Every year, the Black Hat security conference gathers the best and most frightening security research in one (sometimes digital) place. Here’s what impressed and worried us in 2021.
Another Virtual Year
Last year, Black Hat was entirely virtual. This year, attendees had the option to tune in virtually or attend in person. We chose the former, and spent another year behind our respective home desks and not in the glittering expanse of Las Vegas. It seems we weren’t the only ones. The pictures we saw on social media showed a much quieter, emptier Black Hat.
In his closing keynote, Black Hat and Def Con Founder Jeff Moss took it in stride: “It seems weird to me,” said Moss. “But good weird. Like, less pressurized.”
3 Separate Keynotes
Typically, Black Hat has hosted a single, massive keynote address at the beginning of the convention. This year saw three speakers: security expert Matt Tait on Wednesday, Director of the Cybersecurity and Infrastructure Security Agency (CISA) Jen Easterly on Thursday morning, and Department of Homeland Security Secretary Alejandro Mayorkas on Thursday evening.
Tait used his time to talk about how supply chain attacks are upending the economy of hacking, removing the natural brakes on bad behavior online.
Both Mayorkas and Easterly called on the researcher and hacker communities to work with government. Mayorkas put it in dire terms, saying that China, Russia, and Iran seek to build a more repressive internet. Easterly echoed his concerns, but also affirmed her support for strong encryption. That’s not scary, that’s actually a relief.
Pew! Pew! Data Theft!
If you’ve got $200,000 lying around and an incredibly deep understanding of both encryption mechanisms and electrical engineering, have we got a new hobby for you. Take that cash, buy a big laser, and use that knowledge to extract secrets from microchips. And yes, the laser is absolutely necessary.
Iranian Hacker Training Videos
Covering security has given us some unique experiences, like helping to plot the downfall of US democracy. This year, we got a new experience: a training video made for Iranian hackers.
While legitimately frightening, researchers focused on some of the quirkier, humanizing aspects of the hacking group. We watched as they mistyped URLs, struggled with CAPTCHAs, and got hit by ransomware.
Who’s In That Capsule With You?
Security ninja Kya Supa was out of the office, staying at a capsule hotel, which is a lot like temporarily residing inside an IoT appliance. His natural inclination to hack the many remote systems got a big boost when another resident, whom he called Bob, wouldn’t stop making noisy phone calls at 2 a.m.
In his Black Hat briefing, Supa detailed the steps he took and the vulnerabilities he exploited to take full control of the hotel’s devices, which he used to keep Bob up all night by remotely turning lights on and off, switching the bed to sofa mode and back, and more.
Don’t worry; Supa disclosed his findings to the hotel management, and to the maker of the vulnerable devices. The hotel now has a whole new control architecture, so you can sleep soundly in your capsule.
Your New Enemy? Your Browser
Apps are great, but they’re a pain to install and not always on the device you need them. A new technology promises to make the web more like an app by giving it access to your device’s files. There are some serious upsides, but the downsides? They’re pretty serious, too.
5G? More like 5 AUUUUGH
Some of the most startling research this year was built on the sparkling new 5G cellular technology that most of us have only heard about and won’t experience first hand for many years. Regardless, savvy researchers Marco Grassi and Xingyu Chen demonstrated how they were able to get remote code execution on a 5G baseband.
One thing 5G was supposed to do was improve security. Sometimes called Stingrays, IMSI catchers are phony cellular base stations that trick nearby phones into connecting. Older Stingrays were capable of tracking huge groups of people and sometimes intercepting their data.
5G is still susceptible to some IMSI catcher attacks, but it’s significantly better at warding them off, according to Ravishankar Borgaonkar and Altaf Shaik. Mass surveillance and data interception should, hopefully, be out of the picture with 5G. Targeted tracking, however, may still be possible.
Haunted by the Ghost of Excel 4
Only the oldest among us remember using Excel 4, since it was superseded by Excel 5 back in the early 90s. And VBA replaced the dangerously powerful Excel 4 macro system, which had abilities reaching out from spreadsheets into all aspects of Windows.
It turns out, though, that Excel 4 lives on in macro-enabled spreadsheets, and it’s a common entry point for malware attacks. Because these macros can easily change their code while running, it’s easy for malware coders to obfuscate their code and thereby hide nasty behaviors from antivirus tools or researchers. Maybe the malicious behavior occurs only on a certain date, or only when certain conditions are met.
VMWare’s Giovanni Vigna led a team that devised a way to de-obfuscate macros that use this sneaky technique. In effect, their Symbolic Execution system finds the inputs that trigger malware behavior by running the script with every possible input. It’s always a happy day when the good guys defeat the malware coders.
Psst! Your Messenger Is Listening
Researcher Natalie Silvanovich was fascinated by the FaceTime bug that let you listen in on a victim’s phone. It got her wondering: are there more of those vulnerabilities out there? Looking at how mobile messaging platforms implemented WebRTC, she concluded that it was all too common. In her work, she tracked down bugs in Signal, Facebook Messenger, and other popular messaging platforms. But don’t worry: Your conversations are safe, once again.
MacOS Privacy Protections a Pinch Porous
While there are allegedly 50 ways to leave your lover, experts Wojciech Reguła and Csaba Fitzl showed off research that boasted more than 20 ways to defeat the privacy protections of macOS. The team was able to gain permissions through a variety of means, reminding us that there are vulnerabilities everywhere.
Your Router Is Snitching On You
Here’s one more reason to hate your crummy ISP: the combo router/modem they gave you might be giving away your location. Rob Beverly and Erik Rye did some massive data fusion research and discovered that certain low-end routers used a particular form of IPv6 address that they were able to trace to within 50 meters of its true location. That’s a great excuse to upgrade your router.
Windows Says Hello a Bit Too Easily
Passwords are terrible and passwordless authentication is the future. But Omer Tsarfati tricked Windows Hello—a passwordless login feature—by creating a fake camera and feeding it pre-recorded footage. Maybe those COVID face masks can protect your health and your logins?
Stalkerware Is Everywhere
With the proliferation of IoT technology, parental control software, and “Find My” apps, abusers now have a wealth of tech-enabled resources for controlling and surveilling their victims. Lodrina Cherne and Martjin Grooten warn that stalkerware is just a symptom of the larger problem of intimate partner violence (IPV). The pair say Silicon Valley needs to be aware of how their products are being used against survivors.
The Holes in a Series of Tubes
Pneumatic tube systems (PTS) used by hospitals on a regular basis to transport samples, documents, and medications are not entirely secure. Ben Seri and Barak Hadad from Armis, a security research firm, showed how the PTS could be hacked without user interaction, and even installed Doom on one of the consoles. Their research firm is working with the company that makes the PTS to patch the system and prevent future exploits.
