Black Hat 2015: 10 Security Threats To Watch

Black Hat Hackers

Hackers and security researchers converged in Las Vegas this week to reveal the latest and greatest threats facing security professionals today.

In presentations at the Black Hat 2015 conference, demonstrations showed how the rise of the Internet of Things, connected devices, new mobile technologies and other developments have opened up the door to more threats than ever before.

The threats not only have implications on a business, but many of them have real life or death consequences on end users. Among the possible targets: cars, factories -- and even Apple's Mac.

Take a look at 10 (pretty scary) security threats that were revealed at Black Hat this year.

Car Hacking

Probably the most publicized threat coming into the Black Hat conference was car hacking. A few weeks before the event, hackers Charlie Miller and Chris Valasek publicized their ability to hack into a Jeep Cherokee using a zero-day exploit in the car's UConnect system and ultimately crashed it into a ditch on the side of the road. While the hackers teased the event in a Wired article in July, they unveiled the details behind remote hacking an unaltered, factory vehicle in a briefing at the event. The hackers demonstrated how to use remote exploitation to ultimately gain access to electronic control units, physical systems and more.

Hacking Chemical Plants

While Black Hat probably wouldn't let hackers actually use their skills to destroy a real-life chemical plant, hackers did demonstrate a simulated attack on a chemical plant that damaged the plant's productivity and could ultimately put it out of business. In the briefing, Marina Krotofil, senior security consultant at the European Network for Cyber Security, said that these types of attacks are challenging for hackers, as attack patterns often cause real-world changes that will trigger an investigation. For now, that leaves this realm of attacking to more skillful hackers, though Krotofil did provide some pointers to hackers in the audience.

Mac Attacks

Android and Windows devices are often the targets of hackers, but that could change, multiple briefing sessions at Black Hat said. The briefings detailed how hackers can create effective malware to bypass Apple's native malware mitigations and third-party security tools and how Macs are actually vulnerable to software-only firmware attacks (long thought to be possible only on PCs). In addition to computers, other sessions dug into neglected attack surfaces on iOS 8 mobile devices that hackers have yet to exploit and how security professionals can address those areas before they are exploited.

Biometric Hacks

Biometrics is growing in popularity, with recent iPhones rolling out with the technology and more companies embracing it for two-factor authentication solutions. However (like most things), this technology does not come without risk. For example, in one session, security researcher Di Shen from Qihoo360 detailed how hackers could exploit vulnerabilities in ARM TrustZone technology on Android devices, especially those using the Huawei Hisilicon Kirin 925 processor, which would ultimately give them access to fingerprint images or let them bypass security features on the device. Going forward, vulnerabilities like this and a growing attack surface mean that security professionals will have to keep a closer eye on how these biometric technologies are implemented.

Stagefright

Another vulnerability that hit headlines before Black Hat was Stagefright, a vulnerability discovered by Zimperium zLabs that opened the door for hackers to access a user's mobile device knowing only their phone number. Researcher Joshua Drake detailed in a presentation at the conference how this vulnerability in the Android Stagefright multimedia framework could affect as many as 95 percent of Android devices and opened the door for attacks ranging from unassisted remote code execution to simple denial of service.

Attacking Gas Pumps

The Internet of Things creates all kinds of new attack surfaces to take advantage of. One example of that was presented at Black Hat, showing how hackers had attacked several Guardian AST gas pump monitoring systems over a period of a few months. The attack extended from the pumps themselves to the systems associated with them. A script called Gaspot, released at the end of the presentation, can help prevent against this sort of attack with virtual monitoring systems.

Hacking Firearms

Using a Linux-powered rifle, gun owners get perks such as a scope that can follow targets, calculate ballistics, record video and increase shot accuracy. However, in a presentation at Black Hat, security researchers and experts Runa Sandvik and Michael Auger demonstrated how those features in Austin startup TrackingPoint can be exploited by reverse engineering the rifle's scope, firmware and mobile applications. As network-connected firearms enter the market, the two discussed in their presentation the possible impact and dangers that could have going forward.

SIM Cards

Following up on revelations that the NSA and GCHQ had access to millions of keys for encrypted SIM cards, security researcher Yu Yu demonstrated at Black Hat how 3G/4G SIM cards could be cloned by using differential power analysis to crack encryption keys in less than an hour. Then, by using an oscilloscope, MP300-SC2 protocol analyzer, a self-made SIM card reader and a PC, hackers can clone the SIM card. This is the first time there has been a practical attack of this kind against 3G/4G SIM cards, the presentation said.

Active Directory Attacks

Following up on a 2014 Black Hat presentation on an Active Directory vulnerability using what were called "Golden Tickets" that gave hackers access to unlimited admin rights to a network, this year's Black Hat presentations dug into the latest and greatest methods hackers are using to gain access to Active Directory. More important, for security professionals, there are ways to detect this sort of attack (which was previously thought to be undetectable) using tools such as SPN scanning, identifying forged Kerberos tickets, detecting offensive PowerShell tools and more.

Payment Devices

Apple Pay hit the market last fall, joining other payment technologies such as Google Wallet that were already on the market. With the rise of NFC payments comes a concern around hackers using cloning to create fraudulent transactions, a Black Hat presentation said. By using an off-the-shelf phone and software, hackers can clone common NFC payment cards to charge fraudulent transactions.