants to find a way for the government make that alliance even easier....
(One of many stories, poorly formatted in the on-line new article. I've added "Bold" to highlight what is probably this article's title)
Originally posted by URL1
Students honored for hacking computers
Not only did four computer science students walk away with the top prize from their first computer hacking competition, but they also were awarded for outsmarting the judges.
Undergraduate students Austin Whipple and Tobias Kin Hou Lei and graduate students Kimball Germane and Scott Ruoti teamed up to test their hacking skills.
CTF, or capture the flag, competitions are hosted voluntarily throughout the year by schools, companies or other large groups. This competition was hosted by organizations interested in promoting STEM (science, technology, engineering and math) and all high school to graduate level students were eligible.
With a blue ribbon to BYU's name, the students were awarded paid entries to the DEF CON competition in Las Vegas, and a trip to Orlando to be recognized at The Security Congress (IC2) conference. IC2 is a worldwide information security group that certifies information security professionals.
Vermont's Pwnie Express sells a powerful new tool for cyber-security experts — and hackers
By Ken Picard [10.26.11]
...
Hacker Jeff Moss, aka “The Dark Tangent,” founded two of the world’s largest hacker conventions, Black Hat Technical Security Conference and DEF CON Hacking Conference. In recent years, these annual events have morphed into recruitment grounds for cyber-security experts working at the FBI, CIA, NSA and Pentagon.
...
Access to forums was fixed about one hour ago by Jeff when he worked on the firewall.
Access to most https-content at *.defcon.org was leading to timeout and eventually temporary blacklisting, denying access to http-only content.
Visiting the main page at http://www.defcon.org/ would work fine from browsers not using javascript, but those that used javascript would see a request in a served document to grab content from https://forum.defcon.org/ which could blacklist your for a while if followed. This loss of access to the forums and other https-only content lasted about 24 hours.
If you see problems like this, please let us know.
[Aaron Barr] was scheduled to appear on a panel at the Defcon security conference in Las Vegas in August, but was prohibited from doing so at the request of his former employer. The reason, Barr said, is that his employer was afraid it might "stir the hornet's nest and they might attack again."
"I just kind of wanted to rip off the scab, deal with the issue and show people, 'listen this conversation can happen' between me and a group that attacked me," Barr said. "I may not want to drink a beer with them, but we can get through this."
With only his last name, university ID number and birth date, I reset and changed a friend’s password to gain access to his UCLA law school email account Thursday.
...
While researching this column, I attended DEF CON, an annual hacker convention, in Las Vegas this summer. The convention scared me into caring about online security.
So I decided to check it out. I asked my friend Ben Shea, a first-year law student, for consent to “hack” his email account.
...
More details on what happened when the issues was found, motives for abusing stolen accounts, what has been done since then, and what is planned in the future.
During the Black Hat and Defcon conferences in early August, researchers demonstrated a number of disturbing attack scenarios. One particularly scary hack showcased the possibility of hijacking a car. Hackers could disable the alarm, unlock its doors and remotely start it through text messages sent over cell phone links to wireless devices in the vehicle.
Metasploit Gets Covert Forensics And PXE Boot Attack Capabilities By John H. Sawyer, Sep 09, 2011 | 04:52 PM, Dark Reading
(New Metasploit modules released during the Vegas security conferences add cool, new features, like covert forensics and PXE boot pwnage)
Originally posted by URL1
Black Hat USA and DefCon bring a wealth of knowledge, new tools, and updates to old favorites. One thing that is often disappointing is that tools are released and nothing ever happens to further development. I attended several Metasploit-related talks, but I think it was during HD Moore's talk at BSides Las Vegas where I heard it said that if it makes it into Metasploit, it has to be maintained. That's great news because there have been some awesome, independently developed Metasploit modules released in Vegas that have since been included within the Metasploit Framework.
I thought I would also just mention that they had really nice post cards they were distributing around Def Con 19 and were doing their best to promote their local Def Con chapter. It is amayzing to see the range Defcon has all over the world.
...
