Recalling the big uproar last year at Black Hat, this story caught my eye in the news.

Cisco to be under scrutiny again at Black Hat
Though some high-profile researchers not slated to present

July 19, 2006 (IDG News Service) -- Cisco Systems Inc.'s products will again come under scrutiny at this year's Black Hat USA 2006 conference, which kicks off later this month in Las Vegas.

Conference organizers say that 15 new exploits will be discussed at this year's event and that two of them target NAC (Network Admission Control) and VoIP vulnerabilities that affect products from a number of vendors, including Cisco.

Security researchers, no longer as focused on digging up bugs in core Windows components, are looking for green fields, said Black Hat Director Jeff Moss.

Last year, Cisco sued Black Hat conference organizers after security researcher Michael Lynn demonstrated a method for running unauthorized code on a Cisco router. It was a difficult technical achievement that had been considered impossible by some, but Cisco saw it to be a dangerous disclosure of information that could be used to harm the Internet's infrastructure.

Cisco has been working much closer with the Black Hat team and was listed as a sponsor of the event this year. It's unlikely we'll see the sort of controversy around Cisco we saw last year.

This year, I can't attend Black Hat, but I'll be watching for the outcome of another presentation mentioned in the article -

A second presentation, given by researchers at 3Com Corp. and SecureLogix Corp. will examine the SIP (Session Initiation Protocol) used by VoIP systems. "In it, we describe and demonstrate many real-world VOIP exploitation scenarios against SIP-based systems (Cisco, Avaya, Asterisk, etc.)," the presenters wrote in a description of their talk. That description can also be found on the Black Hat site.

With the rapid and continuing increase of SIP utilization in networks, groups like Black Hat will focus more on findng the genuine, exploitable vulnerabilities that exist in any communications protocol.


Technorati Tags: Black Hat, Cisco, Infosec. VoIP Security