Black Hat USA 2010 and DEF CON 18 Wrap Up

by August 10, 2010 08/10/10

Black Hat USA 2010 and DEF CON 18 took place last week in Las Vegas. In order to really appreciate the magnitude of each conference proceedings, it is important to understand where each conference focuses its attention.

Black Hat is a security conference largely addressing all things computer and communications security. It is where industry comes together, describes attack vectors, and openly talks about malware, hackers, and threats to innocent systems and privacy. Black Hat is big business, both expensive to attend and sponsored by big name companies such as IBM and Adobe. If Black Hat were personified as a female actor, it is probably most analogous to an Angelina Jolie. Mostly prim and proper, strong reputation, easily discussed in polite conversation.

In sharp contrast is DEF CON, a conference in its 18th year. This year’s theme: 18 and barely legal. If that doesn’t set the tone for this conference, consider that DEF CON would be best personified as Lindsey Lohan- often drifting into illegal situations. DEF CON is an all-cash conference, no attendance records by design. It is where electronics and software gurus–hackers in proper parlance, meet for 3 days to discuss–and demonstrate–the unthinkable.

Highlights

The highlight of the entire week had to come from DEF CON. For approximately 20 minutes, the presenter “legally” became an AT&T cellular tower, hijacking all the cell phones that use the GSM cellular network. Lawyers were on hand, as were the local media, to witness the presentation entitled Practical Cellphone Spying, by Chris Paget.

The synopsis of the hour-long presentation is this: HAM operators are permitted access to portions of the 900MHz spectrum, so long as they announce their call sign on a regular basis and transmit at less than 100 watts. A portion of this spectrum overlaps with the GSM frequencies used here in the United States. Chris used a 25 milli-watt transmitter and OpenBTS (http://openbts.sourceforge.net/) to capture AT&T handsets, using a VOIP solution as a backhaul. Members of the audience were encouraged to make phone calls during the session. Randomly by design, some were connected through the VOIP backhaul, calls recorded in the process, while others were met with a devilish recording advising them that their call couldn’t be completed, and done in a way one would expect from a DEF CON presentation. Total investment with gear purchased from eBay: no more than $2000.

Most disconcerting to some was that during this presentation 911 services were not available to the GSM phones linked to Chris’ tower. The humorous understatement of the moment: if you burst into flames from the antenna radiation, be sure to find someone with a Verizon (CDMA) phone to dial 911 on your behalf.

Digital Security

The range of digital security discussions across both conferences was daunting. From instructions on how to hack millions of routers, devices that make the Internet a reality, to intricate instructions on how to jackpot ATM machines, my mind consistently wandered toward the same question at the end of virtually every session I attended: have the digital technologies that we’ve come to rely on forsaken us?

Black Hat brought in the biggest names, including Deputy Secretary Jane Holl Lute from the US Department of Homeland Security, and Gen (Ret.) Michael Hayden, former director of both the CIA and the NSA. Both speakers delivered more provocative questions than answers, asking the audience to consider how society has become enamored with technologic advances, ignoring the security ramifications that follow widespread adoption.

Nothing is Truly Secure

The Black Hat opening day keynote emcee succinctly stated the problem: nothing we have built is truly secure. Think about it this way–email, web browsers, digital hardware, including wireless access points, routers and firewalls, and even today’s mega-smart cell phones–none of them is truly secure. Nothing engineered to date is truly secure.   Why?!? Is security that hard to design? Why is encryption so often easily skirted with simple man-in-the-middle attacks? Does the rate at which we innovate preclude us from building secure systems? Are innovators so obsessed with innovation that security is an afterthought, if a thought at all? Or, is security simply beyond the grasp of human engineering? After all, security especially in recent years has been given an elevated status by the media.

What are the ramifications of our inability to build secure systems? The ramifications are disturbing. We often speak about the notion of privacy, but spend 8 consecutive days with hackers at these conferences and one can’t help but reach the conclusion that privacy is already a thing of the past.

Data Leaks Series Planned

Over the next several weeks, we’re going to embark on a journey here at ITS that takes a deep, critical look at the data leaks in your life. These are data leaks that you probably didn’t even know existed. We are going to look at how your car tire valve stems (not tread marks) can give away your daily routine, how WiFi as we know it is fundamentally broken and unsafe, how your computer or cell phone can easily be compromised by a determined hacker armed with an openly available rootkit, and how big business wants to force intrusive location based services (LBS) upon you in the name of profit margins.

The conclusion of the series is likely obvious to most–if you want true privacy, move to the backcountry and unplug everything that has a transistor in it. If that’s not an option, and if you want to better mitigate the digital risks imposed on life from technology, stayed tuned…


Are you getting more than 14¢ of value per day from ITS Tactical?

Please consider joining our Crew Leader Membership and our growing community of supporters.

At ITS Tactical we’re working hard every day to provide different methods, ideas and knowledge that could one day save your life. Instead of simply asking for your support with donations, we’ve developed a membership to allow our readers to support what we do and allow us to give you back something in return.

For less than 14¢ a day you can help contribute directly to our content, and join our growing community of supporters who have directly influenced what we’ve been able to accomplish and where we’re headed.

Click here to learn about all the benefits and Join!


Datajockeys
Datajockeys

Now is the time to think about going on that "Data Diet". If it is not important... DELETE IT! Less crap to manage.

5Solas
5Solas

This is a much-needed series and I look forward to it; hopefully I haven't already hemorrhaged all my information by the time it's completed!

Eric S
Eric S

We use the valve stem trick all the time. Should be a interesting series.

Mike Petrucci
Mike Petrucci

Whoa! What an amazing tease! You got me really excited about it and I thought it would be way over my head! I'm Really looking forward to the future articles. Great post!

Trackbacks

  1. [...] Black Hat USA 2010 and DEF CON 18 Wrap Up – It's Tactical [...]

The Latest
Squawk Box

We just received our Silver Play Button plaque from YouTube for surpassing 100,000 subscribers on our YouTube channel! A huge shout out to all of you that made this possible! It’s a major award and we’re extremely proud to hang this on our wall. Here’s to the next 100,000!

2 days ago
Leave a Comment