Mozilla Finds Flaw With Black Hat Video Stream 106
An anonymous reader writes "Mozilla web security researcher Michael Coates found a flaw in Black Hat's paid video feed. The flaw allowed him to watch a live feed of the conference for free instead of the $395 a head to connect. Unlike many presenters at Black Hat, Michael responsibly disclosed the flaw to organizers, who quickly fixed the issue."
Of course (Score:5, Insightful)
Unlike many presenters at Black Hat, Michael responsibly disclosed the flaw to organizers, who quickly fixed the issue.
If that seems like altruism, think: why would Mozilla want a bunch of black hat hackers pissed off at them?
Re: (Score:2, Interesting)
Re: (Score:2)
Maybe he felt that full disclosure was a good form of payment.
Re: (Score:3, Funny)
I think the "unlike" part of this story is that the issue was fixed rather than sat on for months.
Re: (Score:1, Interesting)
If that seems like altruism, think: why would Mozilla want a bunch of black hat hackers pissed off at them?
If this post sounds like cynicism, it is.
Re:Of course (Score:4, Insightful)
Re: (Score:1)
Re: (Score:1)
If that seems like altruism, think: why would Mozilla want a bunch of black hat hackers pissed off at them?
Fixed it for you.
If that seems like altruism, think: why would Mozilla want a bunch of black hat hypocritical hackers pissed off at them? After all, such rational is what black hatters use to justify almost every action, disclosure, and exploitation. To be pissed at such an exploit would mean thy are a bunch of small minded, hypocritical bitches.
Re: Too many glitches (Score:1)
in soviet rusia (Score:4, Funny)
Applications find bugs on black hats.
responsibility (Score:3, Interesting)
The responsibility aspect is one area where the Black Hat guys could earn a lot of respect by doing the right thing. It's a dick move to just disclose stuff without giving companies a chance to fix their mistakes, no matter how stupid it is.
Re:responsibility (Score:5, Insightful)
Then exactly how would they sale online streaming events for 395 and equally expensive conference tickets?
Re: (Score:1)
Re: (Score:2)
bandwidth certainly doesn't cost that much, and the equipment used has more than likely been paid for/paid for itself.
it's just a flat-out money pit.
Re: (Score:2)
Re: (Score:3, Insightful)
Most likely they want actual attendees and if it's too cheap to just watch the stream these computer people may just sit and watch it from the comfort of their own mancave instead of showing up.
Re: (Score:2)
That's easier access. Think about that for a moment. 500 physical attendees at so much a pop or MILLIONS of online attendees at a lower cost and still making more money?
DUH.
Re:responsibility (Score:5, Funny)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:3)
Excuse me, but were you there at Blackhat? No? Surprise.
Had you attended, you would have noticed that every presenter discussed vulnerabilities only after responsible disclosure. Nobody at Blackhat was surprising any vendors with 0day exploits. Timothy's summary above is full of shit.
Now, I won't say every vendor was responsible about patching their systems upon notification. Too bad for them. But the Blackhat guys were all approaching the topic responsibly.
Re: (Score:2)
"The responsibility aspect is one area where the Black Hat guys could earn a lot of respect by doing the right thing. "
That assumes DTRT is "respected" instead of "punished".
Prisoner's Dilemma? (Score:2, Interesting)
Interesting. You have an unknown number of users accessing the video feeds for free. The system has equilibrium and is yet unstable (they might find out at any time and block everyone). Now enter one prisoner who rats out everyone else. The end result? That one individual gets a free legitimate account and free access to the video streams while everyone else has their access blocked.
Honestly? It sounds like Michael Coates is a little bit of a douche. A small handful of users accessing the stream for
Re: (Score:2, Insightful)
Re:Prisoner's Dilemma? (Score:5, Funny)
Re: (Score:3, Interesting)
Ordinarily I'd say pirating video streams is morally questionable, but hacking access to the video stream of a security conference is so poetic that I refuse to believe it could be evil.
The best example that being a cracker is not synonym with being dishonest.
Even more, I see it as a good example of a wise strategy on long term: if disclosing the flaw before giving a chance the organizers to patch it would have exposed the organizers to ridicule. And one would rely on the same ridiculed persons to have a DEFCON 2011? Opportunism rarely make good sense in scarcity conditions.
Re: (Score:2)
I don't know where people get these ideas about Black Hat. Black Hat has some "interesting" attendees, but for the most part the audience is made up of security professionals. I go to Black Hat every year as part of work. Despite the name of the conference, the atmosphere there is very much "white hat." Some of the presenters are in the gray area, but most of the presenters are just other security professionals who are at the top of their game.
