Hoax hacks. Rigged demos of make-believe security holes. Those, it appears, are the real big news that came out of the Black Hat USA security conference earlier this month. Two of the headline-grabbingest claims by independent security researchers at the show have since turned out to be bogus.
One, a reportedly easy-to-exploit security problem in a Cisco firewall appliance, isn't reproducible. The other, an allegedly even-easier-to-exploit hole in Apple's Wi-Fi drivers, didn't actually involve attacking Apple's products after all.
So much for one of IT's last great myths: the honest hacker.
Hey, I still believe honest hackers exist. More than a dozen security problems were showcased by Black Hatters this year. Some have already been fixed; some have hardware and software vendors hard at work correcting very real issues.
Lots of the people who turned up those problems gained their security expertise the old-fashioned way: by hacking into systems they weren't supposed to be anywhere near. They've since cleaned up, dressed up and hung out their shingles as security researchers. But we know at heart they're still hackers.
And that's been highly valuable to us, especially since IT product vendors aren't always, um, completely candid about security issues. These hackers compete to build credibility by finding security holes and telling us about them. It's in their interest to be honest players in this free market for information about IT vulnerabilities. That's how they build business.
Vendors don't much like it -- security holes make them look bad. And it's a pain for us to learn that our production systems are at risk. But the real bad guys already know about these flaws. We're just finding out what we need to know to protect ourselves -- at least when the hackers keep it honest.
Now we're learning that some of them have all the reliability of the phoniest vendor dog-and-pony show.
Consider Hendrik Scholz, the guy who said at Black Hat that he found a "really easy to do" technique for bypassing Cisco's firewall appliances. His claim consisted of a single slide he tacked onto the end of his talk (it wasn't in the version of Scholz's presentation that Black Hat attendees received).
But in interviews, Scholz admitted that an attack would require insider knowledge and pre-existing control of a device inside the firewall. No wonder Cisco can't reproduce a successful real-world attack.
Or consider SecureWorks researcher David Maynor and hacker Jon "Johnny Cache" Ellch, who worked the press like champs with a Black Hat demonstration of hacking into a wireless-equipped Apple MacBook in 60 seconds. It generated plenty of "Mac hack" publicity.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!