Day one of the Black Hat Security Conference in Las Vegas got off to a hot start with details about DNS and e-mail flaws, Google gaffes, and Cisco vulnerabilities. And some French reporters were kicked out for trying to hack the pressroom facilities.
The Black Hat conference is the premiere conference for the latest in security news and tools. Nearly 7,000 attendees are listening to presentations on phishing, hacking and malware, and many are taking comprehensive training on the latest security tools and techniques to protect their networks.
Dan Kaminsky gave an in-depth briefing of the much-reported DNS flaw he discovered, with some startling new wrinkles.
First and foremost, Kaminsky estimated that only 70 percent of Fortune 500 servers have rolled out a DNS patch. Despite the fact that many servers are still exposed, Kaminsky ran through a detailed laundry list of ways to exploit the flaw before a standing-room only crowd. He may have been pushing laggards to fix the problem by releasing details.
By listening to his presentation, a hacker would have a road map to develop multiple exploits. Kaminsky also spoke in detail on how patches prevent such attacks.
Next up for security woes was Google’s Gadgets. According to conference presenters Tom Stracener and Robert “RSnake” Hansen, Google’s popular desktop gizmos are a gaping security hole waiting to be exploited. Gadgets run a variety of small tasks, such as a desktop calendar, news-feed windows, or the latest crossword puzzle.
Stracener and Hansen highlighted some scenarios.
First, a malicious Google gadget could be added to users’ desktops without their knowledge, monitoring activities and collecting sensitive information.
A malicious gadget could also be used to collect account information, trigger other malicious gadgets and send users to bogus sites to fill out forms with sensitive information.
They also demonstrated JavaScript hacks of Google…