Security researcher Deral Heiland demonstrated various ways to compromise Internet-ready consumer-grade multifunction printers, according to an article posted on PC World.
In a talk at this summer’s DefCon 19 conference, he said vulnerable devices included include printers that can scan to a file, scan to email, and fax documents.
...
At DefCon 19, Heiland demonstrated changing the default Toshiba printer password from 123456 to something unique will not deter a criminal, who can simply add an extra backslash to the URL to gain administrator access to the device.
...
Last edited by TheCotMan; September 6, 2011, 20:21.
a leading Swiss information security and ethical hacking company, invites security specialists, researchers and IT managers to join the hashdays 2011 conference, dedicated to cyber security and risks, organized by DEFCON Switzerland.
Defcon Switzerland?
Is that the name of a Defcon group in Switzerland?
URL1 "Defcon: The security penetration testing quagmire" , Tim Greene, August 08, 2011 09:09 AM ET
Originally posted by URL1
LAS VEGAS -- The relationship between CISOs and security penetration testers is anything but clear-cut and raises ethical issues for both parties, a Defcon crowd heard from a former CISO.
Whether penetration testers should come in looking for the place where they can spectacularly break into the network or instead assess it clinically and point out potential vulnerabilities is the big decision CISOs have to make, says a CISO-turned penetration tester identified only as Shrdlu.
...
URL2 "Hackers take aim at prison locks and other real-world targets" , John D. Sutter, CNN, August 9, 2011 6:36 a.m. EDT
(Mostly about BlackHat)
Originally posted by URL2
No one knows for sure who wrote that worm [Stuxnet], and its powers were never put to use. But the code is out there, and security researchers and hackers are jumping at the chance to study that code and figure out what else it -- or something like it -- could do.
The examples surfacing at Black Hat and DEF CON, a companion hacker conference attended by 15,000 people, sound like they're pulled from a Hollywood thriller.
URL3 "Black Hat 2011: Looking Back", Neil J. Rubenking, August 8, 2011 08:03pm EST
Originally posted by URL3
The most hard-core hacking sessions generally occur at Defcon, but Black Hat did have its own share of sessions demonstrating hacks. ...
...
As the briefings wound down, many attendees made ready to head for Defcon with their kids. That's right; this year's conference introduced a Defcon Kids track. One ten-year-old Girl Scout wowed her audience with an exploit to speed up the action in farming games. Tweets from hacktivists LulzSec and th3j35t3r suggested both were present ad Defcon, though this wasn't confirmed. I spotted Barack Obama in the hall (at least that's what his Black Hat badge said). Those attending Defcon value their privacy so much that Defcon badges (image here ) don't include names.
URL4 "Vegas To Host Next U.S. Cyber Challenge 'NetWars'" , Aug 16, 2011 , 02:25 PM
Originally posted by URL4
The SANS NetWars contest -- part of the U.S. Cyber Challenge program -- will be held as part of the SANS Network Security 2011 conference at Caesars Palace in Las Vegas. The contest is for both new and seasoned hackers.
Capture-the-flag (CTF) type hacking contests are nothing new in cybersecurity. What makes NetWars different than say, DefCon's CTF, is that it's aimed at all levels of hacking skills and all competitors have to begin at level one of the contest, says Ed Skoudis, director of NetWars for SANS. The more advanced players can then quickly advance to higher levels -- up to level four, then five, where the participant gets access to a system at the root level, he says. "Level five is for people who really know their stuff. There's castle-on-castle combat," Skoudis says.
"DefCon is a big-team CTF focused on binary analysis and exploit development. That's cool and a fantastic skill," Skoudis says. "That's not what NetWars is focused on. Ours includes this, too, but it's multilevel and multidisciplinary."
...
URL5 "You Make a Difference" , Aaron Jue , August 17th, 2011
Originally posted by URL5
The Electronic Frontier Foundation would like to thank all of the attendees at this year's Black Hat USA, Security BSidesLV, and DEF CON conferences in Las Vegas. We are humbled by the infosec community's outpouring of generosity to sustain EFF's work defending coders rights and upholding our freedoms online.
