4 ms·

DEF CON: The event that scares hackers

196 points by alexmr 15y ago

swombat 15y ago
A surprisingly well-written tech article for a source like CNN: clear to non-technical people, and yet not chock full of gross inaccuracies. Mainstream journalists have gotten me used to much lower quality.
- SwellJoe 15y ago
  This is especially true when security is involved.
- awayand 15y ago
  ...except for this maybe: "Other DEF CON veterans said they purchase junk computers they can throw away after the convention because they figure they're going to get infected."
- djcapelis 15y ago
  It sounds like maybe you haven't been to Defcon. This article wasn't much better than an article about burning man would be if someone wrote one that focused on the fact that it was in the desert and didn't bother mentioning anything about the artwork or the other things that happen when a community of interesting people spend time together. Defcon isn't about being scared. It's about blood drives, teaching anyone interested how to solder and I think this year it was about the new Defcon kids event that included a 10 year old speaker teaching others about her game hacking techniques. Defcon makes me feel better about the world most years.
munin 15y ago
everyone freaks out because "oh man your computer will get hacked in N seconds on the defcon wifi". lets dissect this a little bit. if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET. and also this is the one time of the year when i'm ready for this. every other day of the year i go to the coffee shop i don't know anything about the other randoms there but i assume they're drifting office droids hacking on their excel macros or recruiters cruising linkedin in between meetings. so, if someone exploits me on the defcon wifi ... where else will that exploit work? everywhere, probably! it's probably a super awesome exploit that has super awesome properties that targets super popular software and is also unpatched. someone owns my openssh 5.3 on my laptop on the defcon wifi ... if i pcap that ... i'm a rich man. i can own boxes like mine. so ... as a hypothetical attacker, why would i do this? i'm surrounded by people like me. they're alert. they're cautious. and they are the most capable people in the world to detect what i am doing and reveal it to everyone. oh and there are a whole bunch of law enforcement people there too, AND the entire thing happens in a casino which has heavy security and is already wired for sound and audio everywhere you go. ... anyone who is smart enough to be able to own your box at defcon, is also going to be smart enough to realize that they might as well wait until the week after when you're sitting at a coffee shop.
- Pewpewarrows 15y ago
  If you're blackhat, sure. But I'd venture to guess that a good portion, as greyhats, are there to do just what this article suggests: raise awareness of new potential threats, claim bragging rights, and improve security for all.
  - munin 15y ago
    by owning random boxes on the wifi? no, "claiming bragging rights" is what onstage demos are for :P
- nookiemonster 15y ago
  Defcon is cheap to attend. You should go sometime and get a feel for the event. If a trip to Vegas is out of your price range, go check visit Hot Topic. You'll get the proper feel. The Defcon crowd is awfully touristy. I mean that professionally. In fact, it's far more the marketing success of defcon that should get attention from hacker news. They have been building quite an empire over the last 19 years.
- matthew-wegner 15y ago
  I don't think it's your computer joining the network that's the issue; the network itself is likely tainted. By extreme example, a rogue cell tower was demonstrated last year which monitored outgoing SMS messages. Your phone would automatically join it because its signal strength was greater and it had all required information. The issue with Defcon Wi-Fi is that you should assume all outbound traffic is captured. Are you sure your mail notifier, Dropbox client, IM client, etc, aren't sending credentials or some kind that can be (at least temporarily) exploited?
  - munin 15y ago
    yes. i'd have big problems on any other network i'd join if i wasn't sure, wouldn't i?
    - dlss 15y ago
Pewpewarrows 15y ago
If you value your sanity, I'd suggest steering clear of the comments on this article. Although I guess you could say that for comments on most article on CNN.
- hugh3 15y ago
  Although I guess you could say that for comments on most article on CNN. I would say that for most comments on the internet.
  - num1 15y ago
