AT&T has joined forces with an 11-year-old hacker -- that's right, 11 -- and DefCon Kids in sponsoring a hacking contest during the second annual conference that runs in conjunction with the adult Def Con later this month in Las Vegas. Whoever finds the most zero-day bugs in mobile apps wins an iPad and $1,000, courtesy of DefCon Kids.

Inspiration for the competition came out of a new class of mobile vulnerabilities that the young hacker, who goes by "CyFi," reported last year to AT&T. After getting bored with her progress in one of her favorite mobile app games, CyFi discovered a so-called "time-travel" flaw in her mobile gaming app that let her move time ahead on the device so she could further progress in the game. That meant she didn't have to wait for things to happen in the game, for example. These bugs affect any app on any mobile tablet and smartphone operating system platform.

Defcon Kids
Photo credit: Seth Rosenblatt, CNET. Courtesy of DefCon Kids.

AT&T helped CyFi notify all of the affected mobile app developers last year, but only a few have actually fixed the bug. DefCon Kids plans to run the hacking contest until most of the app developers finally fix the problem, which could be for some time given that most mobile app developers are not yet security-savvy. The first-place winner gets a new iPad and $1,000, and during the conference CyFi will name the apps that still contain the vulnerability -- details she has kept under wraps until now.

DefCon Kids, which launched last year for kids to learn about white-hat hacking during the grown-ups' Def Con conference, is featuring some big-name speakers again this year. Among its headliners are science-fiction author Cory Doctorow, hardware hacker (and Def Con badge creator) Joe Grand, Electronic Frontier Foundation lawyer Marcia Hoffman, and Wired editor-in-chief Chris Anderson. Aside from AT&T, other partners in the July 27 to 29 event at the Rio Hotel & Casino include the National Security Agency (NSA), the Defense Department, AllClear ID, HacKid, Max Kelly, and the EFF.

"It teaches them to hack for good and not for evil. It keeps the good name of the hacking world alive," says FS, a 17-year-old hacker who will speak at DefCon Kids again this year. FS, a high school student who gets hired for white-hat hacking gigs on the side, says DefCon Kids keeps kids out of trouble by showing them how white-hat hacking is "cool."

"It takes the coolest people in Def Con who teach them and show them how doing hacking in a good way is still cool and you can still be a bad-ass," says FS, who will do a presentation to the kids about Def Con's famous Wall of Sheep, where users who dare to jump unprotected onto the conference's WiFi network get publicly outed.

Christofer Hoff, a security expert who founded HacKid, says DefCon Kids schools youths to "do no harm," and if it's not yours and you don't have permission to break something, don't. Hoff says this year's conference is bigger and was retooled a bit to give the kids more time with speakers, as well as a few field trips and more interactivity so they get to move around a bit (but still within the confines of the conference).

Among the hot topics this year will be responsible disclosure, he says. "If you find things are wrong [with software, you will learn] how you deal with it and how to get it fixed and not just break it," says Hoff, who will bring along some of his daughters to DefCon Kids again this year.

Hoff's 9-year-old daughter, Cl0ver, is scheduled to deliver a talk at DefCon Kids with him, but so far, her topic remains a mystery. "She has yet to inform me," he says.

Sci-fi author Doctorow, who is also editor at BoingBoing, will have his 4-year-old daughter in tow at DefCon Kids to try her hand at a little lock-picking, one of the more popular activities for the kids. Doctorow will give a talk called "Hacking your School's Network," but it's not what you think: He says he wants to teach kids how many school systems' filtering applications are actually backfiring and not truly protecting kids.

"Everybody wants to just block the stuff. The problem is that doesn't solve the problem," Doctorow says. "There needs to be a systemic change in the way censor stuff works, not just for educational reasons, but also for privacy reasons."

Not only do kids find creative ways to get around their schools' censorware, but they can also inadvertently get themselves into privacy trouble, for example, by handing over information to proxies that have not been vetted, according to Doctorow. "You're then driving them from safe behaviors to unsafe behaviors," he says.

And many of the censorware providers also sell their technology to dictatorships nations that practice Internet censorship, such as China and Syria, he says. "Their secondary market is repackaging it for schools," he says.

Kid Schmooze
DefCon Kids this year also will hold its second Social Engineering Capture the Flag contest, a kid-friendly version of Def Con's wildly successful SE CTF. Chris Hadnagy, who heads up both social engineering events for Def Con, says he and his team have kicked it up a notch for this year's contest. "The biggest complaint from kids last year was it was too easy," Hadnagy says.

[ Client management billing platform WHMCS last week notified customers that hacker group UGNazi fooled its Web hosting firm into providing the hackers with administrative credentials. See Social Engineers Steal 500,000 Customers' Data From WHMCS. ]

"Without giving it away, the first set of ciphers will make the kids run around trying to find people and [execute certain tasks] to get their next clue. Once they do that, the next clues will be pieces" to more difficult challenges, Hadnagy says. The contest will encompass 20 kids divided into 10 teams, ranging in age from 7 to 16, he says.

And if the demographics are indicative of the future, the future looks bright for women in security: Half of last year's DefCon Kids' attendees were girls. Meanwhile, the organizers expect about 200 to 300 attendees for the kid con this year.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.