This article appeared in the September issue of CRN magazine as part of the main feature "Levelling the score".
Threat research presented at hacker conferences plays a small but significant role in influencing how security vendors shape their product portfolio and feature sets. Here are 10 significant pieces of research unveiled at the Black Hat 2014 conference.
1. Oracle database
UK-based security researcher David Litchfield revealed new weaknesses in Oracle’s flagship DBMS. A data redaction feature in Oracle 12c, designed to protect sensitive data, has a significant number of security vulnerabilities which could be exploited by criminals.
2. AWS exploits
Andres Riancho, founder of Argentina-based consultancy Bonsai Information Security, demonstrated how AWS cloud infrastructure could be exploited to gain access to account credentials, log files and ultimately hijack an AWS account.
3. Medical devices
Weaknesses in tiny but powerful embedded systems that run insulin pumps, pacemakers and other healthcare devices could be used to target high-risk individuals. Jay Radcliffe, a researcher at vulnerability management vendor Rapid7 who hacked his own insulin pump, said the devices suffer from a long-standing issue of how to update the software running on them to limit the risk.
4. Chip-and-PIN
Nir Valtman, a security researcher at Crowdome and enterprise security architect at NCR Retail, described how cybercriminals can easily get memory-scraping malware, including the malware used in the Target data breach, to execute on POS systems, identify and retrieve details. In a separate session, Ross Anderson, a cryptography expert at Cambridge University, said US retailers are going to be forced to support chip-and-PIN as a fraud reduction measure, but warned that it has limitations.
5. Yahoo and Google encryption
Yahoo announced it is rolling out end-to-end encryption for all of its Mail users, a move Google announced in June. Both are responding to the privacy and security concerns shared by users of cloud services globally, following the NSA revelations.
6. Automobile threats
Automobile manufacturers face a growing list of weaknesses, according to researchers Charlie Miller and Chris Valasek, who identified a list of 20 specific models most significantly at risk. Vehicles are increasingly using wireless capabilities, making remote attacks a reality.
7. Over-the-air updates
Accuvant Labs researchers Mathew Solnik and Marc Blanchou described the weaknesses in an over-the-air update mechanism used by network operators and device manufacturers to update smartphones, tablets and other devices. They said an attacker could hijack carrier remote-control capabilities and exploit vulnerabilities.
8. USB infections
Researchers Karsten Nohl and Jakob Lell showed how an attacker could use tiny USB devices to sniff network traffic, and take control of a victim’s computer by making malware execute during the boot-up process. USB threats are difficult to detect because once plugged into a laptop or PC, it is often identified as a new device.
9. Cisco vulnerabilities
Vulnerabilities in Cisco’s EnergyWise suite were presented by researchers at German IT security consultancy ERNW, which warned that attackers could exploit them to disrupt power at organisations. The researchers reported their findings to Cisco, which issued an advisory warning about the threat.
10. Airport security weaknesses
Noted security researcher Billy Rios identified vulnerabilities in widely used airport scanning equipment. He identified credentials stored in plain text in a manufacturer’s baggage-scanning equipment and other poorly implemented remote-management capabilities.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
