Conference details iPod threats

VANCOUVER -- That innocent-looking iPod plugged into your computer could take over your network.

Or so warned speakers at this year's CanSecWest05 conference, where more than 300 cybersecurity experts and computer hackers from 40 countries gathered to swap cutting-edge information, tips, and tricks.

"This conference is where I go to learn what guys like me are working on in terms of advancing the state of the art of security," said Martin Roesch, chief technology officer of Sourcefire, a Columbia, Md.-based company specializing in network defense.

Unlike other hacker or cybersecurity conferences, CanSecWest doesn’t attract the normal bevy of corporate vendors hawking their wares or government types seeking business partners. For the past six years, it has been a conference of, by, and for hard-core code gurus who actually create the software that businesses and governments use.

Roesch, for example, is known for creating Snort, the most popular open-source software for detecting computer network intrusions.

The conference attracts managers of technical groups within companies and federal government agencies, said Dragos Ruiu, the organizer who is a Canadian computer security consultant for business, governments, and the U.S. military. CanSecWest also attracts hackers who come to learn new techniques to exploit computer networks, Ruiu said.

Headline presentations this year included the iPod revelation. Peripherals like the popular iPod and other items that link to computers through USB and Firewire connections and PCMCIA cards can download tiny, targeted software programs that can give hackers control of a computer and everything connected to it through an enterprise network.

Other events are perennial favorites, such as discussions of vulnerabilities in Microsoft Windows. This time around, participants looked security flaws when Windows works with certain wireless cards.

And for the first time, Ruiu said, there is a serious discussion about security concerns for Apple’s operating system because of the recent release of OS X.

CanSecWest ’05 is unlike any other cybersecurity conference. The dress code is a black T-shirt and jeans, not a business suit. Staff members wear martial arts gis and Ruiu runs things in full black samurai regalia. Participants gather around laptops, beer in hand. Attendees can sign up for "lightning talks," in which they have five minutes to throw out new ideas and get feedback.

The atmosphere is geek chic but the work is serious. Participants discuss endemic flaws in networks, operating systems, and critical software, Ruiu said. They also present their research into known and previously unknown security vulnerabilities. Some of the discussions become breaking news outside the code-guru community.

For example, last year Paul Watson, formerly of Rockwell Automation and now with Google’s security division, discovered a way to send tiny packets of information to computers that would disrupt router communications. The right packets hitting the right servers could have shut down part or the entire Internet.