With the help of our donors and creative community efforts, we were able to raise over $85,000 for protection of online rights!
...
URL6 "Free tool for testing net neutrality" , 1 September 2011, 17:15
Originally posted by URL6
IT security specialist Dan Kaminsky has announced N00ter, a tool for identifying artificial brakes on data traffic implemented by ISPs. Kaminsky first described N00ter at the Black Hat and DefCon security conferences in Las Vegas. He intends to make it available to download free of charge within the next few weeks. ...
...
URL1 "Facebook Offers Cash To 'Bug Bounty Hunters' At DefCon Hacker Conference" ,Gerry Smith, First Posted: 8/6/11 12:42 PM ET Updated: 8/8/11 10:03 AM ET
Originally posted by URL1
LAS VEGAS -- At the DefCon hacker conference this weekend in Las Vegas, a team from Facebook has been making the rounds and delivering an unusual message: Please hack us. We'll pay you for it.
...
Sullivan said DefCon is fertile recruiting ground for Facebook because the company is looking to hire people who live and breathe security.
...
URL2 "Picking Locks and Hacking Servers at Defcon", Somini Sengupta, August 6, 2011, 6:27 pm
Also mentioned with little detail:
* Tamper Evident Contest
* Beverage Cooling Contraption Contest
* MohawkCon
* Vendors
CTF, and LP Village had enough details to get posts in their respective forums on this article.
Originally posted by URL2
...
Contests are a big deal at Defcon, the somewhat circuslike hacker convention that takes place every year amid the circus of Las Vegas.
...
To win at Defcon is to earn the respect of the tribe. It’s refreshing: conventional power and money take a back seat to skill and tenacity. ...
...
Defcon wouldn’t be Defcon without a degree of public humiliation. ...
URL3 "DIY aerial drone monitors Wi-Fi, GSM networks: Passwords cracked on the fly" , Dan Goodin, 5th August 2011 22:54 GMT
Originally posted by URL3
Defcon Hobbyist hackers have built a DIY flying spy drone that's capable of intercepting communications over remote Wi-Fi and cellular networks and beaming them to snoops located half a world away.
...
“Our goal was to take all these things, Black Hat and Defcon's greatest hits, and to put them in a target remotely from a long way away and offer it to a distributed user base,” Mike Tassey, one of the creators of WASP, said at the Defcon hacker conference in Las Vegas on Friday....
...
URL4 "Android App Turns Smartphones Into Mobile Hacking Machines", Andy Greenberg, 8/05/2011 @ 7:05PM
Originally posted by URL4
... app called Anti, or Android Network Toolkit, hits the Android market next week. The program, which Israeli security firm Zimperium revealed at the Defcon hacker conference in Las Vegas Friday and plans to make available to Android users in coming days....
...
URL5 "Photos show the cultural difference between Black Hat and Defcon hacker events" August 7, 2011, Dean Takahashi
Originally posted by URL5
...
Defcon (named after the old code for nuclear war, or defense condition) is now in its 19th year. It was started in 1993 by Jeff Moss, a hacker also known as Dark Tangent. Defcon began as a party for a visiting Canadian hacker. Now it has become the big hacker event of the year with more than 10,000 attendees. The Defcon conference is anything but corporate. For many years, it was at the downscale Riviera Hotel; this year it moved upscale to the larger Rio Hotel. Defcon is more tolerant of alternative views, such as open support for Anonymous...
...
... you’ll see more suits at Black Hat and more T-shirts at Defcon ...
...
... You can pay corporate rates at Black Hat, but at Defcon, they don’t accept credit cards, since hackers do not want to be identified. You have to pay in cash, and attendees are identified as “human,” “goons,” (for staff) and “press.” (Yes, evidently press are not human). There are no names on Defcon badges, which are typically a product of the hacker imagination. I’m killing myself because I forgot to take a picture of the fake automated teller machine at Defcon. ...
...
... At Defcon, people heckle the speakers and drink beer in the middle of comic presentations. ... A few years ago, a CNBC reporter tried to sneak into Defcon to shoot undercover film of hackers — a big no-no at Defcon if you don’t ask permission of those you’re taking images of first. ...
