Black Hat founder Jeff Moss (also known as Dark Tangent) shared a bit of history in his welcome speech for the 2011 Black Hat briefings. The Defcon (short for defense readiness condition) system was devised by the Joint Chiefs of Staff back in Cold War days to codify military response for threats to national security. A gathering of hackers took the name Defcon in 1993, and the event now draws as many as 10,000 attendees. After the first few Defcons, a friend suggested to Moss that he should invite a wider audience and "charge a bundle". That's how Black Hat began.
Briefing Sessions
Over 8,000 people attended the briefings, which covered a wide range of hacking and security topics. Some talks introduced new security initiatives. For example, IEEE representatives revealed a new "taggant" system designed to keep malware writers from hiding their handiwork with packer tools. Microsoft introduced what they call the Blue Hat Prize, a $200,000 prize for innovation in security that will be presented at next year's Black Hat briefings.
Other presenters reported on security problems discovered in their research. Reversing Labs demonstrated dozens of inherent security weaknesses in the executable file format used in Windows, Xbox, and other platforms. In a talk titled "Sophail", vulnerability researcher Tavis Ormandy reported on problems he found by reverse-engineering the Enterprise-focused Sophos Antivirus. Sophos clarified a few points in a blog post and thanked Ormandy for helping "make our products stronger and more secure."
The most hard-core hacking sessions generally occur at Defcon, but Black Hat did have its own share of sessions demonstrating hacks. Adam Laurie (also known as Major Malfunction) and Zac Franken of Aperture Labs gave an on-stage demonstration using a Square credit-card reader to skim credit card data. A pair of consultants showed off a surplus Army drone plane refitted for aerial WiFi infiltration and more.
News and Awards
During the conference McAfee reported on a massive five-year hack discovered by their research. Nicknamed "Operation Shady Rat", this operation infiltrated many significant sites including the U.S. government and the U.N., among others. Researchers from Carnegie Mellon showcased a proprietary app that can identify complete strangers using only a photo—bad news for those concerned about Facebook security.
On a lighter note, the annual Pwnie awards both roasted security failures and recognized excellence in security research and hacking. RSA Security took the no-prize for Lamest Vendor Response based on this spring's RSA SecurID Hack. Sony earned the Pwnie for Most Epic Fail—not surprising, since each of the five nominations named a different Sony failure.
As the briefings wound down, many attendees made ready to head for Defcon with their kids. That's right; this year's conference introduced a Defcon Kids track. One ten-year-old Girl Scout wowed her audience with an exploit to speed up the action in farming games. Tweets from hacktivists LulzSec and th3j35t3r suggested both were present ad Defcon, though this wasn't confirmed. I spotted Barack Obama in the hall (at least that's what his Black Hat badge said). Those attending Defcon value their privacy so much that Defcon badges (image here) don't include names.