First, there were the hacks of researcher Dan Kaminsky's and reformed black-hat hacker Kevin Mitnick's Websites on the eve of Black Hat. The hackers say they exploited the pair's insecure blogging and hosting services, as well as easily guessed their passwords, to grab personal email and Twitter feeds, and post them online -- with some nasty commentary about the two plus other noted players in the security industry. Kaminsky, who had been up much of the night before his Black Hat presentation dealing with the fallout, still joked during his presentation the next day about his own "weak" passwords. He later said the hack was nothing technically interesting.
Then there was the discovery by one of Kaminsky's former colleagues, Chris Paget, of a major ATM machine scam at the Rio Hotel during Defcon; the hack is currently under investigation by the U.S. Secret Service. Paget speculated it may have been an "inside job" or malware.
The Rio ATMs made the phony ATM found at the Riviera earlier in the week seem, well, almost quaint.
So while the Black Hat and Defcon hackers were having fun showing off all kinds of hacks in their presentations -- parking meters, X.509, SSL, IP video, low-tech Web scams -- the reality of what the bad guys can really do (and did) put a bit of a damper on all of the fun.
As one high-profile security expert said (paraphrased) about the Kaminsky/Mitnick hacks: "These guys take the fun out of it."
-- Kelly Jackson Higgins, Senior Editor, Dark Reading