Four members of the Flow development team attended ZaCon III at the University of Johannesburg on 8 October. ZaCon is a community-driven infosec (information security) conference, which aims “to build a better community of hackers in South Africa”.
The information security scene is schizophrenic – on the one hand you have a number of people who will try anything to break into your sites in the interests of “research”. On the other hand you have the “defenders” who try to prevent hackers breaking into their systems. Both were present at the conference.
Flow developers would be considered “defenders” – we have to maintain secure systems to protect our client’s data. But we have a soft spot for security researchers (ethical hackers), as they keep the programming languages we use battle-hardened by reporting vulnerabilities. We have a common enemy: the really bad guys who hack machines to steal data and sell Viagra, amongst other things.
The talks at the conference included:
Open source intelligence. Finding out where people live, what their Facebook connections to each other are, and geo-locating their movements using Twitter. (All determined with publicly available information.) Takeaway: If you’re using Twitter and TwitPic, check your geolocation settings. The metadata attached to the photos you take often has GPS data attached to it that can be used to track your movements.
Hash cracking and password security. This was an amazing talk that showed how vulnerable our passwords are. Using a hardware rig of several video cards, this researcher parallel processes literally billions of passwords a minute. If your password is less than 8 characters, a hacker will get it in two hours if the password is unsalted (salting is a method of randomising an encrypted hash). Takeaway: make passwords longer and full of special characters (and do not use number substitution e.g.Pa55word). Remember you can often use spaces in your passwords, so rather write a sentence. Hackers rarely apply brute force past 10 characters; they just take too long to crack.
Learning what can get you in jail vs what can’t get you in jail (note to self: read the Electronic Communications Act and the Regulation of Interception of Communications Act.) Takeaway: It appears Rica has very little to do with Sim card registration and very much to do with putting hackers behind bars. What is particularly worrying is that security researchers have no legal standing, although “intention” is still a defence.
Rootkits in Windows. A really interesting talk by a security researcher on the vulnerability of the Windows registry. A hacker can take over your entire system and make it completely unusable with a simple installation file (masked as something useful). Takeaway: Be careful what you download and install. If a game only takes 10 seconds to download and claims to be the full installation of “Quake III Arena”, it probably is a rootkit and will take over your system. Rootkits can also be found on Linux and Mac OSX, so there’s no hiding!
Locksports. The art of lock picking was showcased and it is apparently a sport. Lots of fun can be had picking locks. Even though it didn’t have anything to do with digital security, it was an entertaining talk. Takeway: if you’re serious about keeping your stuff secure, check the security rating of the lock you purchase. A lock cheaper than R100 can probably be picked in a matter of minutes. (Some expensive ones are also vulnerable, so check the forums before choosing a good lock.)
This ranked as one of the best conferences I’ve ever attended and the entrance was free. A big thanks to the team of security researchers at SensePost who played a large role in organising the conference.