Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
March 26-29, 2019
Singapore
Black Hat USA
August 3-8, 2019
Las Vegas, NV, USA
Black Hat Europe
December 2-5, 2019
London UK
6/19/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Come to Black Hat USA for the Latest Hardware Hacks

Cars. Vending machines. Hotel suites. Security experts will share the tools and techniques they've used to break into all these things and more at Black Hat USA in October.

There’s no better place to see cutting-edge technology exploited than Black Hat USA in Las Vegas this October, where there’s an entire track of talks dedicated to the (in)security of hardware, firmware, and embedded devices.

Moving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites is a great example; it’s a 50-minute Briefing in which you’ll be shown and taught the tools and methods security researchers used to break the Bluetooth LE-based mobile phone key system of a major hotel chain.

You’ll get a full walkthrough of how the researchers worked out how to wirelessly sniff someone entering their room (or just unlocking the elevator) and then reconstruct the needed data to open the door with any BTLE-enabled PC -- or even a Raspberry Pi.

BMW fans and car security enthusiasts are advised to check out 0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars, another 50-minute Briefing in which speakers from BMW Group and Tencent’s Keen Security Lab will share details of how multiple BMW car models were exploited through physical access and a remote approach -- without any owner interaction.

This is a great opportunity to be introduced to the system architecture and external attack surfaces of connected cars, and you’ll also learn details about the vulnerabilities (including multiple 0-days) which existed in two vehicle components: the Infotainment System (a.k.a. Head Unit) and the Telematics Control Unit.

All the 4G Modules Could be Hacked is, as you might expect, a promising Briefing from the Baidu Security Lab about how all the 4G modules built into things like vending machines, cars, and advertising screens can be hacked. Now  that the “Internet of Things” is in vogue, this Briefing is a great way for you to get a comprehensive overview of the hardware structure of IoT modules. You’ll also learn their most common vulnerabilities and see how researchers used them to do things like take control of vehicles by attacking their built-in entertainment systems. Don’t miss it!

More details on these exciting Briefings and many more are available now on the Black Hat USA Briefings page, which is regularly updated with new content as we get closer to the event!

Black Hat USA returns to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17210
PUBLISHED: 2019-07-20
An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass t...
CVE-2019-12934
PUBLISHED: 2019-07-20
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
CVE-2019-9229
PUBLISHED: 2019-07-20
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can...
CVE-2019-12815
PUBLISHED: 2019-07-19
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVE-2019-13569
PUBLISHED: 2019-07-19
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.