Has it already been a year? Apparently, because two weeks ago I found myself in the middle of the Nevada desert once more to attend what has recently has been affectionaltely named Hacker Summer Camp the week when Black Hat, BSides Las Vegas and DEFCON happen back to back and most mailing lists get oddly silent because almost everyone is out in Vegas anyway. And as in previous years (for example 2012 – Part 1, Part 2 and 2011), I had the pleasure of attending myself, too.

BSides Las Vegas

The original Security BSides is still going strong and is, one might argue, probably the most original and innovative conference happening in this packed week. I skipped the annual madness last year and with it, I missed the move BSides made from the Artisan to the Tuscany, but I think that the move helped the event a lot when it comes to coping with the massive amount of people wanting to attend. While no official numbers have been published to date, there were probably about 1500 people in attendance – a massive feat for a conference that charges attendees an exact amount of zero dollars for a ticket and finances itself completely with the help of sponsors and donations without degenerating into a sales event. In fact, BSides – again – managed to offer a variety of highly sophisticated technical talks on many topics.

Before I give a couple of examples to illustrate the content presented at BSides, let me point out that all the videos are already available online should you wish to catch up. I can only compliment Adrian Irongeek Crenshaw on his professional dealing with the video and the quick uploads.

That being said, I really enjoyed Meredith L. Patterson’s talk Strategies Without Frontiers that essentially deals with game theory in terms of threat modelling.

Another talk that I enjoyed, primarily due to my own affinity for travelling comfortably while not spending an absurd amount of money, is TProphet’s talk Travel Hacking With The Telecom Informer. As the title implies, it’s not strictly related to information security, but it illustrates nicely that hacking is not necessarily to be considered something that has to do with computers.

If you prefer more specific information security content, you might enjoy this talk on ATM Malware by Daniel Regalado.

These are only a couple of examples to illustrate the fantastic content available to BSidesLV this year. Apart from a select few, all talks were posted. One of them is the infamous closing ceremony with a surprise appearance by John McAfee, mostly known for his recent escapades including a wide variety and large quantity of drugs.

Again, while I didn’t get to spend as much time at BSides as I’d have liked to, I can only compliment Banasidhe and her entire team on all their hard work and the results they achieved. And, of course, all the compliments that they deserved.

Black Hat USA

Partially coinciding with BSidesLV, the titan of security conferences, Black Hat USA happened for the first time in one of my favorite venues in Las Vegas, the Mandalay Bay, probably because the event outgrew Caesar’s Palace or just wanted something a bit more modern. Black Hat is always a bit tricky. On one side, the conference has a solid reputation for bringing out some of the best researchers and giving them all the limelight they can to present important findings to the InfoSec industry and the general public. On the other side, Black Hat has a very corporate feel to it that seems to deter a steadily increasing amount of the hardcore security folks.

That being said, Black Hat did feature some very profound and interesting talks, including Dan Geer’s keynote titled Cybersecurity as Realpolitik. The transcript of the talk can be found here and it’s an interesting read, since one Geer’s key points suggested that the US government should buy all available vulnerabilities, at ten times the price every other interested party would offer. He suggests this because it would be an extra incentive for people to get into the field and it would lead to very high transparency, because he suggests that all vulnerabilities should also be published. This would also devalue vulnerabilities and increase willingness to disclose them. It’s a radical suggestion that became a fertile grounds for a lot of discussion, including this elaborate answer by Bill Blunden.

In a less controversial talk, Nils and Jon Butler discussed the potential flaws of Mobile Point-of-Sale (mPOS) systems, featuring some pretty cool proof-of-concepts. The video of talk, as embedded below, is one of the few already available online for free and I’d recommend checking out the list on Black Hat’s official channel.