    If I ever have a site which posts content, or if I ever finally make a blog, the first thing I will do is turn off the comments. If you want to talk to me, you can email me, or write your own post in response.
swah 15y ago
I'd love to know the OS usage stats here and how they differ from HN.
- drivebyacct2 15y ago
  I'd bet there are more Mac users on HN than there are at DEF CON.
  - swah 15y ago
    There could also be more Windows users if they agree with the line of thinking that says you should run the same system as your targets.
    - mahmud 15y ago
      Virtualization.
- jedberg 15y ago
  Walking around the CTF room, it looked to be about 1/2 Mac and 1/2 non-mac, with about 1/2 of the non-macs running some unix variant (assuming people aren't running linux with a windows looking window manager or vice versa).
overshard 15y ago
I'm pretty sure any hacker worth his weight in microchips doesn't have a problem. I've been to def con and always take a *nix system with a solid firewall and a way to ssh/vpn home to do all my logging into websites from. DEF CON doesn't scare hackers. It gives us a chance to see if our setups are actually secure and if we get pwnd we deserved it and learn from the experience.
- rdl 15y ago
  I stick to VPN over 3G / 4G just because it would be embarrassing to get hacked.
X-Istence 15y ago
The DefCon wireless is nowhere near as scary as people make it out to be. Making people believe that something is scary is part of the fun of it for those of us that help run the con. Currently at con, on my laptop with OpenVPN and tethered to my phone because the DefCon wireless is overloaded and not handing out an IP address.
- beagledude 15y ago
  I just uploaded your docs folder to pastebin #sorrybro http://pastebin.com/MH0KYGTi http://pastebin.com/MH0KYGTi
- ddol 15y ago
  Damn sorry I'm missing it this year, but I'd be useless for a sold 2 days after it. I can't remember using the internet much at DEFCON. It was pretty solid partying. Now CCC, that's a different story...
  - mahcuz 15y ago
    Solid, dude.
jwatzman 15y ago
One of the most insightful points in the article, summing up much of DEF CON, got buried near the end of the article; it's worth emphasizing: It's not about breaking the lock [...] it's about learning the lock can be broken.
- marshray 15y ago
  For me, breaking the lock is fun too though.
Groxx 15y ago
Wow, that's impressively well-written. And it's about computer security. And it's about hackers, who are hacking. That's like a perfect storm of news-writer fail, and they did a pretty good job through it all. I love that they included this quote, it sums up security very very very well: >It's not about breaking the lock, he said, it's about learning the lock can be broken. I've found ways to open most combination locks in a second or two, without even looking suspicious. It's easier than entering the combination, usually. Those $20k-insured round-keyed laptop locks? Takes about 30 seconds on average, 5 or less if you're lucky. My dad lost a $20 bet with me on that, with the one his employer supplied (and expected him to use) - it took me 5 minutes on the first attempt, and less than a minute each time after that. Security isn't about stopping people from breaking in. It's about not being the low-hanging fruit.
ck2 15y ago
That memo of things to do/not do, is a great list for everywhere 24/7, not just def con. If you can be hacked there, you can be hacked anywhere, and some damage cannot be recovered from (ie. losing google account).
DeanCollinsLCC 15y ago
Bury your room key...-why LV hotels dont use RFID for room keys. Scan your credit card remotely - not if they are mag stripe. FUD articles like this is why people dont know to use VPN or HTTPS, what a waste of CNN's money sending him there for this - sorry but it has to be said could have been a much better more accurate article covering actual security issues.
zackattack 15y ago
I'm in Vegas. Anyone have an extra badge they wanna sell me? I wanna stop by tomorrow. #meetup
- steveeq1 15y ago
  They ran out of neck holder things for the badges so a lot of people aren't wearing them. As a result, they're not really looking for badges. My friend went around (saturday) and he was able to get in even though he didn't pay.
djcapelis 15y ago
Defcon is much more like a family reunion than a scary thing. This year hundreds of hackers literally opened their veins to give blood in honor of one of our own who needed it. The hacking of other attendees that goes on has more of a prank feel to it (much like a lot of the con!) than a scary thing. It's just a bunch of people getting together to talk, do interesting things and/or get drunk together.

