The cybersecurity community is descending on Las Vegas this week for a series of conferences just as digital warfare has been thrust into the national spotlight.

More than 17,000 security experts, hackers and analysts are expected to attend Black Hat USA for a combination of trainings and briefings by experts. Now in its 21st year, the conference is one of the largest information security events in the world and includes more than 300 speakers or trainers, 120 briefings and more than 80 trainings.

Fifth Domain is in Las Vegas for the week reporting on this so-called “hacker summer camp.” (Contact us on Signal for tips, gossip and burrito suggestions.)

Here are three storylines we’ll be watching for this week:

New threats

Fifth Domain is eager/scared to learn what new threats and trends the cyber community is seeing. Government, military officials and contractors all say they’re trying to defend their systems against what’s coming next.

For an overview on what’s new in cyber vulnerabilities, we’re looking for answers at a briefing on threat modeling on Aug. 8. The briefing includes new systems being attacked, new attack techniques and how to stop them.

A briefing on “bridgeware” a type of malware that can penetrate air-gapped computers, caught our eye. Jumping air-gapped computers is a feature the Stuxnet virus reportedly used. Thankfully, a discussion of countermeasures also will be provided Aug. 8.

Among the most concerning briefings at Black Hat is the potential for backdoors in x86 processors, which are commonly used in Intel, AMD, and other companies and, thus, commonly found in government computers. Presented by Christoper Domas of Finite State, the briefing is appropriately titled “God Mode Unlocked."

Human factors

Security experts and executives have repeatedly said that insider threat and human vulnerability top their security concerns. It is a form of attack that was used to hack Hillary Clinton’s 2016 presidential campaign, the electric grid and restaurants across the U.S.

And hackers are becoming more advanced in their phishing techniques, according to a briefing by Matt Wixley scheduled for Aug. 8. “By building rapport with targeted victims, attackers are able to elicit sensitive information, gather material for extortion, and persuade users to take actions leading to compromises,” the briefing summary says.

But any social engineering attack must ask a specific question, according to Ian Harris, a professor at the University of California, Irvine. His Aug. 9 briefing is focused on whether language processing techniques can detect questions and commands in messages to determine if they are malicious.This could be an innovative way to automatically detect phishing attempts.

Two researchers from the National Security Agency, Celeste Paul and Josiah Dykstra, will present research on the effects of stress on operational security Aug. 8. The briefing is focused on the time of security operations, and says “longer operations did not result in higher success.”

Cyber policy

The Trump administration announced a new risk sharing center July 31 during a conference in New York City, and has said that it would aggressively attribute and deter hacks on the United States. Details are thin however, and Defense Department officials have criticized America’s cyber strategy, with one telling Fifth Domain that the administration’s policy is a “potential catastrophe” because of a lack of coordination.

We are interested to hear the inside story of how companies acted before the Meltdown and Spectre vulnerability announcements. Representatives from CERT, Red Hat, Google and Microsoft are all convening Aug. 8 to discuss a new playbook in vulnerability disclosure.

As the number of cyberattacks appears to be increasing, the international norms are in flux, according to the Global Commission on the Stability of Cyberspace. The group will be hosting a panel Aug. 9 on the new norms in cyberspace being forged by governments, companies, and international organizations. Chris Painter, the former top cyber diplomat at the State Department, will present.

For hardcore policy wonks, a panel of journalists, lawyers and government officials will discuss how the legal community has been at the forefront of shaping information security. On Aug. 8, the briefing will discuss “the emerging legal trends in security that will impact all of us tomorrow.”

Fifth Domain will be in Las Vegas covering BSides, Black Hat and DefCon. We’d love to meet with you. Message us on Twitter.

About Justin Lynch

Justin Lynch is the Associate Editor at Fifth Domain. He has written for the New Yorker, the Associated Press, Foreign Policy, the Atlantic, and others. Follow him on Twitter @just1nlynch.

Share:
More In Cyber