...
Jeff “Dark Tangent” Moss founded both Black Hat and Defcon. He is now vice president and chief security officer at ICANN, the international body that sets the rules for the internet.
...
[Many images in this article compare and contrast Defcon to BlackHat. See the article for more.]
URL6 "DefCon Dings Reveal Google Product Security Risks" , By Jack Loftus, Aug 7, 2011 3:00 PM
Originally posted by URL6
...
... the Android flaw was revealed by researchers Sean Schulte, SSL developer at Trustwave, and Nicholas Percoco, senior vice president of SpiderLabs at Trustwave.
...
... security experts at DefCon argue mobile exploits are a much more viable target for hackers because the OS is more similar to mobile devices and apps.
...
I suppose it's ultimately a good thing we're reading about this at DefCon and not as a breaking news investigative report in the WSJ. [CNET, ]
URL7 "10-year-old hacker finds zero-day flaw in games" , By: Seth Rosenblatt , August 7, 2011 4:00 AM PDT
Originally posted by URL7
LAS VEGAS--A 10-year-old hacker who goes by the pseudonym CyFi revealed today at DefCon 19 a zero-day exploit in games on iOS and Android devices that independent researchers have confirmed as a new class of vulnerability. ...
...
CyFi's mother, who must remain anonymous to protect her daughter's identity, told CNET that at the end of CyFi's presentation at DefCon Kids they would offer a $100 reward to the young hacker who found the most games with this exploit over the following 24 hours....
...
Links to more stories about this topic:
*
URL8 "DEF CON Hacker Event in Las Vegas: Informing and Terrifying" , Gig Veres , August 07, 2011 10:50 AM EDT
Originally posted by URL8
The DEF CON hacker event in Las Vegas is said to be the most dangerous place in the world to use a computer. The four-day event at the Rio is a cash only convention where people can go to learn computer hacking, lock picking, and security breaching.
[the rest of this article is a few more paragraphs with general comments about different aspects, including contests or events]
URL9 "Def Con 19: Battery hacker says Apple security lapse helped him" , Jeffrey Fox , Aug 7, 2011 2:30 PM
Originally posted by URL9
The security expert who made waves last week when he announced that he had hacked into a Macintosh laptop battery explained on Saturday how an oversight by Apple played a key role in his achievement.
...
Last edited by TheCotMan; September 1, 2011, 00:20.
Anyone that wants to post links to stories here is allowed to do so. Replies in this forum should work for all non-lurking registered users, but starting new threads in this "General Announcements" forums is restricted.
More news about Defcon that nobody has linked to:
URL1: "US gov’t building hacker army for cyber war", Andrew Couts, August 2, 2011
Originally posted by URL1
...
To find new recruits, representatives from the NSA, Department of Defense, Department of Homeland Security and NASA, will be attending the annual DEF CON hacker conference in Las Vegas, which takes place this weekend.
Started in 1993 by hacker Jeff Moss (aka Dark Tangent), DEF CON is the preeminent meet-up for US hackers. The four-day conference costs $150 — in cash only — to attend. There is no registration, no credit cards allowed, which keeps everything anonymous. About 10,000 computer savvy individuals are expected to attend this year’s conference.
...(Sources who attended last year’s DEF CON tell us that members of the US nation security complex were also in attendance then, as well, with similar recruiting goals.)
...
...
Still, some hackers have crossed over to the other side. In fact, DEF CON founder Moss is himself now a member of the Department of Homeland Security’s Advisory Council.
URL2: "NSA is looking for a few good hackers", Tabassum Zakaria, August 2, 2011
Originally posted by url2
...an alphabet soup of federal agencies — DOD, DHS, NASA, NSA — are descending on Las Vegas this week for Defcon, an annual hacker convention where the $150 entrance fee is cash only — no registration, no credit cards, no names taken. Attendance is expected to top 10,000.
...
...at Defcon, the NSA and other “Feds” will be competing with corporations looking for hacking talent.
