Network Security News

Black Hat cybersecurity convo to reveal plenty of hacks

Wednesday, July 22, 2009

This year's highly-anticipated gathering of web security researchers and ethical hackers, Black Hat USA 2009, kicks off this weekend in Las Vegas. Researchers will present evidence of newly discovered web vulnerabilities and discuss the implications of the underground cybercrime economy and globalized threats for cybersecurity.

Some of the issues researchers will spotlight at the convention include the security of the electrical grid, hacker rootkits for exploiting Mac OS X and the technology behind darknets - private, peer-to-peer networks that can be used to share data securely, for good or ill.

Mike Zusman, principal consultant at Intrepidus Group, will present on a browser design flaw that allows an attacker to steal data from websites with Extended Validation Secure Sockets Layer (SSL) certificates, which are supposed to guarantee an encrypted connection.

Zusman and another researcher have devised a new attack, called SSL Rebinding, which exploits this flaw to steal sensitive data as it leaves the browser.

Hackers will also recognize the most-overblown security bug and most epic fail with their Pwnie awards. Nominees for "Most Epic FAIL" included StrongWebmail CEO Darren Berkovitz, who issued a challenge to hackers to break into his StrongWebmail email account.

Berkovitz was taken down by security researchers who used a man-in-the-middle attack to infiltrate his web browser when he logged on. He offered a prize of $10,000.