Black Hat, DefCon Expose Flaws in Voting Machines to Smart Guns

The annual week of security conferences—the back-to-back Black Hat USA and DefCon events—colloquially referred to as “hacker summer camp” ran from July 22-30. The Black Hat show that was held at Mandalay Bay celebrated its 20th anniversary and was headlined by a keynote address from Facebook Chief Security Officer Alex Stamos. Perhaps the biggest single flaw detailed at Black Hat was the Broadpwn vulnerability that impacted hundreds of millions of iOS and Android devices. At the DefCon 25 conference, which was held at Caesar’s Palace, voting machines were hacked, as were internet of things (iOT) devices, cars, industrial control systems and even smart guns. In this slide show, eWEEK takes a look at some of the highlights of the 2017 Black Hat USA and DefCon conferences.

Jeff Moss, founder of both the Black Hat and DefCon security conferences, used the Black Hat keynote stage to reflect on the 20th anniversary of Black Hat. The Black Hat conference debuted five years after DefCon as a conference for security professionals, while DefCon is more of a hacker convention.

While a lot of media attention around security tends to deal with zero-day exploits, Alex Stamos, chief security officer at Facebook, said during his Black Hat keynote that the vast majority of security incidents involve various forms of everyday abuse and not zero-day vulnerabilities.

Hollywood actor Christian Slater, who has had multiple roles as a hacker in TV shows and film, was in an HP-sponsored booth taking pictures with attendees.

Google security researchers detailed how the ransomware payment chain works during a Black Hat session.

Exodus Intelligence security researcher Nitay Artenstein detailed the Broadpwn vulnerability in Broadcom WiFi chips that impacted all iOS and Android devices. Thanks to Artenstein’s responsible disclosure to the impacted vendors, the flaws were patched several weeks prior to the Black Hat presentation.

At DefCon 25, hackers were given the opportunity to legally attempt to attack voting machines, rapidly discovering multiple vulnerabilities in different voting machines.

The internet of things (IoT) village at the DefCon provided hackers with the opportunity to quite literally hack all the things.

U.S. Federal Trade Commissioner Terrell McSweeny explained the various actions the FTC has taken over the years to help protect consumers and privacy.

The Car Hacking Village at DefCon provided attendees with the opportunity to learn about and test various components of the modern car’s electronics systems.

The ICS Village at DefCon provided multiple resources and components to help attackers attempt to hack the security of industrial control systems (ICS).

As a nod to security paranoia, DefCon attendees were able to make their own tin foil hats.

Security researchers at DefCon disclosed the new Cabletap set of flaws. Cabletap is a set of 26 related vulnerabilities that impact wireless gateways and set-top boxes provided to consumers by internet service providers.

A security researcher known publicly only as “Plore” detailed a number of vulnerabilities in the Armatix iP1 smart gun. The vulnerabilities could enable a hacker to fire the weapon without the proper authority or to restrict the ability of a user to fire the weapon.

The Wall of Sheep at DefCon was able to catch many unsuspecting users of the open WiFi network that connected to services without proper encryption.

The Black Hat 2018 event is scheduled for Aug. 4-9, 2018.