...
Jeff Moss, a hacker known as Dark Tangent, knows something about bridging the two worlds. He founded Defcon and the companion Black Hat conference for security professionals and is now a member of the Department of Homeland Security’s Advisory Council, which advises the government on cybersecurity.
“They need people with the hacker skill set, hacker mind-set. It’s not like you go to a hacker university and get blessed with a badge that says you’re a hacker. It’s a self-appointed label — you think like one or you don’t,” Moss told Reuters.
URL3: "An Open Letter to Defcon Hackers: Don’t Sell Out to the NSA", By DJ Pangburn Thursday, August 04, 2011
Originally posted by url3
Dear Hackers,
Word on the internet is that the National Security Agency (NSA)—of which I’m sure you’re well aware—has very publicly stated it’s setting up shop at Defcon alongside corporations to recruit hackers to the dark side.
...
An open letter to the hacking community is making the rounds, urging the Defcon crowd not to go work for the NSA. I disagree.
...
If the NSA people at Defcon are there to pull you into a do-nothing job or, worse, a job that does indeed threaten the liberties of innocent Americans, you'll be in a pretty good whistle-blowing position.
URL5 "Black Hat 2011 notebook" , Dan Kaplan , August 04, 2011
Originally posted by url5
Conspiracy theories are running rampant after Riley Hassell and Shane Macaulay, two researchers with Privateer Labs, didn't show up for their planned (and highly anticipated) 10 a.m.Thursday talk at Black Hat: "Hacking Androids for Profit."
...
... Nico Sell did say the pulled presentation was not related to any legal threat, as has been the case before.
"It happens," she said of the talks when the speakers simply fail to show. "DEFCON (Black Hat's sister show), more."
...
With Black Hat winding down, attention now turns to the less formal, even more unpredictable, DEFCON event, held for the first time this year at the Rio hotel.
SCMagazineUS.com reported on Monday that the National Security Agency will be on hand to recruit hackers at the $150-cash-only event.
But there's at least one person who argues that attendees should stay far away from the men in suits.
DEFCON is known for allowing attendees to remain anonymous at the show. Event registrants don't even ask for a name.
URL6: "Click Here
Viruses: Destroying your systems for 25 years", Seth Rosenblatt August 5, 2011 1:24 PM PDT
Originally posted by URL6
LAS VEGAS--The hacker conference DefCon kicked off this morning with the rare public sighting of a now-archaic piece of technology: the 5 1/4-inch floppy disk. Mikko Hypponen, the chief technical officer for the Finnish security company F-Secure, waved the disk above his head to start off his history of PC viruses, and said, "This is Brain."
...
URL7 "Want to plan a cyber war? Ask Bruce Willis", Dean Takahashi, August 5, 2011
Originally posted by URL7
If you want to plan a cyber war, look no further than the Bruce Willis movie, Live Free or Die Hard. That may sound fishy, but that is what a former government cyber war expert told the Defcon security conference today in Las Vegas.
...
Mostly about BlackHat. I pulled the only reference to Defcon in the quote. URL8 (Has ad-system, requires Javascript) "Black Hat Organizer Touts Value of Publicizing Cyber-Security Research", Fahmida Y. Rashid
2011-08-05
Originally posted by URL8
[BlackHat]; Launched as a vendor-neutral alternative to industry security conferences 15 years ago, Black Hat attracted more than 8,000 researchers and security professionals, according to organizers. The more technical and edgy DEFCon follows a week of Black Hat training sessions and briefings. DEFCon begins Aug. 5.
Jerome "Jay" Radcliffe's demonstration at DefCon in Las Vegas will spotlight a critical need to build software defense into pace makers, insulin pumps and other medical gadgets getting "smarter" with computer chips.
...
Radcliffe didn't disclose his insulin pump model nor did he outline critical details of the hack to allow time for the maker to address the situation and to avoid tempting DefCon attendees known for software mischief.
...
Radcliffe was wearing his insulin pump at DefCon on Friday and urged diabetics not to panic.
...
Leave a comment: