Slashdot Log In
Reporters At Black Hat Get Bounced For Hacking
Posted by
Soulskill
on Fri Aug 08, 2008 08:56 PM
from the no-brownie-points-for-you dept.
from the no-brownie-points-for-you dept.
rickb928 and several others have written to inform us that three reporters for the French publication "Global Security Magazine" were booted out of the Black Hat convention for uncovering the login information of other reporters. Quoting the AP:
"The separate, wired Internet connections set up for reporters are supposed to be off-limits to hacking and the Wall of Sheep. Even so reporters who didn't take the extra step and log onto the Internet through an additional secure connection like a virtual private network, risked having their data exposed to colleagues sitting just feet away. It didn't appear to be a complicated hack. The network was working properly, but it wasn't set up to shield each journalist's computer from one another."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not Surprised (Score:3, Insightful)
Really, I'm not surprised at all that people were kicked out of The Black Hat "Hacker" Conference for hacking.
Just shows that Corporate sponsored Hacker conferences are a contradiction in terms
Re:Not Surprised (Score:5, Funny)
Parent
Re:Not Surprised (Score:4, Informative)
Organizers said the trio was caught when they took their purloined password prizes to Wall of Sheep workers and asked them to post the information. The workers refused.
So...they turned themselves in.
Parent
To prove a point (Score:5, Insightful)
That the wired lan was not secure.
The reporters that allowed their login/passwords
to be sniffed should be the ones exposed on the Wall of Sheep.
Talk about being led into a false sense of security.
They *knew* the Wireless was not secure.
But to *ASSUME* the wired LAN was to be trusted
clearly shows their ignorance of security.
The reporter that exposed the problem should not
be booted from future conferences, he should be
welcomed back!
Parent
Re: (Score:3, Interesting)
They were lucky their account info were only stolen for "fun", I doubt anyone else would have had the decency to tell them they had been compromised.
I will side with the people who think that if you attend a "black hat" conference and dare use a) a computer that you don't own, b) on a network that you don't know, c) to access unencrypted private information, you are fair game.
IMHO:
1/ The journalists that were "hacked" do
Re:Not Surprised (Score:5, Funny)
The offending journalist was caught when, after stealing the passwords, he stood up and shouted "Yes, I am invincible!" with a bad russian accent.
Parent
Reminds me of a demoparty I once attended.. (Score:3, Funny)
where at one point all of a sudden some guy a few rows in front of me shouts out "I was blind but now I can see!" on of those moments only a coder can truely appreciate I guess :)
Did they forget there role? (Score:4, Funny)
Re: (Score:3, Insightful)
So basically the french got kicked not for hacking but for being a bunch of scriptkiddies that wanted to demonstrate they could "hack" a network known to be badly secured. Rightly so. These journalists wouldn't have been able to report on the real hacks; they wouldn't understand them.
Re:Did they forget there role? (Score:5, Insightful)
You'd think the organizers of the Black Hat convention could properly secure a wired network.
Which they did. They just didn't secure it from the other journalists.
Consider that it is actually impossible to do so, and allow journalists to bring their own laptops. The best you can do is secure a network, not secure the computers on the network, without insisting on admining each such computer -- think Mordac [wikipedia.org]-style.
I'd lay the blame with the Black Hat organizers.
For kicking them? Maybe.
But for allowing it to happen? Not so much.
Parent
Re: (Score:2, Informative)
What are you talking about. You are completely wrong. The organizers could have done much more.
By properly laying the wiring, they could ensure that you could not set-up such a passive filter. Each group of journalists could have had their own separate connection to a properly configured router - that way, if you wanted to snoop on another journalists traffic, you would have to walk over to their table and jack into their Ethernet connectors, which is significantly mitigates the severity of the problem.
A
Re:Did they forget there role? (Score:5, Insightful)
Each group of journalists could have had their own separate connection to a properly configured router
Implying they could attack each other, still.
Another thing - there's any number of industry-standard authentication & encryption systems out there. IPSEC, 802.1X, Radius, etc.
And if someone didn't even bother to use SSL, what makes you think they'll set all these up on their own computer?
The organizers were just lazy...
For what? Not mandating every journalist use a known-good computer? For not blocking port 80 in favor of 443? For allowing these people on the Internet at all?
Tell me -- given that it's impossible to idiot-proof a single computer, how are you proposing that they idiot-proof an entire network of humans -- humans who can and will make mistakes?
Parent
Re: (Score:2)
Re: (Score:2)
The way I understand it the network itself was not secure rather than the computer's the journalists using being insecure. If any computer on the network can intercept traffic going through the network then generally that is a problem.
Re: (Score:2)
It is almost always possible to do this -- defeating switches is as easy as ARP flooding.
Sniffing packets isn't rocket science.
Setting up per-machine VLANs would've been overkill and required per-machine VLAN tagging.
Re:Did they forget there role? (Score:4, Funny)
Parent
I guess (Score:5, Interesting)
nobody plays Uplink [introversion.co.uk] enough these days.
Re: (Score:3, Insightful)
Don't forget Dark Signs [darksigns.com] either.
comma, duh (Score:3, Funny)
Even so people who post stories to Slashdot, should learn to use commas.
It's happened at Usenix (Score:4, Interesting)
One Usenix there was an announcement that everyone who had used Kerberos to log in from the terminal room needed to set up new keys. Another finished with a paper on what someone had sniffed on the Wifi LAN.
So it's no bloody surprise it's happened at Black Hat. Not that the guys who did it were justified, and they're lucky they were just booted out, but anyone who doesn't use encrypted VPNs or encrypted tunnels at ANY technical conference is asking for trouble.
