From its inception in 1997, Black Hat has grown from a small technology-focused conference into a major information security event — offering briefings, education and training for security and risk practitioners. It’s renowned for shedding light on vulnerabilities found in everything from consumer devices to critical infrastructure.

Ivan Reedman, global hardware security and capability development lead at IBM X-Force Red, said it best: “Black Hat is all about security professionals sharing knowledge, working together and seeing some of the awesome stuff going on in the industry, all while at the same time having fun and making new friends.”

Immediately following Black Hat — which will take place in Las Vegas, Nevada, from Aug. 4–9 — is the somewhat less formal DEF CON. DEF CON is one of the world’s largest hacker conventions and is happening in Las Vegas from Aug. 9–12.

David Bryan, global leader of technology at IBM X-Force Red, is most excited about this event: “DEF CON is a time when newbies, seasoned hackers and professionals come together to share knowledge and level the playing field. It’s also a great time for folks to brush up on their skills and share knowledge in the community.”

Hear Space Rogue talk about Black Hat on the X-Force Red in Action podcast series

What’s On Tap for This Year’s Premier Security Conferences?

Many valuable talks, meetings, demos and games will take place at both Black Hat and DEF CON — and it can be hard for first-time attendees and veterans alike to decide how to spend their time. Below are some interesting sessions I know I don’t want to miss.

‘Outsmarting the Smart City’

In this session, which will take place on August 9 at 12:10 p.m., Daniel Crowley and Mauro Paredes from IBM X-Force Red and Jennifer Savage from Threatcare will discuss the security of smart cities, vulnerabilities they have identified in commonly used devices and how to strengthen smart city security. Attend this talk to learn more about what technology is in our cities today, what’s in store for the future, and how to discover and attack the technology that runs modern cities.

(I’m personally looking forward to finding out what vulnerabilities, if any, the team discovered in my home city!)

‘Foxtrot C2: A Journey of Payload Delivery’

One of the challenges red-team operators face when emulating an adversary is unrestricted or unsupervised communication across defensive technology deployed by the enterprise.

Meet Foxtrot C2, IBM X-Force Red’s concept tool designed to help penetration testers overcome enterprise network inspection mechanisms, successfully deliver malicious payloads and establish a long-running operation while consistently bypassing behavioral traffic correlation mechanisms deployed on the company network.

Join the talk on August 9 at 2:30 p.m. to hear IBM X-Force Red’s Dimitry Snezhkov dive into Foxtrot C2.

‘Sizing Up Vulnerabilities’

Identifying security vulnerabilities has become a business-as-usual activity for many companies — now the real challenge is to fix them.

Given the sheer volume of vulnerabilities coupled with the lack of vulnerability management resources, prioritizing and remediating the most critical flaws is an overwhelming project. Many rely on Common Vulnerability Scoring System (CVSS) scores. However, these alone are not enough because they do not take into account whether a vulnerability is actively being weaponized in the wild.

Join IBM X-Force Red’s Charles Henderson and Steve Ocepek at 11 a.m. on August 9 to learn more about vulnerability ranking.

‘The L0pht Testimony, 20 Years Later (and Other Things You Were Afraid to Ask)’

At 5 p.m. on August 10, IBM X-Force Red’s Space Rogue will participate in a reunion panel at DEF CON with members of the hacking collective L0pht Heavy Industries. The panel will look back on 20 years of cybersecurity and discuss the group’s 1998 testimony to warn Congress of glaring vulnerabilities in government systems.

‘d(struction)20 CTF’

A departure from ordinary competitive hacking games, the d(struction)20 CTF at DEF CON is very likely the first ever capture the flag (CTF) event to include the actual physical destruction of players’ machines. It will almost certainly also be the first CTF where those machines are destroyed by a person in a hot dog costume. Featuring creative and hilarious destruction methods, a Hot Dog Beauty Pageant and plenty of other shenanigans, the d20 CTF will no doubt delight and entertain attendees.

Visit Us at Black Hat 2018 to Learn More

Are you planning your next career move? Are you looking to network with the best in the industry? Visit IBM at booth No. 2104 at Black Hat to discuss potential opportunities.

You can also experience the disruption bar, get your password ‘cracked’ by the tool, look inside an automated teller machine (ATM) and chat with IBM X-Force Red’s team of veteran hackers.

And since IBM X-Force Red is celebrating its second birthday, there will be gifts for all who visit.

To learn more about the team’s latest discoveries, follow the IBM X-Force Red in Action podcast series. Whether it’s cars, planes, toilets (yes, seriously!), ATMs or satellites, you never know what this hacking team will break into next — and you won’t want to miss a single episode.

Read the IBM X-Force Research Report: Weaponizing the Internet of Things