The Pwnie Awards

Another tradition that has established itself in the past couple of years at Black Hat are the Pwnie Awards. They’re a tongue-in-cheek award that seeks to recognize the feats the industry has accomplished this past year and it’s handed out for several categories. While not of giant educational value, it’s usually good for a couple of laughs, so I would not want to keep this information from our readers. First, here are the winners for best bugs and research:

• Best Server-Side Bug: Heartbleed
• Best Client-Side Bug: Google Chrome Arbitrary Memory Read-Write Vulnerability
• Best Privilege Escalation Bug: AFD.sys Dangling Pointer Vulnerability
• Most Innovative Research: RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis

On a more humorous note, AVG managed to win the award for “Lamest Vendor Response” by spectacularly claiming that various vulnerabilities identified by a third party are in fact by design.

Vendor Contact Timeline

The remaining awards in short form:

• Most Epic Fail: goto fail
• Most Epic 0wnage: Mt. Gox
• Best Song: The SSL Smiley Song

DEFCON 22

Last but not least, running for its 22nd year, DEFCON happened. Defying rumours claiming for it to be definitely and undeniably cancelled, the event happened at the Rio Convention center as it did in previous years. It is a significant problem to try and describe DEFCON in a couple of written sentences since there is so much to see, do and learn usually. For a general impression, I wholeheartedly recommend the DEFCON 20 documentary:

There is so much going on at DEFCON, it’s hard to point out specific points without missing out on a lot of others at the same time. But for example, the Blackphone, according to its vendor being the “the world’s first smartphone to put privacy and control ahead of everything else”, got rooted within five minutes because the application in charge for remote wipe had debugging enabled, so attaching a debugger would give a potentially unauthenticated user an instant system shell.

Another entertaining side-story happening at DEFCON was a person using the pseudonym ihuntpineapples to pursue people using Hak5’s WiFi Pineapple. The device used to launch attacks using wireless networks was sold at the event and people trying to set it up on location experienced an instant surprise:

Apparently, someone tried to teach people a lesson by using a 0day vulnerability on the device to compromise them when used at the local DEFCON network. To be fair, using any sort of non-hardened device (or any device at all, frankly) in the DEFCON network is usually a bad idea, but this got viral really quickly and became an amusing topic of discussion throughout the con, causing Hak5 to issue multiple firmware updates mitigating the vulnerabilities used to conduct the attack.

As DEFCON came to a close on Sunday, TheDarkTangent announced that this will be the last event to happen at the Rio. The 2015 DEFCON will happen in the Paris and in the Harrah’s, which should make for an interesting experience. Not only is this going to be the largest DEFCON to date, but it’s also going to be right in the middle of the strip, potentially causing a considerable lot more mayhem than at the slightly off-strip Rio.

That being said, we settle back into our normal everyday life, where you can actually use a WLAN with only a slight possibility of being viciously attacked. It’s pretty relaxing. But we will probably be back anyway.

About the Author

Stefan Friedli is a well-known face among the Infosec Community. As a speaker at international conferences, co-founder of the Penetration Testing Execution Standard (PTES) as well as a board member of the Swiss DEFCON groups chapters, he still contributes to push the community and the industry forward.

Links

• http://abad1dea.tumblr.com/post/66054805317/the-ssl-smiley-song-sing-it-with
• http://cryptome.org/2014/08/Respond-Geer.pdf
• http://geer.tinho.net/geer.blackhat.6viii14.txt
• http://hak5.org/
• http://hakshop.myshopify.com/products/wifi-pineapple
• http://http://www.securitybsides.com/w/page/76140479/BSidesLV%202014
• http://www.blackhat.com
• http://www.bsideslv.org/
• http://www.defcon.org
• http://www.irongeek.com/i.php?page=videos/bsideslasvegas2014/mainlist
• http://www.pwnies.com
• http://www.securityfocus.com/archive/1/532054
• http://www.tau.ac.il/~tromer/acoustic/
• https://twitter.com/banasidhe
• https://twitter.com/ihuntpineapples
• https://twitter.com/thedarktangent
• https://vuldb.com/?id.12370
• https://vuldb.com/?id.12633
• https://vuldb.com/?id.12819
• https://vuldb.com/?id.67016
• https://www.blackphone.ch/
• https://www.youtube.com/user/BlackHatOfficialYT
• https://www.youtube.com/watch?v=bKgf5PaBzyg