Another Black Hat has come and gone. After taking the week off to let those who attended security summer camp recover from the Vegas heat, the conference chaos, and the one-too-many drinks, it’s time to break down what actually happened among all of the madness.
Black Hat is always one of the most interesting conferences of the year. Firmly sandwiched between BsidesLV and DefCon, it always brings a unique mix people and their research to Vegas. This year (Semmle’s second visit to Black Hat), was no exception.
A security reasearcher’s journey
One highlight of the event was a talk by Semmle’s CSO, Fermín J. Serna. In his talk he discussed the importance of open source code security. He also showed how to use Semmle QL to track down variants of a seed vulnerability he discovered in the U-Boot loader. By creating a custom query to find these variants, he was able to quickly discover a number of additional vulnerabilities, eventually leading to 13 CVEs. This talk was a great demonstration of the power of QL.
Capture the flag
Speaking of U-Boot, our team brought a special challenge to BlackHat this year. I created a capture the flag (CTF) challenge based on the same U-Boot vulnerability from Fermín’s presentation. The CTF utilizes the U-Boot codebase to teach you how to write QL queries of your own. If you would like to test your vulnerability-hunting skills to find variants of a real vulnerability, check out the CTF here. If you complete the challenge and send us your results, you are in with a chance to win cool prizes, such as Bose noise cancelling headphones. We are extending the submission deadline to September 6th, so act quickly!
The booth
The Semmle booth was back and better than ever. With a full team available to give demos and answer questions, it seemed as though we always had a crowd. Some people were interested in our impressive list of CVEs, some were interested in our “Spot the Vulnerability” challenge, while others simply wanted to talk about all things security. Whatever their reason for stopping by, they almost always stayed to hear what we had to say and left with their Semmle info sheet in hand. Some of them even volunteered to have their badge scanned, so they could stay up to date with the latest Semmle news. The booth was definitely a major hit, and gave us the opportunity to chat with both existing Semmle users and to meet many new faces.
The party
After a long day at the booth, we were able to take a break from the conference chaos by throwing a party in the penthouse suite. The party, a joint venture between Semmle and IOActive, had an amazing turnout. It was fantastic to chat with fellow conference goers over a security-inspired cocktail while enjoying the breathtaking views of the city below. It was quite the experience, so don’t miss out on it next year.
The conference
When not manning the booth, the was time to wander around the crowded halls of Black Hat, taking in everything the conference had to offer. There were shirts aplenty to be had, talks to listen to, and it was rumored that one booth even had Britney Spears available for selfies.
I spent time picking locks, catching up on the latest security news and technology, and loading up on swag. One of the most interesting places on the show floor was across from the main hall: the Black Hat Arsenal.
The Arsenal was an exhibition space and demonstration area for researchers and developers to highlight free and open source tools they had recently released. The organisers definitely did a great job with it, and you should have it on your list of things to see next time you are at a Black Hat event.
All in all, Black Hat was an incredible success this year, so hats off to Black Hat.
Want to learn more about what we do?
At Semmle, we are pioneering new techniques in variant analysis to quickly discover new vulnerabilities and their variants in any codebase within hours rather than weeks. Top security teams at Microsoft, Google, and Uber use Semmle to protect their customers.
Our vision is to secure software, together. With over 1,600 QL queries contributed by the Semmle Security Research Team in partnership with our growing customer community, your security team is instantly extended with the capabilities of the top security researchers on the planet.
