Black Hat 2010 started today and there is no shortage of vulnerabilities to be revealed. Black Hat and it's lower end companion conference, Defcon, are where security researchers disclose vulnerabilities in IT infrastructure upon which our civilization depends.
I'm a little late getting this post out but here are some things to expect, courtesy of PC World: What to Watch at Black Hat and Defcon. I am glad DNS is getting some focus as is mobile computing.
2) DNS
Two years ago, Dan Kaminsky made headlines worldwide by uncovering a flaw in the DNS (Domain Name System) used to look up the addresses of computers on the Internet. This year, Kaminsky is speaking againat Black Hat -- this time on Web security tools. But he's also been tapped to participate in a press conference where he and representatives from ICANN (Internet Corporation For Assigned Names and Numbers) and VeriSign will discuss Domain Name System Security Extensions (DNSSEC) -- a new way of doing DNS that provides a level of confidence that computers connected to the Internet are what they actually claim to be.
About two weeks ago, ICANN presided over the first cryptographic signingof a root server with a DNSSEC key. DNSSEC isn't yet widely supported, but ICANN hopes that by signing a root zone, it will spur others to support the protocol in their server and client software.
Researchers like Kaminsky say that widespread adoption of DNSSEC could curb a whole bunch of online attacks. "We've been looking at how DNSSEC is going to address not only DNS vulnerabilities, but some of the core vulnerabilities we have in security," Kaminsky said in an interview. "We're not going to solve all of those problems with DNSSEC... but there's an entire class of authentication vulnerabilities that DNSSEC does address."
Search Security also had a nice primer yesterday: Mobile threats, SSL weaknesses, Web application bugs at Black Hat 2010.
Dasient, a Web-based antimalware company, will present its research at Black Hat on the three most critical structural vulnerabilities in websites. Daswani will talk about the vulnerabilities and problems his company's scanning technology has seen in Javascript widgets, third-party advertising services and third-party applications.
Often, Daswani said, the issue comes down to trust. The widget provider, for example, could be an attacker masquerading as a provider; the widget could be compromised; or it could be using DNS cache poisoning to redirect site visitors to an attack site. The research also points out similar issues with third-party advertising that could be serving malware or redirecting users to attack sites. The main problem is that advertising providers always have multiple partners, and chances are one or all of those partners don't vet the security of ad content. Third-party applications also exploit the trust between site visitors and the site. Apps could be vulnerable to Web-based attacks such as SQL injection or cross-site scripting; host sites need to ensure providers are vetting code for security vulnerabilities.
Stay tuned as more news comes out of the these conferences.
I can appreciate the attempt of an artist to engage with social networking and new media. When I first saw this blurb (on Facebook) I became excited because I thought I'd be seeing an artist really using the tools and actual medium of social networking as raw materials for art.
Posted by: wholesale | 12/15/2010 at 05:54 AM