Black Hat is one of the big cyber security events of the year, bringing together some of the best and brightest from the industry. What was on the agenda?
CBR looks at the biggest news, views and rumours from the event.
1. Hacks
Last year, one of the big headline-grabbing events was Charlie Miller and Christ Valasek’s hack of a Jeep Cherooke. The pair was able to kill the vehicle’s engine while it was driving, leading to a recall of 1.4 million Jeeps.
This year, they repeated the hack with a new technique, this time sending false messages to the car’s internal network and overriding the correct ones.
This allowed them to force the vehicle to turn sharply, speed up or brake suddenly.
Fiar Chrysler responded by saying that the hack had not shown any new ways of breaching the Jeep remotely, according to the Associated Press. The manufacturer argued that the attack couldn’t have been carried out remotely.
Content from our partners
Meanwhile, researchers from NCR Corporation Nir Valtman and Patrick Watson were able to capture data from retail transactions using EMV technology, which is used in chip and pin cards.
2. Trouble in Rio
The Rio Olympics could be a major target for cyber attacks, according to a report by Fortinet’s FortiGuard Labs.
Fortinet’s analysis indicated that cyber threats are not considering a particular risk by Brazil, given far lower priority than by other countries.
The report found that the volume of malicious and phishing artefacts, such as domain names and URLs, in Brazil was on the rise.
In June, Brazil’s percentage increase was higher in three of four categories in Fortinet’s report when compared with the global percentage increase. The highest percentage growth was in the malicious URL category at 83 percent compared to 16 percent for the rest of the world.
These findings were backed up by ProofPoint’s report which revealed fraudulent social media accounts and apps associated with the Olympics. 15 percent of Olympics-related social media accounts were fraudulent and 6 percent used the popularity of the Olympics to steal follower credentials through phishing attacks.
3. Accolades
No big conference would be complete without a few awards being dished out. Dark Reading was on the look-out for innovation, looking for the most innovative startup, emerging company and thought leader.
Deep Instinct won the ‘Most Innovative Startup’ award due to its use of machine learning in cyber security. Meanwhile, Vectra was given the ‘Most Innovative Emerging Company’ for its tool allowing security teams to prioritise threats at their organisations. Paul Vixie of Farsight Security won in the ‘Most Innovative Thought Leader’ category.
On the other side of the cyber security battle are the Pwnie awards, now in their tenth year, which are an irreverent take on all things malware. The name comes from online gaming slang, parodying a mistype of the word ‘own’.
There were awards for researchers who discovered the best bugs: Cisco won in the best server-side bug, while Juniper won in the best backdoor category for “introducing or discovering the most subtle, technically sophisticated, or impactful backdoor in widely used software, protocols, or algorithms.”
“Some Bad Ass Motherf***ers” won the Pwnie for Epic 0wnage, an award recognising attacks of particular ingenuity and audacity, for hacking Juniper Networks' routers and firewalls late last year.
4. The threat of shadow data
Blue Coat analysed more than 15,000 enterprise cloud apps and 108 million enterprise documents stored and shared within them.
The report produced the staggering finding that 99 percent of the apps did not provide sufficient security, compliance controls and features to protect enterprise data in the cloud. This was based on Blue Coat’s risk-based scoring system.
Shadow Data, which is unmanaged content stored in and shared across cloud apps by employees, with 23 percent of it being broadly shared among employees and external parties.
Organisations are also running 20 times more cloud apps than they estimate, with the average being 841 across their extended networks.
5. Partnerships
The cyber security industry talks big on the need for collaboration, so it’s good to see companies pooling their expertise and working together.
A10 and Cylance announced that they would be combining their technologies to improve cyber security for individual endpoints.
Cylance’s anti-malware engine will now be embedded into A10 Networks’ SSL Insight and Thunder Convergent Firewall.
Deloitte Cyber Risk Services also unveiled an alliance before the show with ThreatConnect to boost the capabilities around its Vigilant Managed Services. This will combine ThreatConnect's threat intelligence platform with Deloitte’s intelligence and analytics services.
6. Services
Black Hat is more a conference about research and sharing expertise than about product or industry announcements.
However, IBM used the conference to announce the formation of IBM X-Force Red, a new penetration testing team which will help businesses discover vulnerabilities in their computer networks, hardware and software applications.
The team will form a subset of IBM Security Services and will also examine human security vulnerabilities in daily processes and procedures.
The new team will be led by IBM's Charles Henderson. X-Force Red will span a network of hundreds of security professionals in dozens of locations around the world, including the United States, the United Kingdom, Australia and Japan.
The four main areas of focus for X-Force Red are applications, the network, hardware and human behaviour.
San Francisco-based RiskIQ also announced new service offerings at the conference, adding Security Intelligence Services to its External Threat Management platform.
On Wednesday, Cybereason launched the Adversary Hunting Service, the Active Monitoring Service and the Incident Response Service.
7. Products
There were a few notable product announcements at the conference. Tripwire announced the new version of Tripwire IP360, which distributes scanning across multiple scanning appliances to deliver faster and more resilient vulnerability assessments.
Trustlook launched Trustlook Sentinel, a new mobile security application, while Pwnie Express announced two solutions to provide Bluetooth detection and penetration testing for mobile devices.
