From its inception in 1997, Black Hat has grown from a small technology-focused conference into a major information security event — offering briefings, education and training for security and risk practitioners. It’s renowned for shedding light on vulnerabilities found in everything from consumer devices to critical infrastructure.

Ivan Reedman, global hardware security and capability development lead at IBM X-Force Red, said it best: “Black Hat is all about security professionals sharing knowledge, working together and seeing some of the awesome stuff going on in the industry, all while at the same time having fun and making new friends.”

Immediately following Black Hat — which will take place in Las Vegas, Nevada, from Aug. 4–9 — is the somewhat less formal DEF CON. DEF CON is one of the world’s largest hacker conventions and is happening in Las Vegas from Aug. 9–12.

David Bryan, global leader of technology at IBM X-Force Red, is most excited about this event: “DEF CON is a time when newbies, seasoned hackers and professionals come together to share knowledge and level the playing field. It’s also a great time for folks to brush up on their skills and share knowledge in the community.”

Hear Space Rogue talk about Black Hat on the X-Force Red in Action podcast series

What’s On Tap for This Year’s Premier Security Conferences?

Many valuable talks, meetings, demos and games will take place at both Black Hat and DEF CON — and it can be hard for first-time attendees and veterans alike to decide how to spend their time. Below are some interesting sessions I know I don’t want to miss.

‘Outsmarting the Smart City’

In this session, which will take place on August 9 at 12:10 p.m., Daniel Crowley and Mauro Paredes from IBM X-Force Red and Jennifer Savage from Threatcare will discuss the security of smart cities, vulnerabilities they have identified in commonly used devices and how to strengthen smart city security. Attend this talk to learn more about what technology is in our cities today, what’s in store for the future, and how to discover and attack the technology that runs modern cities.

(I’m personally looking forward to finding out what vulnerabilities, if any, the team discovered in my home city!)

‘Foxtrot C2: A Journey of Payload Delivery’

One of the challenges red-team operators face when emulating an adversary is unrestricted or unsupervised communication across defensive technology deployed by the enterprise.

Meet Foxtrot C2, IBM X-Force Red’s concept tool designed to help penetration testers overcome enterprise network inspection mechanisms, successfully deliver malicious payloads and establish a long-running operation while consistently bypassing behavioral traffic correlation mechanisms deployed on the company network.

Join the talk on August 9 at 2:30 p.m. to hear IBM X-Force Red’s Dimitry Snezhkov dive into Foxtrot C2.

‘Sizing Up Vulnerabilities’

Identifying security vulnerabilities has become a business-as-usual activity for many companies — now the real challenge is to fix them.

Given the sheer volume of vulnerabilities coupled with the lack of vulnerability management resources, prioritizing and remediating the most critical flaws is an overwhelming project. Many rely on Common Vulnerability Scoring System (CVSS) scores. However, these alone are not enough because they do not take into account whether a vulnerability is actively being weaponized in the wild.

Join IBM X-Force Red’s Charles Henderson and Steve Ocepek at 11 a.m. on August 9 to learn more about vulnerability ranking.

‘The L0pht Testimony, 20 Years Later (and Other Things You Were Afraid to Ask)’

At 5 p.m. on August 10, IBM X-Force Red’s Space Rogue will participate in a reunion panel at DEF CON with members of the hacking collective L0pht Heavy Industries. The panel will look back on 20 years of cybersecurity and discuss the group’s 1998 testimony to warn Congress of glaring vulnerabilities in government systems.

‘d(struction)20 CTF’

A departure from ordinary competitive hacking games, the d(struction)20 CTF at DEF CON is very likely the first ever capture the flag (CTF) event to include the actual physical destruction of players’ machines. It will almost certainly also be the first CTF where those machines are destroyed by a person in a hot dog costume. Featuring creative and hilarious destruction methods, a Hot Dog Beauty Pageant and plenty of other shenanigans, the d20 CTF will no doubt delight and entertain attendees.

Visit Us at Black Hat 2018 to Learn More

Are you planning your next career move? Are you looking to network with the best in the industry? Visit IBM at booth No. 2104 at Black Hat to discuss potential opportunities.

You can also experience the disruption bar, get your password ‘cracked’ by the tool, look inside an automated teller machine (ATM) and chat with IBM X-Force Red’s team of veteran hackers.

And since IBM X-Force Red is celebrating its second birthday, there will be gifts for all who visit.

To learn more about the team’s latest discoveries, follow the IBM X-Force Red in Action podcast series. Whether it’s cars, planes, toilets (yes, seriously!), ATMs or satellites, you never know what this hacking team will break into next — and you won’t want to miss a single episode.

Read the IBM X-Force Research Report: Weaponizing the Internet of Things


More from Intelligence & Analytics

2022 Industry Threat Recap: Manufacturing

It seems like yesterday that industries were fumbling to understand the threats posed by post-pandemic economic and technological changes. While every disruption provides opportunities for positive change, it's hard to ignore the impact that global supply chains, rising labor costs, digital currency and environmental regulations have had on commerce worldwide. Many sectors are starting to see the light at the end of the tunnel. But 2022 has shown us that manufacturing still faces some dark clouds ahead when combatting persistent…

Cybersecurity in the Next-Generation Space Age, Pt. 3: Securing the New Space

View Part 1, Introduction to New Space, and Part 2, Cybersecurity Threats in New Space, in this series. As we see in the previous article of this series discussing the cybersecurity threats in the New Space, space technology is advancing at an unprecedented rate — with new technologies being launched into orbit at an increasingly rapid pace. The need to ensure the security and safety of these technologies has never been more pressing. So, let’s discover a range of measures…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…