Hackerconferentie DEF CON verbiedt 'slimme' brillen

Eens, maar dan veel breder. Als het gaat over privacy ben ik een voorstander van generieke wetgeving die over het "verzamelen van gegevens" zegt: "Nee, tenzij". En dat dan niet in het BW opnemen maar onder het strafrecht laten vallen.

[insert] plaatje met Will Smith van M.I.B. met zijn Neuralyzer[/insert]

Dacht eerst dat het bescherming was voor de persoon in kwestie, alle electronica wordt nogal snel gehackt van zodra die Defcon betreden. Nu hebben die brillen wellicht een airplane-mode, maar toch.

https://www.reddit.com/r/Defcon/comments/1542ntn/bringing_your_personal_computing_devices_to_the/

"I posted this a couple of year ago, but worth putting out again.

TL/DR...I bring my personal assets and have never had a problem. YOU DO YOU!


I often see people talk about bringing "burner" devices to the con. The concern is that at a hacking convention, a hacker is sure to attack your personal device, put malware on it and pwn you. If you bring a burner device (something you plan of erasing/re-installing post con) any compromise is contained.

Here is my personal opinion on this

(no warranties expressed or implied)

(my opinions are my own and are based on my knowledge and experience...don't take what I say at face value. Analyze for yourself)

I bring my personal laptop and cell phone each year. I have been working infosec for ~20 years. I know how to "harden" my devices and I practice good "cyber hygiene". I understand the threat vectors and limit my exposure. I have never had an issue and never detected anything on my devices.

Hardening - Run your host based firewall. Update your AV. Patch your OS. Patch your applications. Update your phone. Do this PRIOR to the con. (i.e. Do not take the chance of a MitM attack at the con). Bottom line, make sure everything is up to date before you connect to the conference WiFi network, the hotel network or any network while in Vegas that week. This should cover any "known" vulnerabilities...things that vendors are aware of have patches for. (I will be doing one last update check for everything the day before I fly out)

0-days - We can patch our devices against known vulnerabilities but what about 0-days. Def Con is run by some of the best cyber security people in the world. They know how to monitor a network. If someone had a 0-day and executed it on the Def Con network, it would be detected. The packets would be captured. Someone just burned a 0day just to attack you? That 0-day could be worth a lot as a bug bounty or on the black market. I don't see it as a threat against me as a conference attendee. (If I was CTO of a big company I might be more of a target and would change my defense strategy.)

In the middle of hardening and 0-days...know about current threats. #PrintNightmare. MS is still working on a patch. Current suggested mitigation, turn off the print service. We are mitigating, not remediating. Do your research if you don't know what I'm talking about. We could do a whole post on PrintNightmare.

https://wccftech.com/how-to/how-to-mitigate-printnightmare-print-spooler-vulnerability-on-windows-10-computers/

Exposure - Turn off WiFi and Bluetooth while not in use. Basic cyber hygiene...Don't run unnecessary services. Turn them on when you need them, turn them off when you don't. Speaking of WiFi, don't "autoconnect" to networks. Imagine someone running a rogue access point with an SSID of Starbucks. Your phone/laptop might try to auto connect to that SSID if it remembers that network name. The rogue AP will prob forward your traffic to the internet and you won't realize you have been MitMd (is that a term?). Oh, and run a VPN. nuff said.

Def Con network - Last year was virtual, but the year before the Def Con NOC provided WiFi with 802.1x authentication and digital certificate verification. Makes me feel better knowing they do something to verify connections. Here is a link from their FAQ a couple years back. (nothing on the current year FAQ about this yet but I expect it will come.)

https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20network.txt

Per my autoconnect comment above, pay attention to what WiFi network you are on. Get in the habit of checking.

Cyber Hygene - Don't plugin random USB devices. Don't click on random links. We all get this in our annual cyber security awareness training. Especially true at the con. Meet a stranger and he sends you links?! I actually watched someone do this. Guy was trying to get us to click links on his page he wanted to forward to us. no. no. no.

Think further. How bout QR codes? What shenanigans do you think they can pull off with QR codes. Put a poster up with a QR code that tries to connect your device to SSID "%p%s%s%s%s%n" (do you get the reference?). You're taking a pic of some friends, this poster is in the background, your phone politely tries to connect for you, you click the popup without fully looking at what popped up. On an iphone? bad day.

https://howtoremove.guide/p-s-s-s-s-n-wireless-network/

This is what works for ME. I may be dead wrong. Maybe there is malware deep in my system and I am unaware. (doubt it). I have measured my risk, applied appropriate mitigations and make informed decisions. (is my CISSP showing?)

Cyber n00b? Be safe out there. Its not all black magic and voodoo. Know the threats and how to navigate the threatscape. If you don't understand all of this (what is a VPN?) then err of the side of caution and get your burner phone/laptop. There is nothing wrong with that approach...It is not "over the top" or unreasonable. It is the right solution when aren't confident you can secure your own device and communications. Hopefully cons like this and your journey in infosec will get you there. That's why your coming to the con, right? To learn the black magic and voodo!

The most secure computer in the world is powered off, buried in concrete. Not very usable though. I like to get use out my devices.

Very curious to see other opinions on my approach. Other suggestions to protect yourself?"

Exact, eigenlik zegt de regel dat smartphones juist niet meer mogen, heb geen smartphone gezien die aangeeft dat er wordt opgenomen.