Re: (Score:2)
For the sake fo changing the car analogy, think of a firing range. When you go there, you are specifically told you shoot in a particular area, and told NOT to shoot wildly at will. Going to a firing range doesn't mean you are more exposed to bullets IF people follow the instructions. I shouldn't be required to wear high impact body armor, just because "going to a firing range without body armor i
When in Rome... (Score:2, Funny)
... hack like Romans hack!
Seriously, these reporters, they were told where they were going and what they were reporting on, right?
Two people... (Score:5, Interesting)
... are seated in a noisy restaurant, yelling back and forth to each other from one side of the table to the other. I'm sitting 3 tables away and can hear them.
Am I hacking??
Re:Two people... (Score:5, Funny)
Yes.
Die, Hacker!
Parent
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
I disagree. If you yell username and password pairs along with hosts that they work with across a room, that conversation is what we call unprotected. Like there is freedom of speech, there is also freedom to listen. If you're going to broadcast your conversation, without first taking steps to protect that conversation, that conversation is open game to all and sundry. Same with broadcast tv. Brits might disagree with their odd television licensing, but here in the States, we don't need a license to receive
This gives a new meaning too... (Score:2)
"You're not a journalist! You're a hack!"
I know, shoot me.
Many low cost switches... (Score:3, Insightful)
Re:Many low cost switches... (Score:5, Interesting)
We're all taught in network design class that a switch unlike a hub doesn't send traffic that's not yours to you, then learn in security class that it's easy to turn a switch into a hub.
Parent
Re:Many low cost switches... (Score:5, Interesting)
I don't understand this very well, so someone who does please chime in.
Switches use your ethernet card's MAC address (not IP) to know how to route ethernet frames on across the switch. It knows that MAC AB:CD:EF:etc is on port 1, and 12:34:56:etc is on port 2. Because you can daisy chain switches, it actually has to remember a many MACs to 1 port sort of mapping.
Switches can only remember a finite number of MAC addresses, so if you overflow the memory of the switch with bogus MAC addresses, it fails over to hub mode and just broadcasts all the packets to all the ports. It's not pretty, and would cause the network to get slower, but at least it would continue to work.
As I can't see hubs being used at a Black Hat conference, I'd guess this is the sort of thing the reporters did. I'm sure there's a name for it... probably "ARP Cache Smashing" or something, but I don't know it.
Anyway, if someone can give a better explanation, I'd be grateful.
Parent
Re:Many low cost switches... (Score:5, Informative)
"ARP poisioning" is what it's called, and your explaination sums it up pretty well. If the other side of a port is claiming to have enough MAC addresses reachable by it the cache will fill and the switch will start over with a blank cache which renders it into a hub until it learns what's really where, then gets poisioned again, rinse, wash, repeat.
Dumb switches will fall for this trick and have no way for anybody to notice, smarter switches will log this and let the admin know there's more than one MAC address being reported on a port... you just trace to who's on the other end of the report and you've busted them.
Parent
Re: (Score:3, Informative)
Far easier than overflowing the memory.
Just look for the other computer's MACs and then tell the switch that they are on your port.
You then send a copy of their data to them.
Re: (Score:2)
are really only switched between different speed segments. I.e., they might bridge (switch) between a 10 mb segment and a 100 mb segment, but they're only repeaters (hubs) on each.
I think there's a good chance those guys know about ARP poisoning [sourceforge.net].
Re: (Score:2)
Many low-cost switches are simple layer 2 switching bridges, devices that pass packets from one interface to another, electrically segmenting a network into collision domains. If the network had stayed wired with nothing but switches, there wouldn't have been an issue. Let me guess, someone thought some hubs would be a good idea. Congratulations, epic fail.
Re:Many low cost switches... (Score:5, Funny)
If only their were experts who knew the specification of network switches and how not to expose users to casual snooping, then we could set up a conference where such people get together to share their knowledge of these type of vulnerabilities.
Parent
Re:Switches are not expensive (Score:5, Informative)
Are they using a hub for wired connections at a security conference? Seems like the most plausible explanation for a simple "hack" like this with the network "working correctly"...
It's a common misconception that switches prevent snooping. Switches are *not* security devices, they are an performance optimization. As such, they mostly "fail open".
If you flood the switch with many different MAC addresses, such that its internal ethernet routing table fills up, it will usually simply direct *all* traffic to your port, rather than potentially incorrectly dropping some traffic you should have received.
And then you can snoop to your heart's content, with nobody else the wiser.
Parent
Re: (Score:2)
Sure... (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2, Funny)
I wonder what lucky guy is overpaying you for network administration.
Re: (Score:3, Informative)
wrong:
http://www.blackhat.com/html/bh-usa-08/wallofsheep.html
Re: (Score:2)
Re: (Score:2)
Finally, someone gets it.
sheesh. /. used to be quicker than this...
Re: (Score:2)
Re: (Score:2, Funny)
Journalists ARE hacks... right?
http://en.wikipedia.org/wiki/Hack_writer [wikipedia.org]
Come on now. If you are reporting the black hat conference, what better way to show you know what you're reporting on than to hack?
Personally, despite any failure on the part of the organizers, I think it admirable that they did a 'little' hacking. Perhaps we can get a new "meme that is never spoken"(TM) like male sportscasters all have stupid ties and bad hair and female sportscasters are Playboy bunny wouldhavebeens. Hacking conference
Re: (Score:2)
What's next? Hackers that write articl... oh, nevermind.
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Just start reading at the second post and do not reply to fist posts, not that hard.. Also The frosty pist at the top of the page tells you your are really on /. and that your DNS has not been hacked and redirected you to some fake ./ site.
Re: (Score:3, Informative)
Computer misuse is illegal, yes, but not under the DMCA.