The running joke among seasoned Defcon attendees in Las Vegas every year is to steer clear of ATM machines at the Riviera Hotel, where hackers have known to place a booby-trapped ATM to prove their point that nothing is sacred when hackers are in the house (or worse). Then there's the Wall of Sheep "contest" at both Black Hat USA and Defcon to see who's either clueless or bold enough to jump onto the unsecured WiFi network at the shows. When they do, they get the dubious honor of getting their

The running joke among seasoned Defcon attendees in Las Vegas every year is to steer clear of ATM machines at the Riviera Hotel, where hackers have known to place a booby-trapped ATM to prove their point that nothing is sacred when hackers are in the house (or worse). Then there's the Wall of Sheep "contest" at both Black Hat USA and Defcon to see who's either clueless or bold enough to jump onto the unsecured WiFi network at the shows. When they do, they get the dubious honor of getting their usernames and partially redacted passwords blasted on the Wall of Sheep.But this year, a couple of incidents during the two hacker conferences served as an ominous warning and reminder of what the real black hat hackers can do, even to white hat hackers -- and why white hat hackers are compelled to do what they do.

First, there were the hacks of researcher Dan Kaminsky's and reformed black-hat hacker Kevin Mitnick's Websites on the eve of Black Hat. The hackers say they exploited the pair's insecure blogging and hosting services, as well as easily guessed their passwords, to grab personal email and Twitter feeds, and post them online -- with some nasty commentary about the two plus other noted players in the security industry. Kaminsky, who had been up much of the night before his Black Hat presentation dealing with the fallout, still joked during his presentation the next day about his own "weak" passwords. He later said the hack was nothing technically interesting.

Then there was the discovery by one of Kaminsky's former colleagues, Chris Paget, of a major ATM machine scam at the Rio Hotel during Defcon; the hack is currently under investigation by the U.S. Secret Service. Paget speculated it may have been an "inside job" or malware.

The Rio ATMs made the phony ATM found at the Riviera earlier in the week seem, well, almost quaint.

So while the Black Hat and Defcon hackers were having fun showing off all kinds of hacks in their presentations -- parking meters, X.509, SSL, IP video, low-tech Web scams -- the reality of what the bad guys can really do (and did) put a bit of a damper on all of the fun.

As one high-profile security expert said (paraphrased) about the Kaminsky/Mitnick hacks: "These guys take the fun out of it."

-- Kelly Jackson Higgins, Senior Editor, Dark Reading

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights