Black Hat 2016 began in scorching 105-degree weather, but after beautiful thunderstorms — ideally seen from the Comodo party at the iconic Ghost Bar — the weather turned sharply cooler, which made for a lovely, post conference stroll down the Las Vegas strip to DEF CON.
Once again, Black Hat offered a wealth of good talks and information. In his keynote, security researcher Dan Kaminsky, Chief Scientist of White Ops, explained that “this Internet” is not the only way things could have turned out, and that the Internet will continue to evolve, and not necessarily for the better. Based on years of fixing computer bugs, Kaminsky discussed how the Internet “really works”, and dissected numerous of its building blocks, often with the support of hilarious personal anecdotes. True to form, Dan explained that hackers have played, and will continue to play, an inherent and indispensable role in making the Internet work for all of us.
Among the technical talks, NCR’s Nir Valtman and Patrick Watson cracked chip and PIN technology on a point of sale (POS) device with a Raspberry Pi, swiping the name of the card owner, the card number, and its expiration date. Car hackers Charlie Miller and Chris Valasek, already notorious for compromising the security of a Jeep Cherokee — which led Fiat Chrysler to recall over a million vehicles — did it again, demonstrating that they could make a car speed up, turn sharply, and slam on its brakes. And Apple made a splash by using the conference to announce its new ‘bug bounty’ program in which Apple will pay researchers up to $200,000 to report vulnerabilities in its products.
My own talk covered the current state of cyber war, based on a book I recently published through NATO, Cyber War in Perspective. My Q&A session was even longer than the talk itself! I told Jeff Moss, Black Hat’s founder, that some of the concepts I presented were not so different from my Black Hat talk in 2005, Hacking in a Foreign Language: A Network Security Guide to Russia. My 2016 talk covered recent events in Ukraine. Here is a summary from the Guardian: “Cyberwar is not coming to the US – it’s already here”.
Followinng Black Hat, DEF CON got under way at the Paris Las Vegas. Its kickoff event was the DARPA Cyber Grand Challenge, the world’s first all-computer Capture the Flag (CTF) tournament, in which seven teams fought for almost $4 million in prize money. The world’s best reverse-engineering, vulnerability scanning, and bug patching skillz were on display in another Vegas first for information security. The hacking and scoring visualizations were Tron-like, and the winner, “Mayhem”, will play against human opponents in the upcoming, traditional DEF CON CTF.
In a side discussion, an Internet of Things researcher told me that, from a security perspective, everything he is currently evaluating is “swiss cheese”. And to make matters worse, in the future, the line between “cyber” and “physical” systems will be non-existent. On that note, we began brainstorming topics for next year’s Black Hat paper 🙂
Comodo had a great time participating in Black Hat for the first time. There was plenty of traffic at the booth, with attendees watching a Malware presentation as we downloaded Malware LIVE and watched as Comodo worked its magic at preventing it from infecting the laptop. We also had demos available featuring Endpoint, Boundary, Certificate Management and more! If you stopped by the booth at the right time, you were also able to see an interesting Black Hat vs. White Hat illusionist act. Clearly there was a lot going on at the Comodo booth this year! And we can’t wait to participate next year!
