HITB

HITB
Name	HITB
Type	Conference series
Founded	2003
Headquarters	Amsterdam
Language	English

HITB is an international series of conferences and events focusing on information security, vulnerability research, and applied cybersecurity. It convenes practitioners, researchers, vendors, and policymakers to present technical findings, demonstration exploits, and defensive techniques. The program typically blends keynote talks, hands-on workshops, capture-the-flag competitions, and vendor exhibits.

Overview

HITB unites speakers and attendees from a broad array of institutions including Google, Microsoft, Apple Inc., Facebook, Amazon (company), IBM, Cisco Systems, Intel, Nokia, BlackBerry Limited, Oracle Corporation, Siemens, Huawei, Samsung Electronics, Adobe Inc., Mozilla, Dropbox, Twitter, LinkedIn, PayPal, HP Inc., Dell Technologies, VMware, Red Hat, Canonical (company), CrowdStrike, Palo Alto Networks, Symantec, Kaspersky Lab, McAfee, FireEye, Checkpoint Software Technologies, Trend Micro, Fortinet, Bitdefender, Sophos, ReversingLabs, Mandiant, Recorded Future, Darktrace, Okta, Cloudflare, GitHub, Atlassian, Salesforce, Stripe (company), Square, Inc., Visa Inc., Mastercard, SWIFT, Interpol, Europol, FBI, NSA, GCHQ, Australian Cyber Security Centre, ENISA, NIST, MITRE, SANS Institute, OWASP, ISACA, IEEE, ACM, DEF CON, Black Hat (conference), RSA Conference, and BSides as participants, sponsors, or collaborators. The conference emphasizes original technical disclosure akin to work presented at Chaos Communication Congress, CanSecWest, BruCON, Hack In The Box (conference).

History

HITB traces origins to early-2000s underground and academic intersections where researchers from University of Cambridge, Massachusetts Institute of Technology, Stanford University, ETH Zurich, University of Oxford, University of California, Berkeley, Carnegie Mellon University, Georgia Institute of Technology, National University of Singapore, Nanyang Technological University, and Tsinghua University shared exploit techniques. Early editions featured contributors who later joined or influenced projects at DARPA, NSA, GCHQ, MITRE Corporation, Project Zero, CERT Coordination Center, Bugcrowd, and HackerOne. Over time HITB expanded geographically to include chapters and events in Amsterdam, Singapore, Kuala Lumpur, Dubai, Bangkok, Jakarta, and Istanbul, attracting presenters associated with Stuxnet, WannaCry, NotPetya, Equation Group, Shadow Brokers, Anonymous (group), Lizard Squad, Chaos Computer Club, Cult of the Dead Cow, and academic labs behind the Meltdown (security vulnerability) and Spectre (security vulnerability) disclosures.

Events and Conferences

HITB conferences run multi-track programs with hands-on courses resembling offerings at SANS Institute trainings, reverse-engineering sessions like those at ReversingLabs meetups, and hardware hacking workshops similar to DEF CON Groups activities. Typical content includes exploit development, kernel fuzzing inspired by Google Project Zero, firmware analysis like investigations into Juniper Networks and Cisco IOS issues, mobile security following research from Android (operating system) and iOS, and cloud threat modeling relevant to Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Competitive elements include capture-the-flag tournaments evoking DEF CON CTF and vulnerability disclosure panels featuring representatives from Bugcrowd, HackerOne, CERT/CC, ZDI, and Zero Day Initiative. Past keynote speakers have been affiliated with Bruce Schneier, Mikko Hyppönen, Dan Kaminsky, Charlie Miller, Chris Valasek, Marc Rogers, HD Moore, Joanna Rutkowska, Keren Elazari, Eugene Kaspersky, Peiter Zatko, and Kevin Mitnick.

Research and Publications

HITB disseminates technical reports, slide decks, white papers, and proof-of-concept code paralleling outlets such as USENIX, Black Hat Briefings, IEEE Symposium on Security and Privacy, ACM Conference on Computer and Communications Security, NDSS Symposium, WOOT (Workshop on Offensive Technologies), CCS, and Usenix Enigma. Research topics presented include microarchitectural attacks following Spectre and Meltdown, supply-chain compromise analyses referencing SolarWinds, automotive security research in the vein of Charlie Miller and Chris Valasek's work on Jeep Cherokee hack, industrial control system investigations related to Stuxnet and Industroyer, IoT botnet analyses similar to Mirai, biometric bypass demonstrations akin to attacks on Apple Touch ID and Android fingerprint, and cryptographic protocol critiques echoing concerns raised about OpenSSL and Heartbleed.

Community and Organization

HITB is organized by a professional events team working with regional partners, academic program committees, and industry sponsors including firms like Ruckus Networks, Akamai Technologies, Palo Alto Networks, Check Point Software Technologies, Imperva, and local cybersecurity startups. Community engagement includes mentoring programs inspired by Women in CyberSecurity, university outreach partnering with CyberCorps: Scholarship for Service, student competitions resembling CTFtime entries, and volunteer-run track curation similar to BSides chapters. The network fosters collaboration among independent researchers, corporate security teams, and government labs such as CERT Australia and SingCERT.

Criticisms and Controversies

HITB has faced critiques about responsible disclosure practices, echoing controversies around Zero Day Initiative payouts, the ethics debates surrounding Stuxnet-style offensive research, and tensions seen at Black Hat regarding vendor marketing versus technical rigor. Concerns have been raised over managing dual-use demonstrations comparable to disputes involving Project Veritas-style leaks, potential legal exposure reminiscent of prosecutions in Aaron Swartz and Richard O'Dwyer cases, and attendee safety after high-profile incidents at events like DEF CON and Borneo Hackerz Conference. Organizers have responded by tightening code-of-conduct policies, coordinating with local law enforcement such as Interpol liaison offices, and adopting disclosure frameworks advocated by ISO/IEC standards bodies and NIST guidance.

Category:Computer security conferences