Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/7/2008
09:20 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Hackers to Face Off in Black Hat 'Iron Chef' Contest

Black hat stars don chefs' hats in hacking challenge

Two 'Iron Hackers' will have one hour to find as many vulnerabilities in a piece of mystery code as possible at Black Hat USA next month.

For the second year in a row, Fortify Software is hosting its own version of the wildly popular Food Network show “Iron Chef,” pitting fuzzing techniques against static-code analysis in the Iron Chef-style hacking contest. (See Hacking, Iron Chef Style.)

The two hackers who will face off in Vulnerability Stadium on Aug. 6 are Charlie Miller, principal analyst at Independent Security Evaluators, who will use fuzzing techniques to find vulnerabilities in the code; and Sean Fay, lead engineer for source code analysis at Fortify, who will show his stuff with static-code analysis techniques.

Miller was recruited for the hacking battle after nearly stealing the show last year. “Last year, this epic battle taking place wasn’t the battle we thought it was going to be -- it ended up being a battle between Iron Chef [session] and the session next door, with the iPhone vulnerability [found by] Charlie Miller. So we had to get some resolution this year,” quips Brian Chess, chief scientist at Fortify Software. “This year, Charlie Miller is taking up the cause of fuzzing."

Chess is keeping details about the open source code -- the “secret ingredient” -- close to the vest, but he did say it would be something that Miller would be comfortable with. “But we won’t be handing out iPhones,” Chess says.

One thing Fortify learned from last year’s competition was that actual exploits are more palatable to the security-celebrity judges and audience than theoretical vulnerability finds. “Showing something exploitable goes a long way to impressing people. They had their theoretical results, but what ended up carrying it were the exploits of some simpler stuff,” Chess says of last year’s contest. “Even if it’s not as wild as the theoretical stuff,” the judges were hungry for actionable exploits, he says.

The contestants bring their own machines and tools for the contest, and they don’t see the code until the contest begins. The audience is also able to compete simultaneously, and Chess and Jacob West, who heads up Fortify’s Security Research Group, will serve as emcees and provide live commentary and presentations on the techniques the Iron Hackers are deploying.

“It isn’t just one presentation… there are three or four going on,” Chess says.

“It’s controlled chaos,” West says.

And Iron Chef audience members who get the most vulnerabilities get a free dinner at one of Vegas’s hot new restaurants. Just don’t tell Miller or Fay: “Nothing but glory for the guys up on stage,” Chess says.

Fortify is also sponsoring another hacking competition during the week that could win you an iPhone. “We’re going to put up a Web app that will be vulnerable in a couple of ways we know about, and probably a couple we don’t know about,” Chess says. “The iPhone goes to whoever finds the most vulns in the application.”

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Fortify Software Inc. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Greater Focus on Privacy Pays Off for Firms
    Robert Lemos, Contributing Writer,  1/27/2020
    Average Ransomware Payments More Than Doubled in Q4 2019
    Jai Vijayan, Contributing Writer,  1/27/2020
    Emerging Long-Range WAN Networks Vulnerable to Hacking, Compromise
    Jai Vijayan, Contributing Writer,  1/28/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: Physical Security Privilege Escalation
    Current Issue
    IT 2020: A Look Ahead
    Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
    Flash Poll
    How Enterprises are Attacking the Cybersecurity Problem
    How Enterprises are Attacking the Cybersecurity Problem
    Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-3719
    PUBLISHED: 2020-01-29
    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
    CVE-2020-3758
    PUBLISHED: 2020-01-29
    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
    CVE-2020-8432
    PUBLISHED: 2020-01-29
    In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identifi...
    CVE-2020-3710
    PUBLISHED: 2020-01-29
    Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
    CVE-2020-3711
    PUBLISHED: 2020-01-29
    Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.