Now that I knew what I was in for, the second day of Black Hat DC took quite a bit less adjusting to, I felt more okay to skip parts of a presentation to chat was presenters, which I did after the Tor presentation.
In the morning, Dan Kaminsky gave a brief review of the DNS exploit he found last year, and the current status of the source port randomization patch. The estimate for patch coverage was about 60% of DNS servers, though the unpatched servers are being pretty actively exploited. He also clarified his stance on DNSSEC, that he’s neutral to the technology, but feels that it can provide end to end trust, something that DNSCurve cannot do, and has a higher chance of being accepted on the root since it doesn’t require pre-operation cryptography. A big implementation hurdle that he sees is for the deployment of DNSSEC servers to be turn-key and not require extra maintenance or knowledge to use.
The following presentation was an interesting one that provided a technical solution to a political problem, how to share data without compromising the data privacy, and without letting the data sharing knowing what is being searched for.
After that, a researcher from Vietnam showed how to break the facial recognition software built into laptops. Simply by taking a photo of the user, and editing it for proper lighting and tones. I got to be the lovely assistant in this presentation, enrolling my face into one of his laptops, then having him take my picture through a Skype chat, then using that picture to unlock the computer. This got the crowd laughing and very impressed with how this technology can actually sell.
The presentation on Tor did very little for me, the research was of marginal value, but the talk after with the presenter and the creator of Tor was eye opening. The most important thing I brought back from that talk was that Tor is not meant to protect you from big brother, but to keep you anonymous from the sites you are browsing, and your ISP. After I saw that shift, I was able to accept the many attacks that have come out of the woodwork over the past few years, and finally put Tor in the proper place in my cyber tool chest.
Finally, the memory snorting presentation was very slick, it seemed to be a very clever way to reuse the signature data already in existence, and be able to both analyze a saved memory dump, and also potentially find malicious code before it hits the wire.
Overall, the show was a blast, and I hope to have the privilege of attending sometime in the future.
Peace and chow,