550 ethical hackers converged on Milwaukee Wisconsin to discuss the latest in cracking security WIFI protocols, engage in hacking cryptography contests and explore the fringe of science fiction vs. reality at Cyphercon2.0. While most conferences I attend often have different tracks or topics of interest, this multi-layered conference went beyond tracks to highly interactive forums and competitions. Michael Goetzman, the founder of Cypercon, said, “I find that the best things happen when you just stay out of the way and let conference attendees lead the way.”
The interactive cubical conference badge developed by TYMKRS best represents the spirit of the conference – part DIY circuitry project and part interactive game called “Switchboard” – loosely based on Zork. I asked Addie, an engineer from TYMKRS, about their creation, “We thought about conference collaboration and the physicalness of getting people together for the purpose of figuring out how to work with each other and how to play the game.” Addie’s ambition encapsulates the many contests, villages and sessions that took place over two days. Some of the highlights included:
Brain-Based Authentication
A real head-scratcher, this session led by Sydney Swaine-Simon, a researcher from NuerotechX, discussed studies that had a 99.15% authentication accuracy rate based on visual identity mapped to brain patterns. This is very good as fingerprint bio-metrics are about 90% accurate based on the type of technology being used. However, to achieve this level of accuracy you must be conscious and have 61 electrodes connected to your head! Sydney predicted that we may start to see brain-based authentication as technology for reading brainwaves becomes more cost effective and easy to implement in the next 10 years. One of the biggest hurtles we still face is sheer processing power to receive multiple brain waves, process and compare in real time takes large scale compute power, this is where Moore’s law is helping us catch up and get there sooner than we think.
Wireless SDR
Wireless Software Defined Radio, or SDR, was the conference buzz in more than one session. It was also included as a special challenge in the Capture the Flag competition. If you are new to SDR, the basic premise is that inexpensive technology like the Yardstick have recently been introduced enabling users to listen and transmit radio waves on all popular radio spectrums. This means that you can use SDR technology to not only watch digital TV, listen to FM radio, but it can also be used to receive signals from your garage door openers, baby-cams, WIFI devices, and any wireless IoT devices. The hack is not that complicated; first look at the back of your device and find the FCC number, then search for the device on the publicly available FCC website. The next step is to tune into the channel and observe how the device sends and receives. For simple devices that do not use encryption like doorbells the hack is as simple as playing back a recording of a captured frequency to ring the bell. Fortunately, most critical wireless devices like your car’s wireless entry fob use encryption which are harder to crack than a doorbell, but they aren’t impossible.
Passwords
Password cracking, password encryption, and managing passwords were all hot topics! It would seem that we are past passwords, however password hygiene is still a major security issue. One group of penetration testers (ethical hackers) noted that they started their tests with weak domain passwords because they were successful 66% of the time! “Password1” was the most popular weak domain password used. That was the easy hack, hobbyist started a club called CynoSure Prime where members develop and test password cracking software for fun! In their defense the majority of the work is focused on developing effective hashes or cryptology used to securely encrypt passwords.
Conference attendees considered themselves ‘ethical hackers’, in that they were exploiting vulnerabilities and experimenting with new methods of security to create awareness and find better security methods. However, I got into one discussion with a hacker who went by the name “Lannister” on how technically gifted and demented criminals are exploiting insider accounts as they go after Fullz (full identity records) that trade for $7 a piece on the darknet. The big take-away is that given enough time and motivation unethical hackers can and will exploit systems for fun and profit. This only underscore the importance of safe guarding data, creating a business continuity plan and creating policies and controls that support the principle of least privilege. I hope you can meet me in Milwaukee for Cyhpercon 3.0 to discover all the new exploits and hacks this creative conference delivers in 2018.
