Vulnerabilities / Threats
6/25/2013
02:19 PM
Connect Directly
RSS
E-Mail
50%
50%

Black Hat USA: T-Minus One Month And Counting

This highlighted trio of Briefings range widely in topic, yet they all sport that certain cool factor

Black Hat is well-regarded for the depth and breadth of its content, as well as the "cool s#!%" factor of its Briefings. Today's trio of highlighted Briefings are a fine example of both of these traits, ranging widely in topic yet all sporting that certain cool factor that'll keep you engaged even as you're poring over the finer points of electronic esoterica.

Click here for more of Dark Reading's Black Hat articles.

If popular heist films are anything to go by (and let's be honest, they're not), then security cameras seem pretty easily fooled. Surprisingly, this is one detail Hollywood actually gets mostly right because, sure enough, today's popular surveillance cameras sport a range of striking vulnerabilities, which Craig Heffner will blast through in "Exploiting Network Surveillance Cameras Like a Hollywood Hacker." Cameras from D-Link, Trendnet, Cisco, IQInvision, Alinking, and 3SVision are all vulnerable. Come join Heffner for not only a proof-of-concept of a Hollywood-style freeze-and-modify attack, but also the debut of multiple 0-day exploits.

RFID is everywhere these days, from door locks to the badge you'll wear at Black Hat. Video game and movie producers should catch this talk, too: "RFID Hacking: Live Free or RFID Hard" should be your first stop for practical info on how RFID proximity badge systems actually work. You'll learn how to build your own RFID physical pen-test toolkit, how to weaponize commercial badge readers, and how to defend yourself from others' RFID-hacking efforts. The Briefing will be packed with demos, and 100 lucky attendees will receive a PCB that can make almost any commercial RFID reader steal badge info from up to three feet away.

Detecting mobile malware poses unique problems because the typical antivirus paradigm used in larger systems becomes impractical when saddled with the battery and CPU realities of typical handsets. Firmware OTA patches, cloud-based screening, and hardware security support all have notable drawbacks. In "Mobile Malware: Why the traditional AV paradigm is doomed, and how to use physics to detect undesirable routines," Markus Jakobsson will delve into the nitty-gritty of software-based attestation, which relies on the physics of the device (its bus speed, for example) to detect undesirable routines. It, too, has some drawbacks, but it may just be the best approach for mobile device anti-malware.

Another good use of physics, incidentally, is to carry airplanes through the air, such as when Black Hat attendees travel to Las Vegas. We're just about one month out now, so be sure all the numbers on your travel reservations add up to July 27-Aug. 1. Speaking of travel, the room block at Caesars is sold out, but Black Hat has negotiated additional blocks of discount rooms at Bellagio and Flamingo -- hotel details can be found here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.