Comments on: Pwned @ hack.lu? http://blog.didierstevens.com/2007/10/19/pwned-hacklu/ (blog \'DidierStevens) Mon, 10 Jun 2013 08:49:54 +0000 hourly 1 http://wordpress.com/ By: Didier Stevens http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-16496 Mon, 29 Oct 2007 11:43:18 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-16496 That’s my Nokia N800, more pics here: http://blog.didierstevens.com/2007/06/05/omg-my-n800-is-infected/

]]> By: uber http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-16387 Sun, 28 Oct 2007 17:59:47 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-16387 Nice GUI. What’s that? Seems like Vista but…

]]> By: Hackers Blog » Blog Archive » Security conference attendees fall victim to man-in-the-middle hack http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15774 Mon, 22 Oct 2007 12:11:52 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15774 [...] witnessed a man-in-the-middle attack on the TLS at hack.lu (a hacker/security conference held in Luxembourg) [...]

]]> By: tlr http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15689 Sun, 21 Oct 2007 09:48:30 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15689 My bet is on ettercap, since the attacker used the default public key that is shipped with that piece of software — but of course that’s not proof.

Evidence and a bit of analysis are here:
http://log.does-not-exist.org/archives/2007/10/20/2144_hacklu_mitming_a_room_full_of_security_people.html

]]> By: achtung! http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15679 Sun, 21 Oct 2007 03:10:07 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15679 Yeah, there’s a way to create a fake certificate using Cain & Abel. Then you get a “secure” connection to the owner of the false certificate so you transmit your password :-P

]]> By: Benny K http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15666 Sat, 20 Oct 2007 23:33:30 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15666 Here is an analysis
http://log.does-not-exist.org/archives/2007/10/20/2144_hacklu_mitming_a_room_full_of_security_people.html

]]> By: Noah http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15665 Sat, 20 Oct 2007 23:01:14 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15665 Someone used Cain & Abel in APR mode between the gateway and it’s users…?

]]> By: Benny K http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15602 Fri, 19 Oct 2007 23:36:36 +0000 http://blog.didierstevens.com/2007/10/19/pwned-hacklu/#comment-15602 And still a lot of people clicked through (they told me). I also saw it and I checked the name and the CA and it seemed fine. The analysis from someone in the public on the beamer was breathtaking.

And a lot of people in the audience were security professionals. I guess no one is perfect. It was a devious attack.

]]>