Risky Bulletin: Sponsored Episode Summary Title: What Really Goes Down on Blackhat Wi-Fi Networks Release Date: May 11, 2025

In this sponsored episode of Risky Bulletin, host Tom Nguyen engages in an insightful conversation with James Pope, Director of Technical Enablement at Corelight. The discussion delves into the intricate dynamics of Wi-Fi networks at Black Hat conferences, shedding light on the security challenges and vulnerabilities encountered in such high-stakes environments.

1. Corelight’s Involvement with Black Hat Conferences

Establishing and Monitoring the Network

James Pope elaborates on his dual role at Black Hat Singapore, where he serves as both the SOC lead for the Network Operations Center (NOC) and the Director of Technical Enablement at Corelight. He explains how Corelight collaborates with reputable technology partners like Palo Alto Networks, Cisco, Arista, and Corelight itself to establish a secure and segmented network for the event.

“[We] select the right technology to help us solve a problem, whether it be Palo Alto Networks, Cisco, Arista or Corelight.”
[00:48]

Corelight’s primary responsibility involves network monitoring, leveraging a team of experts from various departments to oversee all traffic within the Black Hat network. Their goal is to identify and mitigate any malicious activities or security threats in real-time.

2. Detection Strategies and Black Hat Positive Alerts

Understanding Expected vs. Anomalous Behavior

James discusses the balance between recognizing legitimate activities aligned with conference sessions and identifying potential threats. Corelight employs AI and machine learning baselining to discern patterns that match the curriculum and expected behaviors within the classrooms.

“At Black Hat we let [Black Hat Positive alerts] go because you might be in that classroom learning it. You could be a presenter on stage presenting it. You could be doing a demo on the floor and we don’t want us breaking and stopping any of that.”
[02:18]

This approach ensures that essential educational activities are not disrupted while still maintaining vigilance against genuine security risks.

3. Common Vulnerabilities and Misconfigurations

Instances of Data Leakage and Mismanagement

Despite the ostensibly secure environment, James highlights several instances where vulnerabilities have been exploited. One notable example involved a weather application with five million downloads that continuously leaked GPS locations, enabling real-time tracking of users within the conference center.

“An application was misconfigured in one spot is sending out credentials.”
[03:13]

Additionally, Corelight has observed numerous cases of self-hosted services being improperly configured, leading to the exposure of sensitive information such as API keys and credentials in plain text. These oversights pose significant security threats, not only at Black Hat but across various networks globally.

4. Encryption Practices and Corporate Security

The Reality Behind Encrypted Networks

James discusses the misconception that all corporate environments maintain robust encryption practices. Despite widespread claims of encrypted communications, a substantial portion of network traffic remains unencrypted, leaving organizations vulnerable to data breaches.

“Everything’s encrypted. There’s probably not a lot you’re going to find in here every single time. Find stuff. Enterprise is still sitting 60, 40% encrypted, unencrypted.”
[06:32]

He emphasizes the importance of organizations actively monitoring and validating their encryption protocols to ensure comprehensive security.

5. Global Perspectives: Black Hat Networks Across Regions

Regional Differences in Security Practices

The conversation shifts to the variations in security practices observed in Black Hat conferences around the world. James notes that regions like APAC (Asia-Pacific) tend to implement more encryption compared to other areas, often driven by distrust in governmental oversight.

“APAC Asia typically has more encryption than anywhere else. There’s a lot more in Asia, like side loaded APKs for Android things. And that definitely increases the amount of detections and weirdness.”
[12:21]

Furthermore, he points out the prevalence of Android devices and side-loaded applications in the APAC region, contributing to a higher detection rate of anomalies and security incidents.

6. Notable Incidents and Case Studies

Real-World Examples of Network Compromises

James shares compelling stories from his experience monitoring Black Hat networks. One such incident involved a presenter’s laptop that triggered numerous security alerts due to malware infections. Despite initial resistance from the presenter, Corelight’s intervention led to the resolution of the issue after collaboration with the organization's IT team.

“We have this line and I wait in this line and I get to them at the end and I say, hey, I’m from the black adnoc. You weren’t by chance presenting on malware or on some like sandbox that you were detonating? And they said, no, I’m the CTO of Org.”
[13:07]

This incident underscores the constant threat of security breaches, even among participants who are presumed to be security-conscious.

7. Conclusion and Key Takeaways

The episode concludes with James emphasizing the critical need for continuous monitoring and proactive security measures. He advocates for organizations to utilize available tools, such as Zeek, to analyze their own network traffic and identify potential vulnerabilities.

“There’s no real excuse for an organization to not look.”
[07:08]

James encourages both individuals and organizations to take ownership of their security practices, leveraging technology to safeguard against increasingly sophisticated threats.

Final Thoughts

This episode of Risky Bulletin offers an in-depth exploration of the complexities surrounding network security at high-profile conferences like Black Hat. James Pope’s insights reveal the delicate balance between facilitating educational activities and maintaining stringent security protocols. The discussions highlight the pervasive challenges of encryption mismanagement, regional variations in security practices, and the ever-present risk of network compromises. For cybersecurity professionals and enthusiasts alike, the episode serves as a compelling reminder of the importance of vigilance and proactive measures in safeguarding digital environments.