Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:54 PM
Connect Directly

AT&T To Sponsor Zero-Day Contest For Kids

Second annual DefCon Kids highlights mobile app security, responsible disclosure, social engineering, and other topics aimed at teaching the ways of white-hat hacking

AT&T has joined forces with an 11-year-old hacker -- that's right, 11 -- and DefCon Kids in sponsoring a hacking contest during the second annual conference that runs in conjunction with the adult Def Con later this month in Las Vegas. Whoever finds the most zero-day bugs in mobile apps wins an iPad and $1,000, courtesy of DefCon Kids.

Inspiration for the competition came out of a new class of mobile vulnerabilities that the young hacker, who goes by "CyFi," reported last year to AT&T. After getting bored with her progress in one of her favorite mobile app games, CyFi discovered a so-called "time-travel" flaw in her mobile gaming app that let her move time ahead on the device so she could further progress in the game. That meant she didn't have to wait for things to happen in the game, for example. These bugs affect any app on any mobile tablet and smartphone operating system platform.

DefCon Kid CyFi Defcon Kids
Photo credit: Seth Rosenblatt, CNET. Courtesy of DefCon Kids.

AT&T helped CyFi notify all of the affected mobile app developers last year, but only a few have actually fixed the bug. DefCon Kids plans to run the hacking contest until most of the app developers finally fix the problem, which could be for some time given that most mobile app developers are not yet security-savvy. The first-place winner gets a new iPad and $1,000, and during the conference CyFi will name the apps that still contain the vulnerability -- details she has kept under wraps until now.

DefCon Kids, which launched last year for kids to learn about white-hat hacking during the grown-ups' Def Con conference, is featuring some big-name speakers again this year. Among its headliners are science-fiction author Cory Doctorow, hardware hacker (and Def Con badge creator) Joe Grand, Electronic Frontier Foundation lawyer Marcia Hoffman, and Wired editor-in-chief Chris Anderson. Aside from AT&T, other partners in the July 27 to 29 event at the Rio Hotel & Casino include the National Security Agency (NSA), the Defense Department, AllClear ID, HacKid, Max Kelly, and the EFF.

"It teaches them to hack for good and not for evil. It keeps the good name of the hacking world alive," says FS, a 17-year-old hacker who will speak at DefCon Kids again this year. FS, a high school student who gets hired for white-hat hacking gigs on the side, says DefCon Kids keeps kids out of trouble by showing them how white-hat hacking is "cool."

"It takes the coolest people in Def Con who teach them and show them how doing hacking in a good way is still cool and you can still be a bad-ass," says FS, who will do a presentation to the kids about Def Con's famous Wall of Sheep, where users who dare to jump unprotected onto the conference's WiFi network get publicly outed.

Christofer Hoff, a security expert who founded HacKid, says DefCon Kids schools youths to "do no harm," and if it's not yours and you don't have permission to break something, don't. Hoff says this year's conference is bigger and was retooled a bit to give the kids more time with speakers, as well as a few field trips and more interactivity so they get to move around a bit (but still within the confines of the conference).

Among the hot topics this year will be responsible disclosure, he says. "If you find things are wrong [with software, you will learn] how you deal with it and how to get it fixed and not just break it," says Hoff, who will bring along some of his daughters to DefCon Kids again this year.

Hoff's 9-year-old daughter, Cl0ver, is scheduled to deliver a talk at DefCon Kids with him, but so far, her topic remains a mystery. "She has yet to inform me," he says.

Sci-fi author Doctorow, who is also editor at BoingBoing, will have his 4-year-old daughter in tow at DefCon Kids to try her hand at a little lock-picking, one of the more popular activities for the kids. Doctorow will give a talk called "Hacking your School's Network," but it's not what you think: He says he wants to teach kids how many school systems' filtering applications are actually backfiring and not truly protecting kids.

"Everybody wants to just block the stuff. The problem is that doesn't solve the problem," Doctorow says. "There needs to be a systemic change in the way censor stuff works, not just for educational reasons, but also for privacy reasons."

Not only do kids find creative ways to get around their schools' censorware, but they can also inadvertently get themselves into privacy trouble, for example, by handing over information to proxies that have not been vetted, according to Doctorow. "You're then driving them from safe behaviors to unsafe behaviors," he says.

And many of the censorware providers also sell their technology to dictatorships nations that practice Internet censorship, such as China and Syria, he says. "Their secondary market is repackaging it for schools," he says.

Kid Schmooze
DefCon Kids this year also will hold its second Social Engineering Capture the Flag contest, a kid-friendly version of Def Con's wildly successful SE CTF. Chris Hadnagy, who heads up both social engineering events for Def Con, says he and his team have kicked it up a notch for this year's contest. "The biggest complaint from kids last year was it was too easy," Hadnagy says.

[ Client management billing platform WHMCS last week notified customers that hacker group UGNazi fooled its Web hosting firm into providing the hackers with administrative credentials. See Social Engineers Steal 500,000 Customers' Data From WHMCS. ]

"Without giving it away, the first set of ciphers will make the kids run around trying to find people and [execute certain tasks] to get their next clue. Once they do that, the next clues will be pieces" to more difficult challenges, Hadnagy says. The contest will encompass 20 kids divided into 10 teams, ranging in age from 7 to 16, he says.

And if the demographics are indicative of the future, the future looks bright for women in security: Half of last year's DefCon Kids' attendees were girls. Meanwhile, the organizers expect about 200 to 300 attendees for the kid con this year.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.