196 points by alexmr 15y ago

A surprisingly well-written tech article for a source like CNN: clear to non-technical people, and yet not chock full of gross inaccuracies. Mainstream journalists have gotten me used to much lower quality.

SwellJoe 15y ago
This is especially true when security is involved.
awayand 15y ago
...except for this maybe: "Other DEF CON veterans said they purchase junk computers they can throw away after the convention because they figure they're going to get infected."
djcapelis 15y ago
It sounds like maybe you haven't been to Defcon. This article wasn't much better than an article about burning man would be if someone wrote one that focused on the fact that it was in the desert and didn't bother mentioning anything about the artwork or the other things that happen when a community of interesting people spend time together. Defcon isn't about being scared. It's about blood drives, teaching anyone interested how to solder and I think this year it was about the new Defcon kids event that included a 10 year old speaker teaching others about her game hacking techniques. Defcon makes me feel better about the world most years.

munin 15y ago

everyone freaks out because "oh man your computer will get hacked in N seconds on the defcon wifi". lets dissect this a little bit. if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET. and also this is the one time of the year when i'm ready for this. every other day of the year i go to the coffee shop i don't know anything about the other randoms there but i assume they're drifting office droids hacking on their excel macros or recruiters cruising linkedin in between meetings. so, if someone exploits me on the defcon wifi ... where else will that exploit work? everywhere, probably! it's probably a super awesome exploit that has super awesome properties that targets super popular software and is also unpatched. someone owns my openssh 5.3 on my laptop on the defcon wifi ... if i pcap that ... i'm a rich man. i can own boxes like mine. so ... as a hypothetical attacker, why would i do this? i'm surrounded by people like me. they're alert. they're cautious. and they are the most capable people in the world to detect what i am doing and reveal it to everyone. oh and there are a whole bunch of law enforcement people there too, AND the entire thing happens in a casino which has heavy security and is already wired for sound and audio everywhere you go. ... anyone who is smart enough to be able to own your box at defcon, is also going to be smart enough to realize that they might as well wait until the week after when you're sitting at a coffee shop.

Pewpewarrows 15y ago
If you're blackhat, sure. But I'd venture to guess that a good portion, as greyhats, are there to do just what this article suggests: raise awareness of new potential threats, claim bragging rights, and improve security for all.
- munin 15y ago
  by owning random boxes on the wifi? no, "claiming bragging rights" is what onstage demos are for :P
nookiemonster 15y ago
Defcon is cheap to attend. You should go sometime and get a feel for the event. If a trip to Vegas is out of your price range, go check visit Hot Topic. You'll get the proper feel. The Defcon crowd is awfully touristy. I mean that professionally. In fact, it's far more the marketing success of defcon that should get attention from hacker news. They have been building quite an empire over the last 19 years.
matthew-wegner 15y ago
I don't think it's your computer joining the network that's the issue; the network itself is likely tainted. By extreme example, a rogue cell tower was demonstrated last year which monitored outgoing SMS messages. Your phone would automatically join it because its signal strength was greater and it had all required information. The issue with Defcon Wi-Fi is that you should assume all outbound traffic is captured. Are you sure your mail notifier, Dropbox client, IM client, etc, aren't sending credentials or some kind that can be (at least temporarily) exploited?
- munin 15y ago
  yes. i'd have big problems on any other network i'd join if i wasn't sure, wouldn't i?
  - dlss 15y ago

Pewpewarrows 15y ago

If you value your sanity, I'd suggest steering clear of the comments on this article. Although I guess you could say that for comments on most article on CNN.

hugh3 15y ago
Although I guess you could say that for comments on most article on CNN. I would say that for most comments on the internet.
- num1 15y ago
  If I ever have a site which posts content, or if I ever finally make a blog, the first thing I will do is turn off the comments. If you want to talk to me, you can email me, or write your own post in response.

