Hacker News Reader

Comment by lost_name | Hacker News Reader

Kind of a tangent, but I was traveling in Portugal last year, and one day as I was headed to a train station I felt my phone buzz. I picked it up and it had a failed Bluetooth file transfer. In the settings, the device name had changed from the default to what looked like a base64 string, if I remember correctly. Unfortunately I didn't think to screenshot anything.

The phone was literally only a couple weeks old. Nothing new had been paired. I changed the name back and figured I would look it up later. The failed file transfer was automatically cleared (just a phone thing) and I wasn't able to find information about it.

View on HN

A similar thing happened to my phone while I was at Defcon several years ago. After that I put my phone on airplane mode. Then when I got home, I reset all my passwords, and wiped the phone.

Is people trying to hack the attendees a common occurrence at Defcon?

No its more of an urban legend. I'm sure there's some hijinks going on but I doubt the hotels would tolerate any kind of large scale malicious activity especially with all the unrelated people staying at the hotel

DefCon sets up its own wifi networks, it doesn't use the hotel's wifi

Do you have sources for that? It’s unlike what many people who attend claim so I’d like to know what it’s based on.

I concur. While I bring a "burner" phone and laptop, it's more so I have a scratch system I can play / experiement on than any real fear that a sensibly configured device is going to get pwned. I used my real phone and laptop during Defcon 27 last week, too. I do have bluetooth off, and I made sure I had no filesharing enabled, and the latest patches, etc.)

I've been to about 10 defcons, and I've never had a device pwned that wasn't a spare device I was playing with.

So much so there is a 'wall of shame' projector posting attendees credentials for all to see.

I think that should be "wall of sheep".

That's for unencrypted credentials captured going across the wire by the ops team. That's to highlight insecure comms not hack people.

There was an instance where someone used a wifi pineapple 0day to brick pineapples, which are considered script kiddie tools in many circles.

Generally nobody will waste a valuable 0day at defcon to attack a personal device. If you get popped it's probably because you're running known vulnerable software.

It's Defcon, so yes.

Can be, the Wall of Sheep mentioned here is from the traffic on the DefCon network. General practice is to make sure at least your bluetooth and wifi are turned off. Realistically, no one is going to use a 0-day to hack into your personal phone.

Always treat Defcon as a dangerous place

https://en.wikipedia.org/wiki/Bluesnarfing

I might be misremembering technologies, but I think in BT the incoming connection can directly execute commands on your device without any kind of identification/authorization.

Reply on news.ycombinator.com