Category: Defcon

Jun 11 2016

Unicorn – PowerShell Downgrade Attack

Magic Unicorn is a simple tool for using a PowerShell downgrade attack to inject shellcode straight into memory. Based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by David Kennedy (TrustedSec) and Josh Kelly at Defcon 18. Usage is simple, just run Magic Unicorn (ensure Metasploit is installed and in the...

Read the full post at
Jul 13 2015

A $200 privacy device has been killed, and no one knows why

A security researcher has abruptly cancelled next month's scheduled unveiling of a privacy device designed to mask Internet users' physical locations. It's a move that has both disappointed privacy advocates and aroused suspicions.

Ben Caudill, a researcher with Rhino Security Labs, took the unusual step of saying he no longer plans to release the software or hardware schematics for his so-called ProxyHam box. He said the devices already created have been destroyed. Caudill has offered no explanation for the killing of the project, but he has reportedly ruled out both intellectual property disputes and Federal Communications Commission licensing concerns.

That has left some people to speculate a secret government subpoena known as a National Security Letter is at play in the decision to kill the project. That speculation seems unlikely because NSLs are a very specific legal process typically served on e-mail providers, phone companies, or the like for specific information, Electronic Frontier Foundation General Counsel and Deputy Executive Director Kurt Opsahl said.

Read 5 remaining paragraphs | Comments

May 24 2014

US may block visas for Chinese hackers attending DefCon, Black Hat

On Saturday, an unnamed “senior administration official” told Reuters that the US government is considering using visa restrictions to keep Chinese hackers from attending DefCon and Black Hat, two major hacking conferences that take place in August in Las Vegas.

The move would be “part of a broad effort to curb Chinese cyber espionage,” Reuters reported. The news comes after five members of the Chinese military were indicted by the US on Monday for allegedly hacking into US companies and stealing trade secrets. It was the first time ever that the US has formally accused another government of hacking.

Jeff Moss, founder of both the DefCon and Black Hat conferences, and Chris Wysopal, a member of the Black Hat board that reviews presentations, were both skeptical of the move. Wysopal noted that Black Hat talks are taped and sold after the conference, and preventing Chinese hackers from being physically there would not appreciably affect China's hacking abilities. "It seems symbolic to me," Wysopal told Reuters of the move. Several Chinese nationals are booked to speak at the Black Hat conference, although none are booked to speak at DefCon.

Read 3 remaining paragraphs | Comments

Jul 11 2013

For first time ever, feds asked to sit out DefCon hacker conference

Since its founding in 1992, DefCon has been a venue where anarchists, geeks, and employees of three-letter federal agencies became unlikely comrades under a live-and-let-live credo that placed the love of computer tinkering above almost everything else. No more. As tensions mount over the broad and indiscriminate spying of Americans and foreigners by the National Security Agency, DefCon organizers are asking feds to sit out this year's hacker conference.

"For over two decades DEF CON has been an open nexus of hacker culture, a place where seasoned pros, hackers, academics, and feds can meet, share ideas and party on neutral territory," Jeff Moss, aka The Dark Tangent, wrote in a blog post published Wednesday night. "Our community operates in the spirit of openness, verified trust, and mutual respect."

He continued:

Read 5 remaining paragraphs | Comments