No punches are pulled at Black Hat, and the policy is full discl
Re: (Score:3, Interesting)
because it's stealing (Score:2, Insightful)
The product has a price. If you take the product without paying, you're stealing the product.
Why am I supposed to feel ad for those who had illegal free feeds and no longer do?
Bandwidth does cost money you know. I'll tell you what, I'll just start siphoning gas out of your car. Not so much that you can't afford it, but just a little. No harm done, right?
Re: (Score:1)
Umm, yeah, well, blackhats would never steal digital products, of course.
Watching a few self-proclaimed bad guys talk about security is like stealing from Mother Teresa, right?
Re: (Score:1)
$395 worth of bandwidth? Hmm, someone needs to get out of the early 90's...
Re: (Score:3, Insightful)
Just because the price is high doesn't make it not stealing.
If you think the product provides a poor value, then don't buy it and do without. Just as you would do if it were a shirt in a store.
Re:because it's stealing (Score:5, Insightful)
Call it unethical, freeloading, leeching, but not stealing.
Re:because it's stealing (Score:5, Informative)
I agree with you, and I also move that we start calling all RIAA employees pedophiles. It's a fine word, not a reference to the criminal code!
Re: (Score:2)
If the RIAA were involved in something that was something that was generally regarded to be pedophilia, but was not actually illegal but required the victim to sue, then I'm sure people would do so.
Bit like the way people call them bastards when most of them are probably legitimate.
Re: (Score:2)
Re: (Score:2)
On slashdot no, maybe most people wouldn't call that stealing. But out in the real world people very often would - this is the thing that I think many of the "information wants to be free" types don't quite get. Apart from student age groups and below, they are
Re:because it's stealing (Score:4, Informative)
v. stole (stl), stolen (stln), stealing, steals
v.tr.
1. To take (the property of another) without right or permission.
2. To present or use (someone else's words or ideas) as one's own.
3. To get or take secretly or artfully: steal a look at a diary; steal the puck from an opponent.
4. To give or enjoy (a kiss) that is unexpected or unnoticed.
5. To draw attention unexpectedly in (an entertainment), especially by being the outstanding performer: The magician's assistant stole the show with her comic antics.
6. Baseball To advance safely to (another base) during the delivery of a pitch, without the aid of a base hit, walk, passed ball, or wild pitch.
v.intr.
1. To commit theft.
2. To move, happen, or elapse stealthily or unobtrusively.
3. Baseball To steal a base.
n.
1. The act of stealing.
2. Slang A bargain.
3. Baseball A stolen base.
4. Basketball An act of gaining possession of the ball from an opponent.
Re: (Score:2)
To take (the property of another) without right or permission.
So whether this counts as stealing all really comes down to whether we are going to allow intellectual property to be a type of property. Sounds like and interesting debate but it is still a complete waste of time.
The reality is that when all the people here advocating watching a stream without paying for the content grow up and get a job producing something that can be easily digitised they will realise it is not so hot when people do this and then do not pay you for your work. Hell, maybe it is too expens
Re: (Score:1)
To take (the property of another) without right or permission.
So whether this counts as stealing all really comes down to whether we are going to allow intellectual property to be a type of property. Sounds like and interesting debate but it is still a complete waste of time.
I agree with the general emphasis and message of your post. However, you failed to notice that "take" and "copy" are two different words with different definitions.
Re: (Score:2)
STEAL
the wrongful or willful taking of money or property belonging to someone else with intent to deprive the owner of its use or benefit either temporarily or permanently. No particular type of movement or carrying away is required.
Any appreciable change in the location of the property with the necessary willful intent
Re: (Score:2)
Re: (Score:3, Informative)
That cost may be less than $395, but it's also greater than $0, so real theft is involved because someone is out some money as a result of the action. Not theoretical "lost sale" money, but real money that someone will have to actually pay.
Re: (Score:2)
If someone were to then go and take some of the crop (which would have spoiled anyway), should it have the same penalty as stealing it from the store?
Yes, because it's the same crime. A court might take into consideration, when determining punishment, whether anyone was harmed. But either way the rightful owner was deprived of his property. It's his choice how to dispose of his excess goods. It might be that he donates his overage to local charities ... in which case someone would be harmed by the criminal's actions.
Re: (Score:2)
Re: (Score:2, Funny)
Agreed, some people deserve money just because!
