3 ms·

"Look at this debug port" is spot on, and relevant in the case of the bodega ATM. It's a WinCE single board computer behind a pathetic lock. Pointing out the

"Look at this debug port" is spot on, and relevant in the case of the bodega ATM. It's a WinCE single board computer behind a pathetic lock. Pointing out the silliness of the design is relevant. The theatrics that followed? Not so much. I think it is fair to say not all boutiques play the sensationalist card. The ones that actually refuse to do this presentation clown cycle suffer some damage and have to work harder, because the showy ones grab mindshare while. I also agree, the big ones do it, too, but it is harder to pick out against the slow lumbering noises as they rumble from one puppy mill PCIDSS gig to the next.

tptacek 14y ago
I liked Barnaby Jack's presentation, but I have a bias for people who came up at eEye. I think there's room every year for 1-2 theatrical security presentations --- not that I want to give them! --- and that demonstrating that it's easy to jackpot an ATM or pop open a hotel room door is a perfectly valid bit of theater. I also think some topics become theatrical without sacrificing technical value. For instance, Nate Lawson, Peter Ferrie and I picked a fight with Joanna Rutkowska a few years ago. There was a lot of drama. But the drama was about the accuracy of HPET timers, the AGP GART, and whether we could probe the branch translation buffers to detect hypercalls. I don't think it should have mattered if we got on stage in clown suits and shot nerf guns at the audience; if you're giving a talk about address remapping chipsets, I think it's all fair game. (In fairness: Rutkowska did not agree about the value of the drama.) I agree that the theater gets tiresome, and, in particular, I think if you're going to shoot for theater, you'd better be right. Your exploit should work. It should work in the real world. It should be repeatable. The problem with the hype cycle here isn't that "taking an airplane down with an Android app" is a bogus topic. It's that you don't believe it's actually possible.
danielweber 14y ago
I've done the media thing occasionally. It certainly works, and it's fun, but it's also feels like a distraction from doing the important things. Many years ago a group of folks tried to move the industry away from the "find a bug, win a prize" model that the industry had settled into, seeing it as a local maximum. They didn't seem to have much success.

tptacek 14y ago

I liked Barnaby Jack's presentation, but I have a bias for people who came up at eEye. I think there's room every year for 1-2 theatrical security presentations --- not that I want to give them! --- and that demonstrating that it's easy to jackpot an ATM or pop open a hotel room door is a perfectly valid bit of theater. I also think some topics become theatrical without sacrificing technical value. For instance, Nate Lawson, Peter Ferrie and I picked a fight with Joanna Rutkowska a few years ago. There was a lot of drama. But the drama was about the accuracy of HPET timers, the AGP GART, and whether we could probe the branch translation buffers to detect hypercalls. I don't think it should have mattered if we got on stage in clown suits and shot nerf guns at the audience; if you're giving a talk about address remapping chipsets, I think it's all fair game. (In fairness: Rutkowska did not agree about the value of the drama.) I agree that the theater gets tiresome, and, in particular, I think if you're going to shoot for theater, you'd better be right. Your exploit should work. It should work in the real world. It should be repeatable. The problem with the hype cycle here isn't that "taking an airplane down with an Android app" is a bogus topic. It's that you don't believe it's actually possible.

danielweber 14y ago

I've done the media thing occasionally. It certainly works, and it's fun, but it's also feels like a distraction from doing the important things. Many years ago a group of folks tried to move the industry away from the "find a bug, win a prize" model that the industry had settled into, seeing it as a local maximum. They didn't seem to have much success.