August 6th, 2007

Something uncomfortable about DEFCON's treatment of Dateline NBC reporter

Posted by Ryan Naraine @ 8:12 am

Categories: Black Hat, Botnets, Browsers, Data theft, Exploit code, Hackers, Metasploit, Open source, Passwords, Patch Watch, Punditocracy, Responsible disclosure, Vulnerability research, Zero-day attacks

Tags: Hacking, TV, Reporter, Hacker, Conference, Ryan Naraine

I don’t know about you but after watching the video and reading the reports (George Ou, Techmeme, Threat Level) about DEFCON’s outing of Dateline NBC producer Michelle Madigan, I came away with an uncomfortable feeling that it was rather childish, over-the-top and unnecessary.

For starters, there’s the irony of underground hackers preaching about rules and trust. Please. What’s so criminal about going undercover to get a news story? Hackers at this conference take great pride in doing man-in-the-middle password hijacks for Wall of Sheep giggles. DEFCON folks routinely commandeer Las Vegas television displays, ATM screens and hotel TV networks. Suddenly, OMG, a female TV reporter with a camera rigged into her handbag is a terrorist on wheels.

We’re talking about an entire sub-culture built on exactly what Madigan did — breaking the rules. This is an industry that celebrates the the ignoring of EULAs, encourages social-engineering (pretexting) and basks in the glory of sticking it to the man. Yes, law-breaking in the hacking world is romanticized.

So then, was it really necessary for DEFCON organizer Jeff Moss, a guy who is usually even-keeled and unruffled, to trigger a mob frenzy to get Madigan tossed from his conference?

The back story is that DEFCON was tipped off to Madigan’s plans to use a hidden camera to interview hackers for (this is where it gets really bizarre) for a story that would have exposed people admitting to hacking crimes.

Moss, who also runs CMP’s Black Hat conference, openly admits that his staff negotiated several times with Madigan to come clean by using a press pass. Show organizers were part of the plans to lure her to a packed hall where Moss would point her out, leading to “burn the witch” chants and a scary chasing of the female reporter through the parking lot.

Reporters were pre-briefed on the plans so they could get photographers in place for the ruckus. All this planning for a public spectacle seems so needless when Moss and his team could have simply walked up to Madigan quietly and have her expelled for violating the show rules.

What if Madigan had gotten hurt by some maladjusted person? Would Moss have accepted responsibility? These conferences are built on borderline anarchy so save me the preaching about ethics and trust.

Even more strange was the gleeful hand clapping by the bloggers and reporters who covered Madigan’s misfortune (Dan Goodin’s “scurries like a cockroach” tagline was among the nicer ones I’ve seen). Today it’s Madigan, tomorrow it may be you.