Re: (Score:2)
Re: (Score:3, Insightful)
No, they deserve money because they provided a service. Or do you not think that lawyers, programmers, stockbrokers and architects should not be paid, just because they haven't created a physical object?
Re: (Score:2)
Let's compromise. We'll agree not to pay the lawyers.
Re: (Score:2)
If only I could deal with my taxes in the same way.
Re: (Score:2)
"Bandwidth does cost money you know"
Bandwidth does not cost $395 per person for a medium-bitrate 24/7 video and audio feed from a conference.
Please. I could spend maybe 99 bucks per month for 2TB data throughput for my Camfrog video server and serve 10,000+ video streams simultaneously, and it would still take me about half a month to reach my cap.
Re: (Score:2)
Re: (Score:2)
And would that "bandwidth" just magically work, with no outside maintenance or infrastructure? What? You mean it requires servers, and salaried employees, and a host of properly implemented technology to provide bandwidth? And the company needs to actually make an operating profit in order to expand its offerings, replace old infrastructure, and develop new business? And you're also learning something new from a bunch of security experts?
Gee, maybe that's why it costs $395?
Your view is so reductionist i
Re: (Score:2)
I used to work for an ISP. I can do all of that MYSELF. No staff needed.
I ACTUALLY DO IT. Right now there's development on a multi-video monitoring station for each of our hydroponic tiers.
If you think it takes that much experience and knowledge, you're a fool. I've been at it since I was 16 broadcasting with a 10FPS webcam at 252x144 resolutions from my school's LAN.
Re: (Score:2)
I'm sure you *can* do all of that yourself.
I'm also sure that you *cannot* do all of that yourself in a reasonably timely fashion at no cost.
Pray tell - did your school's LAN infrastructure just magically self-assemble? Or did it cost money to build & maintain? And all of that just for your little cyber sessions - now imagine scaling it up to hundreds or thousands of users spread around the world.
If you continue to assert that it can be done at the scale of this conference without experience, knowledg
Re: (Score:2)
You can't equate the two. Bandwidth gets easier and cheaper with time. Oil gets rarer and has to be physically moved.
Re: (Score:2)
Because 99% of those watching for free can't or won't pay for it, and now they get nothing. Same reasons people pirate.
It's all right with me, as long as there's still gas for everyone else.
One person watching for free doesn't deprive everyone el
Re: (Score:2, Interesting)
I work with (Score:2, Insightful)
the company that organizes these online events. Believe me, this stuff is expensive to put together and while $395 is a lot of money, it does need to be paid for if conferences like this are to exist. Letting people in for free will detract from the exclusivity and ultimate quality of the event online or physical. Being Black Hat, it's not surprising someone figured out an exploit!
Re: (Score:1, Insightful)
Let's face it, black hat is just a shitty conference attended by self-proclaimed security researchers. And it's too expensive.
Responsible Disclosure (Score:5, Interesting)
Re: (Score:2)
Misleading (Score:5, Insightful)
Unlike many presenters at Black Hat, Michael responsibly disclosed the flaw to organizers, who quickly fixed the issue.
It's obvious why it was quickly fixed - because he disclosed it to the people who were losing out from the flaw.
A false contrast is being drawn to situations where a supplier, whose OWN security is not at risk and who frequently see discovery of flaws as more of a cost than a benefit, is not given sole access to the details of the flaw.
It could have ended up very different (Score:4, Insightful)
Bugs cost money to fix. In this case, fixing the bug could also cause more paying customers (the freeloaders also willing to pay, no matter how small their number). So it was in their best interest to fix the bug.
But let's be realistic here: Micheal Coates was lucky.
There are many instances (some of them documented extensively here), where reporting the bug causes the reporter financial and legal harm. Especially with security related bugs, companies see no potential gain in fixing the bug and cleaning up -- only costs, which piss off their investors. That is, unless the story gets out and people get angry. But by starting a fight with the honest, reponsible reporter, people are much more likely to think: 'must be a disgruntled customer/ex-employee/...'. Result: not enough bad publicity to raise a stink.
Wow... (Score:2)
... irony.
Re: (Score:2)
Obv (Score:3, Funny)
In Soviet Russia, Mozilla finds security flaw in Black Hat!
Yes but... back in the day... (Score:1)
That is the problem with Black Hat "Hackers" today... They are way too honest for their own good. Heck in back in my day, we would have all gotten in that conference for free, and we would be on our way to Paris to discuss it.