Black Hat USA
August 2-7, 2014
Mandalay Bay, Las Vegas, NV
Black Hat Europe
October 14-17, 2014
Amsterdam Rai, The Netherlands
6/18/2014
02:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
Connect Directly
RSS
E-Mail
50%
50%

Black Hat USA 2014: Embedded & Vulnerable

They're all around us, just waiting to be hacked. WiFi signals? Well, sure, but today we want to talk about embedded systems, the hackable internals in an ever-growing number of everyday devices.

Modern cars are hackable; this we know. Unfortunately, thus far research has only been presented on three or four particular vehicles. Since each manufacturer designs their fleets differently, analysis of remote threats must avoid generalities. A Survey of Remote Automotive Attack Surfaces takes a step back and examines the automotive network of many manufacturers from a security perspective. Now we can ask better questions: Are some cars more secure from remote compromise than others? And has automotive network security changed for the better over the last five years?

USB: The ubiquitous interface is a friend to everyone, at least when they can figure out which way to flip that darn connector. But ubiquity, of course, does not equal safety, which Karsten Nohl and Jakob Lell will prove with brutal aplomb in BadUSB - On Accessories that Turn Evil. They'll introduce a new form of malware that operates from controller chips inside USB devices. A full system compromise from USB? Sure. A self-replicating USB virus not detectable with current defenses? Why not. They'll wrap by diving into the USB stack, assessing where USB malware defense should set up shop.

Finally, in Breaking the Security of Physical Devices, Silvio Cesare will describe a series of attacks on objects ranging from a car to a baby monitor to home alarm systems. The common thread here is that all his attacks are simple but effective. He'll also show you how to mitigate them, a lot of which comes down to buying the right goods, thus avoiding their easily broken competitors.

One and a half months until the event... time to lock down your travel plans. Regular registration ends on July 26. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.