Black Hat, Defcon, and BSides
The Pwnie Awards have been given at Black Hat. CSO offered an account of the winners; here's a quick run-down of some of the major honors:
- Best server-side bug: the Equation Group (honored for CVE-2017-0143, 0144, and 0145).
- Best client-side bug: the independent, parallel discoverers of CVE-2017-0199, a Microsoft Office OLE exploit.
- Best privilege escalation bug: the many who worked on Drammer, the rowhammer attack on mobile platforms.
- Best cryptographic attack: researchers as Google and CWI, for breaking SHA-1.
- Best backdoor: M.E.Doc, the Ukrainian accounting software at the bottom of NotPetya.
- Best branding: Atlassian, for branding (and in the opinion of the judges, overhyping) the Ghostbutt vulnerability (with a shout-out to threatbutt).
- Most epic fail: Australia's Prime Minister Malcolm Turnbull, who's picked up the fallen backdoor deadender banner from former US FBI Director Comey. When asked whether "the laws of mathematics" would make proposed crypto restrictions unfeasibly, Prime Minister Turnbill is said to have replied, “Well the laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.” Mr. Turnbull nosed out the Intercept, nominated for the way they inadvertently exposed a source, NSA-leaker Reality Winner.
- Epic 0wnage was a shared award, going to both WannaCry (tentatively credited as "North Korea(?)") and the ShadowBrokers (unambiguously credited as "Russia. Straight up: Russia").
Other news from Las Vegas is linked below. Of particular interest will be MedSec CEO Justine Bone's unrepentant advocacy of vulnerability-research-driven stock-shorting as a legitimate business model for security companies. Bone's company was involved in shorting St. Jude Medical stock when it gained knowledge of an undisclosed vulnerability in St. Jude products. Also of interest are the many lurid stories from the Internet-of-things, including a smart car wash that may be induced to wish you dead.