Free hack_it event aims to help cybersecurity pros hone their skills

On the heels of the exploitation of Microsoft Exchange servers and the SolarWinds hack, managed detection and response provider Huntress is hosting its second annual free hack_it event on March 23-24. The two-day virtual event is designed to let attendees sharpen their trade, network with security professionals and get hands-on training.

For the first time, Huntress is also offering a “Hacking Windows” pre-day on March 22, a four-hour virtual hands-on hacking lab with the goal of preparing IT staff to defend against threats to their networks.

SEE: Identity theft protection policy (TechRepublic Premium)

“We’re going to let folks get hands-on … and bring them into a virtual room and play pretend hacker,” said John Hammond, senior security researcher at Huntress. Attendees will learn how hacking works and the opportunities for threat actors when they assess a target. They will learn how the offense works, he added.

“The real mission is to get folks educated,” Hammond said. The two-day conference will offer three presentations, “and we don’t want it to be boring people to death with slideshows, so we’re trying to keep it simple.”

Some of the content will be repeated on the second day in the event that people can’t attend day one, he said.

SEE: Account takeover attacks spiked in 2020, Kaspersky says (TechRepublic)

The event is “by the MSP community, for the MSP community with members of the MSP community onstage with us,” Hammond said. That said, it is open to all security professionals at all levels of expertise.

“We want to make hack_it approachable for anyone,” he said. “We want to make sure whether you’re an absolute beginner and don’t know the difference between a mouse and a keyboard, or you’re an uber lead hacker and doing pen tests left and right—we want to bring something to the table.”

The most enjoyable thing from this event is that it will be audience-centric, Hammond said. The idea is to “have them drive the ship.”  

For example, the “Making the Malware: A Choose-Your-Own-Adventure” session will allow attendees to “break out your hacker hoodie and prepare to get shady” while planning a big cyberattack.

SEE: Meet the hackers who earn millions for saving the web, one bug at a time (TechRepublic)

Another session, “Cooking up Cybercrime: You Choose the Recipe for Ransomware,” imagines the attendee is the “head chef, and malware is on the menu.” The audience chooses “what ingredients go in our inject,” and they will learn about all the components involved in pulling off a big hack.

In the “Tales from the Trenches: Hacker Horror” session, members of the IT and small business communities will be able to share actual events they have worked through and provide insights and lessons learned.

Hammond stressed that beginner sessions are designed to be high level and offer role play, but a session he is participating in, “Under the Radar: Bypassing Antivirus,” gets technical, and attendees will craft a payload for offensive operations, and then refine it to bypass detection by antivirus software.

The SolarWinds and Exchange incidents “raise a lot of concerns about on-premises software I use and trust,” Hammond said, and “how come those indicators of compromise were not picked up by my antivirus software and my [extended detection and response] EDR?”

Huntress is tying hack_it “to real-world events and the activity we’re seeing in the industry and in the cybersecurity space,” he added. “We play with the mentality that understanding offense and knowing how the bad guys work is the best defense.”

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see