Delegate hacks into Black Hat streaming video

What happens in Vegas...


Security shortcomings in Black Hat's newly established streaming media service allowed a security consultant to hack into the system and see presentations for free.

Michael Coates, head of web security at Mozilla, discovered he was able to use an account on a test login page to view videos without paying. Normally the service would cost $395. Coates came across the hole after he began exploring oddities he noticed during the sign-up process, as he explains in a blog post here.

"To be fair, Black Hat didn't operate this video service themselves," Coates wrote. "But it's still a bit ironic that the largest hacking conference in the world has this security hole in their video streaming service."

Coates describes the vulnerability as "a combination of logic flaws and misconfigured systems which provided access to a testing login page that could be used with user credentials that were not fully 'registered' [no payment received]."

Black Hat's inaugural video streaming services was supplied by Inxpo. Coates said he notified Inxpo about the problems and waited until it fixed the security flaws before writing up the attack.

Running any service for delegates to Black Hat and its companion conference Defcon are always fraught with difficulties. In the past, casino VoIP systems been hacked to make free calls, for example.

The same has happened over the years with hotel TV services. Over the years improvements have been made to lock down systems.

Although venues wind up getting arguably the world's most effective penetration testing services in the process, it's difficult to think any organisation other than a Vegas hotel would put up with such hacker hijinks year after year.

Black Hat director Jeff Moss told IDG that it selected Inxpo on a recommendation but that the firm had never previously run live streaming services for a security conference. "It's kind of like their trial by fire: Welcome to Black Hat," Moss said. ®

Similar topics

Broader topics


Other stories you might like

  • Israeli air raid sirens triggered in possible cyberattack
    Source remains unclear, plenty suspect Iran

    Air raid sirens sounded for over an hour in parts of Jerusalem and southern Israel on Sunday evening – but bombs never fell, leading some to blame Iran for compromising the alarms. 

    While the perpetrator remains unclear, Israel's National Cyber Directorate did say in a tweet that it suspected a cyberattack because the air raid sirens activated were municipality-owned public address systems, not Israel Defense Force alarms as originally believed. Sirens also sounded in the Red Sea port town of Eilat. 

    Netizens on social media and Israeli news sites pointed the finger at Iran, though a diplomatic source interviewed by the Jerusalem Post said there was no certainty Tehran was behind the attack. The source also said Israel faces cyberattacks regularly, and downplayed the significance of the incident. 

    Continue reading
  • Hackers weigh in on programming languages of choice
    Small, self-described sample, sure. But results show shifts over time

    Never mind what enterprise programmers are trained to do, a self-defined set of hackers has its own programming language zeitgeist, one that apparently changes with the wind, at least according to the relatively small set surveyed.

    Members of Europe's Chaos Computer Club, which calls itself "Europe's largest association of hackers" were part of a pool for German researchers to poll. The goal of the study was to discover what tools and languages hackers prefer, a mission that sparked some unexpected results.

    The researchers were interested in understanding what languages self-described hackers use, and also asked about OS and IDE choice, whether or not an individual considered their choice important for hacking and how much experience they had as a programmer and hacker.

    Continue reading
  • Stolen-data market RaidForums taken down in domain seizure
    Suspected admin who went by 'Omnipotent' awaits UK decision on extradition to US

    After at least six years of peddling pilfered personal information, the infamous stolen-data market RaidForums has been shut down following the arrest of suspected founder and admin Diogo Santos Coelho in the UK earlier this year.

    Coelho, 21, who allegedly used the mistaken moniker "Omnipotent" among others, according to the US indictment unsealed on Monday in the Eastern District of Virginia, is currently awaiting the outcome of UK legal proceedings to extradite him to the United States.

    The six-count US indictment [PDF] charges Coelho with conspiracy, access device fraud, and aggravated identity theft following from his alleged activities as the chief administrator of RaidForums, an online market for compromised or stolen databases containing personal and financial information.

    Continue reading

Biting the hand that feeds IT © 1998–2022