Skip to content

Torturing Open Government Systems for Fun

Dr. Tom Keenan

Dr. Tom Keenan explores torturing open government systems for fun at DEF CON 21, examining automotive-security and practical defenses.

Summary

Architecture and Background

Torturing Open Government Systems for Fun, Profit and Time Travel TOM KEENAN PROFESSOR, UNIVERSITY OF CALGARY "I'm from the government and I'm here to help you" takes on a sinister new meaning as jurisdictions around the world stumble over each other to 'set the people's data free'. NYC boasts in subway ads that 'our apps are whiz kid certified' (i.e. third party) which of course translates to 'we didn't pay for them, and don't blame us if somebody got it wrong and the bus don't come.' This session reports on my (and other people's) research aimed at prying out data that you're probably not supposed to have from Open Government Systems around the world.

Vulnerability Analysis

For example, Philadelphia, PA cavalierly posted the past 7 years of political contribution receipts which contained the full names and personal addresses of thousands of people, some of whom probably didn't want that information to be out there in such a convenient form. The entire database was also trivially downloadable as a CSV file and analysis of it yielded some fascinating and unexpected information. Referring back to classic computer science and accounting principles like 'least privilege' and 'segregation of duties' the presentation will suggest some ways to have our Open Data cake without letting snoopy people eat it.

Exploitation and Demonstrations

Tom Keenan (@drfuture) wrote his first machine and assembler language programs in 1965 and by 1972 was working as a systems programmer on the KRONOS and MULTICS operating systems. This led to a long career as a computer science professor, media commentator and writer about the human side of technology. He helped design one of the first automated DNA sequencing machines as well as a system for personal identification based on typing rhythm.

Remediation and Defensive Strategies

He has a Masters in Engineering and a Doctorate from Columbia University and has held a number of credentials including CISSP but doesnít feel the need for that now. An award-winning journalist, he co-authored the 1984 CBC Radio IDEAS series "Crimes of the Future" and is currently writing a book on creepiness to be published by OR Books. Blog: Materials:

Related talks

Main Stage·44 min

  • DEF CON
  • ICS / OT
  • Date: Aug 2014
  • Location: Las Vegas

Joshua Corman · Nicholas J Percoco

The Cavalry Year[0] & a Path Forward for Public Safety Joshua Corman CTO, SONATYPE Nicholas J Percoco VP STRATEGIC SERVICES, RAPID7 At DEF CON 21, The Cavalry was born.

automotive-securitycan-busvehicle-hacking+2