Convention tips the hat to hackers

He wears a furry Russian hat and a wool cape.

He calls himself President Bogdan, and he wants to steal your identity.

"Have you ever been to Hackistan?" he asks passers-by in a thick Arab accent. "If you like to visit, just give me your Social Security number."

President Bogdan and his country, whose slogan is "A proud nation that sneers at the global conventions of intellectual property," were a creation of Fortify Software. But the threat they represent is what has brought 4,000 people to Caesars Palace this week for the annual Black Hat USA conference.

Black Hat caters to professional hackers, government agents and computer security enthusiasts who spend their days protecting their software, Web sites and networks from ill-intentioned hackers. The conference features companies selling the latest security products and speakers talking about computer vulnerabilities and solutions.

Influencing much of the discussion at Black Hat and the upcoming Defcon convention are two major computer attacks this year: a well-coordinated strike on the Baltic state of Estonia that crippled the Web sites of banks, media outlets and government agencies, and a data breach at the parent company of T.J. Maxx and Marshalls stores that exposed at least 45 million credit and debit cards to potential fraud.

The attacks are reminders that online criminals are increasingly driven by money and ideology, rather than the challenge of infiltrating a vulnerable computer system or Web site, experts said.

"The motivation is different, and the resources behind it are different, which makes it a much greater threat" than in previous years, said Jim Christy, director of Futures Exploration in the Defense Department's Cyber Crime Center.

Black Hat is the more mainstream of the two events and attracts scores of corporate sponsors, including Microsoft and Google. By comparison, Defcon is considered more of a renegade affair. It bills itself as the world's largest underground hacking convention and is known for its more motley attendance and wild hacker competitions. Defcon starts Friday at the Riviera.

In recent years, many of the biggest technology companies have come to embrace the ability of Black Hat and Defcon hackers to publicly poke holes in their products, even sponsoring contests to discover problems and make their technologies safer.

But the demonstrations can put corporations in an uncomfortable position, as some of their most profitable products can suffer attacks that would potentially expose their customers' private information or damage critical infrastructure.

Some of the juiciest consumer targets at this year's hacker conventions are Apple Inc.'s iPhone, social networking Web sites, software for routing voice calls over the Internet and Microsoft Corp.'s Vista operating system.

Richard Clarke, former top counterterrorism adviser to President Bush, told attendees Wednesday that basic flaws in the Internet's infrastructure should be remedied in part through government and international intervention.

"We're building more and more on top of cyberspace, and we haven't secured it," Clarke said. "(The threat) gets worse every year."

Conference attendee Jeff Vincent said he loses sleep worrying about all the threats facing his company, ICMA-RC, which manages retirement accounts for 650,000 public employees.

"There are 100 to 200 vulnerabilities," Vincent said. "As the bad guy, I only need one of those to get in."

The Associated Press contributed to this report.