At Black Hat: Hackers 1, Security Experts 0
As the security elite descend upon Black Hat this week to discuss the latest threat trends and defensive technologies, hackers are reviving the old way of proving their mettlea high-profile attack against, well, people who used to be just like them. Several press reports are recounting how the Websites of high-profile security experts and researchers, including Dan Kaminsky, Jay Beale and Kevin Mitnick, were compromised. The victims believe the attack was made possible by a vulnerability in WordPress, a popular blogging platform. An attack of Mitnick comes as no surprise to anyone. As one of the first celebrity hackers, his notoriety has drawn the ire of fame-seeking script-kiddies and professional black hats since he was first able to reconnect to the Internet. He tells CNET that he had to move his public-facing servers to a specialty hosting service because his old host was tiring of the constant attacks. Kaminsky is a little more of a special case. A noted and well-respected security researcher, Kaminsky earned his stripes at Black Hat many moons ago. The first time I met him was at Black Hat 2002, where he warned the audience against social engineering attacks and lax physical security. At the time, I thought it was pretty trivial to think that people would just walk into an office and download files onto a ZIP drive (yeah, it's been awhile). Kaminsky has graduated to be a rock star among security researchers. He's intensely agnostic and, near as anyone can tell, is purely a white hat. He's credited for deciphering a DNS vulnerability and leading an elite coalition of researchers and vendors to prevent an exploit from literally taking down the entire Internet. At Black Hat this year, he is scheduled to present research into X.509 encryption weaknesses. While the Mitnick attack revealed information of little value, hackers hit the mother lode with Kaminsky. Included in the posted files were documentation on vulnerability research, a proof-of-concept exploit for a known DNS vulnerability, passwords and back-doors to his Website and, sadly, intimate instant message conversations. "It was a jackpot. I really respect [Kaminsky] and I think he's super intelligent in security, and yet he was victimized. On a public-facing box you don't keep anything confidential on there," Mitnick told CNET's Elinor Mills. Frankly, I'm a little surprised that Kaminsky dismissed the incident as "just drama" because there was nothing "technically interesting" about the attack. It's interesting and noteworthy precisely because there's nothing technically interesting about the attack. What does it say when a notable security expert makes a simple mistake like putting all the crown jewels on a public-facing Web server? It tells us that even the best of security practitioners need a second look at their designs and work. This isn't the first time hackers have targeted security researchers presenting at the Black Hat conference. A similar event happened last year. But as noted by several observers, the attacks are more aimed at embarrassing the researchers than revealing any truly valuable secrets. It sort of reminds me of the old days at Black Hat and its sister event, Def Con, where hackers would rise in rank for the more complex and visible hack they pulled off. Based on these reports coming out of Las Vegas, meritocracy isn't dead in the hacker community. |

Comments (2)
What a self-righteous article! Whose to say that Kaminisky's protections were not consistent with his perceived threat-consequence landscape? Security practitioners work with budgets, and that necessarily means some threats are unmitigated and some information is kept in low-security containers. That's life. Running on gold-plated IT doesn't always make you smarter or safer, but will make you broke. Neither the hack, nor the compromised information, was "that interesting". Parturient montes, nascetur ridiculus mus!
Posted by Mike | July 30, 2009 3:34 PM
I think in Kaminsky's case, he made the inaccurate assumption that his hosting provider was keeping his site secure. I don't think people are saying his "protections were not consistent with his perceived threat-consequence landscape", we're saying he mis-perceived the threat-consequence landscape. Since he's a security pro, the most likely explanation for such a misperception is an untested assumption. The fact that the crown jewels were on the site certainly indicates that he either believed the site to be highly secure, or that the information contained wasn't critical.
Posted by Bruce | August 8, 2009 8:05 PM