News
DEFCON 19 - 2011 – Overview of the Conference
August 2011 by Michael Hayes CTO of B-4-U Inc. / ROBOTS-4-U
DEFCON is one of the largest INFOSEC conferences in the U.S.A., with a twist or two or three. Some of the key differentiators of this conference are the client base, presenters and affordability. The clients are typically the individuals that work the key boards across organizations across the nation and in some cases the world. This organization is highly populated by volunteers; the presenters are generally security practitioners and are individuals, not corporations and the price for participation is $150.00 for three days of learning and experiencing mayhem.
Michael Hayes CTO of B-4-U Inc. / ROBOTS-4-U
These individuals typically have done research, or identified vulnerabilities at the micro and macro level. In many cases the presenters demonstrate their particular findings, during the presentations or show the weaknesses, that they have identified to the vendors.
There are approximately 150 individual seminars, which share and educate in this field of very young to veteran security participants. Additionally this year there are a number of all day work shops that can be used to sharpen the skills and develop new skills again a great bargain at $200.00, typically paid by mainly of these participants individually.
Of note this year, there is a track targeted to young kids up to 16, before you wrinkle your eye brow; think of this, question: Mom, Dad, what exactly do you do, and what the heck is a stack overflow, or a malformed packet. Well these sessions will allow the kids to understand their parents in the technical world that they live in. This audience tends to bring its growing kids who are immersed in technology.
What also is interesting is the range of presentations within the 150 or so offered in this program. The presentations span the realm from very technical issues, regarding specific products or technologies like IVRs, Data Bases (DB2 and Oracle), to discussions on protecting the Infrastructure like Smart grid and Wireless Water Meters. Other interesting topics, include the use of Offensive Cyber Attacks from a national perspective, to real tough attacks that are hitting major corporations and Taiwan specifically called APT ( Advanced Persistent Threats ).
Other presentations deal with specific sessions address issues like Credit Cards, “Chip and Pin is definitely broken” and hacking into corporations via VoIP or IVR. With these two and a number of others researchers can talk about first hand issues and vulnerabilities that impact technology that usually covers a number of sectors like Banking and Communications.
As a number of speakers have stated, this is not about an issue that is busting out all over today, but a vulnerability that is there today. The issue is when will somebody take advantage of this problem, and not if, and when will the vendors close this gap in security.
Some of the discussions dealt with compound documents like excel and imbedded objects, and this, in itself was very hard for current anti-virus programs to detect the embedded objects that are clearly nefarious. It also was a very good predictor, when this was mailed in a Social Engineering based Spear Phishing Attack, that this could be a pre-curser to APT.
In Summary, DEFCON 2011, and DEFCON in general is a program, which I would encourage security practitioners’ to become involved in. The learning opportunities are extensive and the quality of firsthand knowledge that can be shared is first rate. This is not about polish and glitz, but the front line impact of security, from the troops in the trenches.
Related articles:
