DEF CON: The event that scares hackers
cnn.com
cnn.com
Defcon isn't about being scared. It's about blood drives, teaching anyone interested how to solder and I think this year it was about the new Defcon kids event that included a 10 year old speaker teaching others about her game hacking techniques. Defcon makes me feel better about the world most years.
if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET.
and also this is the one time of the year when i'm ready for this. every other day of the year i go to the coffee shop i don't know anything about the other randoms there but i assume they're drifting office droids hacking on their excel macros or recruiters cruising linkedin in between meetings.
so, if someone exploits me on the defcon wifi ... where else will that exploit work? everywhere, probably! it's probably a super awesome exploit that has super awesome properties that targets super popular software and is also unpatched. someone owns my openssh 5.3 on my laptop on the defcon wifi ... if i pcap that ... i'm a rich man. i can own boxes like mine.
so ... as a hypothetical attacker, why would i do this? i'm surrounded by people like me. they're alert. they're cautious. and they are the most capable people in the world to detect what i am doing and reveal it to everyone. oh and there are a whole bunch of law enforcement people there too, AND the entire thing happens in a casino which has heavy security and is already wired for sound and audio everywhere you go.
... anyone who is smart enough to be able to own your box at defcon, is also going to be smart enough to realize that they might as well wait until the week after when you're sitting at a coffee shop.
The Defcon crowd is awfully touristy. I mean that professionally.
In fact, it's far more the marketing success of defcon that should get attention from hacker news. They have been building quite an empire over the last 19 years.
The issue with Defcon Wi-Fi is that you should assume all outbound traffic is captured. Are you sure your mail notifier, Dropbox client, IM client, etc, aren't sending credentials or some kind that can be (at least temporarily) exploited?
For example, signin for this very website is done in cleartext. Do you have "big problems" right now? No, I hardly expect you do. Would you expect to if you jumped onto your standard open coffeeshop wifi? Realisticly no. It is fairly unlikely that anyone in your average starbucks gives half a shit about your HNs account.
Now, if you went to DEFCON and didn't take additional precautions? Well, I'm not going to say anyone will really happen to care about your account even then, but you can be damned sure they'll log it anyway.
My point is 1) "any other network" on average is probably not as hostile as the open networks as DEFCON, and 2) your vulnerability will not necessarily manifest visibly as "big problems".
When you connect to the wireless at DefCon, the only real question is how many people are sniffing it, and for what. :)
The first time I went to DEFCON, I got to hear Roger Dingledine complain about how Ubuntu had been shipping a version of Tor with a known remote root vulnerability for months. Modern Linux distribution != magical instant application of all patches.
I can't talk about the wifi there, but what we're doing for 44Con is reason enough not to use the wifi. We will be logging everything on that network and running it through netwitness gear. We won't have a wall of sheep, but unless you're certain your transport is encrypted, your details will be captured and stored.
At DEF CON it's worse - you can't assume that your GSM or any form of RF connection is secure. Fake ATMs, Rogue cell towers and RFID hacking have all been done before there. It's the nature of the atmosphere there.
I love that they included this quote, it sums up security very very very well:
>It's not about breaking the lock, he said, it's about learning the lock can be broken.
I've found ways to open most combination locks in a second or two, without even looking suspicious. It's easier than entering the combination, usually. Those $20k-insured round-keyed laptop locks? Takes about 30 seconds on average, 5 or less if you're lucky. My dad lost a $20 bet with me on that, with the one his employer supplied (and expected him to use) - it took me 5 minutes on the first attempt, and less than a minute each time after that.
Security isn't about stopping people from breaking in. It's about not being the low-hanging fruit.
It's not about breaking the lock [...] it's about learning the lock can be broken.
Currently at con, on my laptop with OpenVPN and tethered to my phone because the DefCon wireless is overloaded and not handing out an IP address.
I can't remember using the internet much at DEFCON. It was pretty solid partying. Now CCC, that's a different story...
I would say that for most comments on the internet.
DEF CON doesn't scare hackers. It gives us a chance to see if our setups are actually secure and if we get pwnd we deserved it and learn from the experience.
If you can be hacked there, you can be hacked anywhere, and some damage cannot be recovered from (ie. losing google account).
FUD articles like this is why people dont know to use VPN or HTTPS, what a waste of CNN's money sending him there for this - sorry but it has to be said could have been a much better more accurate article covering actual security issues.