Black Hat has disabled features of its mobile app because attackers could have logged in as legitimate attendees, posted messages in their names and spied on the messages they sent. The problem was discovered by mobile security vendor Lookout who detail the problem in a blog that says the method of registration and password resets were flawed. Lookout says the problems stemmed from the fact that new accounts were created without email verification, and that even when users reset their passwords, authentication tokens werent revoked, so attackers logged in already could stay logged in.”]