Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:54 PM
Connect Directly

AT&T To Sponsor Zero-Day Contest For Kids

Second annual DefCon Kids highlights mobile app security, responsible disclosure, social engineering, and other topics aimed at teaching the ways of white-hat hacking

AT&T has joined forces with an 11-year-old hacker -- that's right, 11 -- and DefCon Kids in sponsoring a hacking contest during the second annual conference that runs in conjunction with the adult Def Con later this month in Las Vegas. Whoever finds the most zero-day bugs in mobile apps wins an iPad and $1,000, courtesy of DefCon Kids.

Inspiration for the competition came out of a new class of mobile vulnerabilities that the young hacker, who goes by "CyFi," reported last year to AT&T. After getting bored with her progress in one of her favorite mobile app games, CyFi discovered a so-called "time-travel" flaw in her mobile gaming app that let her move time ahead on the device so she could further progress in the game. That meant she didn't have to wait for things to happen in the game, for example. These bugs affect any app on any mobile tablet and smartphone operating system platform.

DefCon Kid CyFi Defcon Kids
Photo credit: Seth Rosenblatt, CNET. Courtesy of DefCon Kids.

AT&T helped CyFi notify all of the affected mobile app developers last year, but only a few have actually fixed the bug. DefCon Kids plans to run the hacking contest until most of the app developers finally fix the problem, which could be for some time given that most mobile app developers are not yet security-savvy. The first-place winner gets a new iPad and $1,000, and during the conference CyFi will name the apps that still contain the vulnerability -- details she has kept under wraps until now.

DefCon Kids, which launched last year for kids to learn about white-hat hacking during the grown-ups' Def Con conference, is featuring some big-name speakers again this year. Among its headliners are science-fiction author Cory Doctorow, hardware hacker (and Def Con badge creator) Joe Grand, Electronic Frontier Foundation lawyer Marcia Hoffman, and Wired editor-in-chief Chris Anderson. Aside from AT&T, other partners in the July 27 to 29 event at the Rio Hotel & Casino include the National Security Agency (NSA), the Defense Department, AllClear ID, HacKid, Max Kelly, and the EFF.

"It teaches them to hack for good and not for evil. It keeps the good name of the hacking world alive," says FS, a 17-year-old hacker who will speak at DefCon Kids again this year. FS, a high school student who gets hired for white-hat hacking gigs on the side, says DefCon Kids keeps kids out of trouble by showing them how white-hat hacking is "cool."

"It takes the coolest people in Def Con who teach them and show them how doing hacking in a good way is still cool and you can still be a bad-ass," says FS, who will do a presentation to the kids about Def Con's famous Wall of Sheep, where users who dare to jump unprotected onto the conference's WiFi network get publicly outed.

Christofer Hoff, a security expert who founded HacKid, says DefCon Kids schools youths to "do no harm," and if it's not yours and you don't have permission to break something, don't. Hoff says this year's conference is bigger and was retooled a bit to give the kids more time with speakers, as well as a few field trips and more interactivity so they get to move around a bit (but still within the confines of the conference).

Among the hot topics this year will be responsible disclosure, he says. "If you find things are wrong [with software, you will learn] how you deal with it and how to get it fixed and not just break it," says Hoff, who will bring along some of his daughters to DefCon Kids again this year.

Hoff's 9-year-old daughter, Cl0ver, is scheduled to deliver a talk at DefCon Kids with him, but so far, her topic remains a mystery. "She has yet to inform me," he says.

Sci-fi author Doctorow, who is also editor at BoingBoing, will have his 4-year-old daughter in tow at DefCon Kids to try her hand at a little lock-picking, one of the more popular activities for the kids. Doctorow will give a talk called "Hacking your School's Network," but it's not what you think: He says he wants to teach kids how many school systems' filtering applications are actually backfiring and not truly protecting kids.

"Everybody wants to just block the stuff. The problem is that doesn't solve the problem," Doctorow says. "There needs to be a systemic change in the way censor stuff works, not just for educational reasons, but also for privacy reasons."

Not only do kids find creative ways to get around their schools' censorware, but they can also inadvertently get themselves into privacy trouble, for example, by handing over information to proxies that have not been vetted, according to Doctorow. "You're then driving them from safe behaviors to unsafe behaviors," he says.

And many of the censorware providers also sell their technology to dictatorships nations that practice Internet censorship, such as China and Syria, he says. "Their secondary market is repackaging it for schools," he says.

Kid Schmooze
DefCon Kids this year also will hold its second Social Engineering Capture the Flag contest, a kid-friendly version of Def Con's wildly successful SE CTF. Chris Hadnagy, who heads up both social engineering events for Def Con, says he and his team have kicked it up a notch for this year's contest. "The biggest complaint from kids last year was it was too easy," Hadnagy says.

[ Client management billing platform WHMCS last week notified customers that hacker group UGNazi fooled its Web hosting firm into providing the hackers with administrative credentials. See Social Engineers Steal 500,000 Customers' Data From WHMCS. ]

"Without giving it away, the first set of ciphers will make the kids run around trying to find people and [execute certain tasks] to get their next clue. Once they do that, the next clues will be pieces" to more difficult challenges, Hadnagy says. The contest will encompass 20 kids divided into 10 teams, ranging in age from 7 to 16, he says.

And if the demographics are indicative of the future, the future looks bright for women in security: Half of last year's DefCon Kids' attendees were girls. Meanwhile, the organizers expect about 200 to 300 attendees for the kid con this year.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-10
Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.
PUBLISHED: 2019-12-10
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitra...
PUBLISHED: 2019-12-10
A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to that could cause systems to experience a blue screen error. Lenovo Energy Management is a client utility. Lenovo XClarity Energy Manager is not affected.
PUBLISHED: 2019-12-10
A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to leading to a buffer overflow which could cause a denial of service.
PUBLISHED: 2019-12-10
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.