‘Legacy system’ exposed Black Hat 2018 attendees’ contact information

https://techcrunch.com/2018/08/22/legacy-system-exposed-black-hat-2018-attendees-contact-information/

by RobertSmith • 8 years ago

101 59 8 years ago

ghaff10• 8 years ago

I guess this is a story because it's Black Hat and someone who wasn't supposed to be able to access this info did. However, conference attendee information is widely sold and shared as a matter of course. You shouldn't consider it as anything approaching confidential.

BuildTheRobots• 8 years ago

conference attendee information is widely sold and shared as a matter of course

Is that something people get warned when buying a ticket?

edit: https://www.blackhat.com/us-18/registration-terms.html#priva... links to https://legal.us.ubm.com/privacy-policy/#Choices which someone smarter than me should interpret.

walrus012• 8 years ago

These days pretty much anyone going to a tech conference that allows any sort of salespeople to attend, or vendor booths, should expect a high degree of spam. Email I can deal with, when they get my direct cellular number and won't take no for an answer, that's when the vendor goes on the "never buy" list.

ghaff10• 8 years ago

It's probably in some fine print somewhere. You can sometimes opt out of some sharing but exhibitors scan badges, you often get scanned when you attend breakouts, etc. Assume that any information you provide when registering for a typical conference (other than payment details obviously) will be widely shared.

adiusmus3• 8 years ago

Having never been to a black hat conference, I’m surprised that such people would be so easily open to attack. Surely no one gives out their real email address or phone details at these events? I hope they don’t take critical hardware with them full of secrets to be happily liberated by someone more enthusiastic. They wouldn’t have “interesting” conversations in taxi/ubers, would they?

Maybe there are less black hats at these conferences than the numbers suggest.

tptacek9• 8 years ago

I don't know if they warn you when you get a ticket, but I think it's impossible to go to a conference at Black Hat's scale and not understand what's happening. Black Hat is a trade show (much more so than it used to be) --- the research component is set off from the "expo", but the expo is huge. If you're staying in the conference hotel, I think there's even direct targeted swag delivered to rooms and stuff? (I might be confusing that with RSA).

It's not great to just dump contact info --- that happened to RSA Security a couple years back and it was a story then --- but it's mostly an optics problem, I think.

RobLach• 8 years ago

I mean, Black Hat is one of UBM’s products. It’s not like some underground get together.

Rotdhizon• 8 years ago

It's a bit more than that. Sure nothing overly sensitive was exposed, but it is more about the underlying system. The 'what-if'. What if sensitive information like PII was apart of that data set? Then all of it would have been exposed. That sure the conference was full of security professionals, but what level of expertise and competency is actually running the show?

ghaff10• 8 years ago

PII certainly was part of the data set. Just nothing that was sensitive. I don't disagree though. Certainly if plaintext payment information were part of the same record, that would be an issue.

matthew-wegner• 8 years ago

The conference is over, but it's certainly be more of a social engineering risk if it were used beforehand (especially people attending as aliases printed on their badges).

lawnchair_larry3• 8 years ago

Yep, most attendees seem to be unaware, but a big part of their sponsor/exhibitor pitch involves selling access to this data. Most booths have a gimmick, such as a giveaway or party invite, which requires scanning your ID badge. That scan transfers all of your personal info, including employer and job title, straight into their CRM. At BlackHat, despite the large price tag, attendees are the product, and vendors are the customers.

tptacek9• 8 years ago

If you've ever pitched a booth at a trade show like Black Hat --- I've never done Black Hat, but I've done RSA --- you know that you can just get the attendee list. It costs money but it's a product that is for sale. The point of the scan is not to collect as much personal information as possible, but rather to get a list of people who are interested in what you're selling; the scan is (very very flimsy first-pass) lead qualification.

vanrysss• 8 years ago

ironic

gammateam• 8 years ago

and nothing more

walrus012• 8 years ago

It's amazing the number of things you can find by simply enumerating through a sequential series of integers, in what is basically a "gimme data" request to some public facing data endpoint.

compostable• 8 years ago

Some guy went to jail for doing this.

jessaustin• 8 years ago

It's OK that was only 13 months because it turns out that the least ethical federal prosecutors are also the dumbest.

wolco• 8 years ago

If it is public I don't see a problem. Reminds me of wardialing in the 80s.

gwbas1c• 8 years ago

I once heard of a very major website essentially being DOS-ed because a scrapper was enumerating IDs in the URL. (Can't say the name because I signed an NDA.) The engineers involved all assumed the scraping was legitimate indexing by a 3rd party or researcher.

blablabla123• 8 years ago

Integrity is quite a thing ;)

driverdan• 8 years ago

Can we change this to the original post? https://ninja.style/post/bcard/

vvram• 8 years ago

in other words MQLs (Marketing Qualified Leads) from BH2018 are free (if your know how to get them).

walshemj2• 8 years ago

Why would you goto black hat and use your real name / identity ?

billyhoffman2• 8 years ago

Because real black hats don't spend multiple thousands of dollars to go to BH, unless they also have a corporate day job. In which case, they have no reason not to use their real name. Otherwise it gets a little awkward to meet your co-workers for a MS -sponsored happy hour with a con badge that says "Mr. ThE PlaGUe"

walshemj2• 8 years ago

But even if your a civilian player you might say I am "John" from Att or BT - but that's not your real name and you actually work for the security group.

metric10• 8 years ago

It's worth noting that Black Hat was spun off from Def Con to get corporations to allow employees to expense it. Often speakers at Black Hat also present at Def Con. Def Con as a matter of policy does not collect any information about its attendees [0].

[0] Read the fine print: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20rec...

jenkstom• 8 years ago

In related news, apparently 90% of the attendees were named "Chuck U Farley".

‘Legacy system’ exposed Black Hat 2018 attendees’ contact information

Related Stories