swah 15y ago

I'd love to know the OS usage stats here and how they differ from HN.

drivebyacct2 15y ago
I'd bet there are more Mac users on HN than there are at DEF CON.
- swah 15y ago
  There could also be more Windows users if they agree with the line of thinking that says you should run the same system as your targets.
  - mahmud 15y ago
    Virtualization.
jedberg 15y ago
Walking around the CTF room, it looked to be about 1/2 Mac and 1/2 non-mac, with about 1/2 of the non-macs running some unix variant (assuming people aren't running linux with a windows looking window manager or vice versa).

overshard 15y ago

I'm pretty sure any hacker worth his weight in microchips doesn't have a problem. I've been to def con and always take a *nix system with a solid firewall and a way to ssh/vpn home to do all my logging into websites from. DEF CON doesn't scare hackers. It gives us a chance to see if our setups are actually secure and if we get pwnd we deserved it and learn from the experience.

rdl 15y ago
I stick to VPN over 3G / 4G just because it would be embarrassing to get hacked.

X-Istence 15y ago

The DefCon wireless is nowhere near as scary as people make it out to be. Making people believe that something is scary is part of the fun of it for those of us that help run the con. Currently at con, on my laptop with OpenVPN and tethered to my phone because the DefCon wireless is overloaded and not handing out an IP address.

beagledude 15y ago
I just uploaded your docs folder to pastebin #sorrybro http://pastebin.com/MH0KYGTi http://pastebin.com/MH0KYGTi
ddol 15y ago
Damn sorry I'm missing it this year, but I'd be useless for a sold 2 days after it. I can't remember using the internet much at DEFCON. It was pretty solid partying. Now CCC, that's a different story...
- mahcuz 15y ago
  Solid, dude.

jwatzman 15y ago

One of the most insightful points in the article, summing up much of DEF CON, got buried near the end of the article; it's worth emphasizing: It's not about breaking the lock [...] it's about learning the lock can be broken.

marshray 15y ago
For me, breaking the lock is fun too though.

Groxx 15y ago

Wow, that's impressively well-written. And it's about computer security. And it's about hackers, who are hacking. That's like a perfect storm of news-writer fail, and they did a pretty good job through it all. I love that they included this quote, it sums up security very very very well: >It's not about breaking the lock, he said, it's about learning the lock can be broken. I've found ways to open most combination locks in a second or two, without even looking suspicious. It's easier than entering the combination, usually. Those $20k-insured round-keyed laptop locks? Takes about 30 seconds on average, 5 or less if you're lucky. My dad lost a $20 bet with me on that, with the one his employer supplied (and expected him to use) - it took me 5 minutes on the first attempt, and less than a minute each time after that. Security isn't about stopping people from breaking in. It's about not being the low-hanging fruit.

ck2 15y ago

That memo of things to do/not do, is a great list for everywhere 24/7, not just def con. If you can be hacked there, you can be hacked anywhere, and some damage cannot be recovered from (ie. losing google account).

DeanCollinsLCC 15y ago

Bury your room key...-why LV hotels dont use RFID for room keys. Scan your credit card remotely - not if they are mag stripe. FUD articles like this is why people dont know to use VPN or HTTPS, what a waste of CNN's money sending him there for this - sorry but it has to be said could have been a much better more accurate article covering actual security issues.

zackattack 15y ago

I'm in Vegas. Anyone have an extra badge they wanna sell me? I wanna stop by tomorrow. #meetup

steveeq1 15y ago
They ran out of neck holder things for the badges so a lot of people aren't wearing them. As a result, they're not really looking for badges. My friend went around (saturday) and he was able to get in even though he didn't pay.

djcapelis 15y ago

Defcon is much more like a family reunion than a scary thing. This year hundreds of hackers literally opened their veins to give blood in honor of one of our own who needed it. The hacking of other attendees that goes on has more of a prank feel to it (much like a lot of the con!) than a scary thing. It's just a bunch of people getting together to talk, do interesting things and/or get drunk together.