Black Hat video feed hacked
Connecting state and local government leaders
For a conference made up of professional hackers, you'd think they would ensure the security of the video feed. But at least one person managed to hack the Black Hat Briefings video, offered for $395 as an alternative for people who couldn't travel to the Las Vegas conference location.
For a conference made up of professional hackers, you'd think they would ensure the security of the video feed. But at least one person managed to hack the Black Hat Briefings video, offered for $395 as an alternative for people who couldn't travel to the Las Vegas conference location.
Michael Coates, who heads Web security for Mozilla, wrote a blog post about his experience:
"[D]uring registration I was quickly sidetracked by a few oddities in the design. Long story short, I identified a series of flaws that would enable the creation of an account with only providing an e-mail address (e.g. no name, address, phone etc) and I was never asked to enter any credit card data," he wrote. "Odd I thought, perhaps you enter the credit card info upon your first login. The only problem was that I didn't actually have a registration e-mail with a link to the login page. A few select Google searches and I ended up on a relatively vanilla looking login page. I have a username and a key, let's give it a shot. To my surprise the login was accepted and I was now sitting in front of the live Black Hat video stream."
However, Coates didn't take advantage of the flaw. True to the spirit of the Black Hat Briefings, he contacted Inxpo, the third-party video provider Black Hat was using, and reported it. "I sent over my notes on how to recreate the 'free' user,' he wrote. "I was assured that this information would go straight to their developers and was of the highest priority. They weren't kidding, within 4 hours the issue was fixed and deployed live."
Black Hat Director Jeff Moss, discussing the incident in an article in Network World, said working with outside providers is always a risk.
"I'm always nervous about those systems, because we don't get access to their source code and we can't review it," he said in that article. "We don't have time to write video streaming software, so we picked a vendor that we thought was good...apparently they'd never hosted a security stream before."
"Running any service for delegates to Black Hat and its companion conference Defcon are always fraught with difficulties," wrote John Leyden in The Register, a United Kingdom newspaper. "In the past, casino VoIP systems been hacked to make free calls, for example.
"The same has happened over the years with hotel TV services. Over the years improvements have been made to lock down systems.
Although venues wind up getting arguably the world's most effective penetration testing services in the process, it's difficult to think any organisation other than a Vegas hotel would put up with such hacker hijinks year after year."
NEXT STORY: Senator wants cybersecurity center at NIST