Chaos Computer Club - archive feed

Exploration of the sensor hardware and programming of the flow3r badge. In particular the pressure sensor BMP581 and acceleration/gyrometer BMI270. I will give a quick introduction into the Bosch MEMS technology and sensors. Next I want to show some very basic steps how to use MicroPython on flow3r to play with LEDs and sensors. about this event: https://pretalx.c3voc.de/camp2023/talk/Z3CPTN/

In this talk Holger Levsen will give an overview about reproducible builds, the past, the presence and the future. How it started with a small BoF at DebConf13 (and before), how it grew from being a Debian effort to something many projects work on together, until in 2021 it was mentioned in an executive order of the president of the United States. And of course the talk will not end there but rather outline where we are today and where we still need to be going, until we'll all be running 100% reproducible software, verified by many. In this talk Holger Levsen will give an overview about reproducible builds, the past, the presence and the future. How it started with a small BoF at DebConf13 (and before), how it grew from being a Debian effort to something many projects work on together, until in 2021 it was mentioned in an executive order of the president of the United States. And of course the talk will not end there but rather outline where we are today and where we still need to be going, until we'll all be running 100% reproducible software, verified by many. And while Holger's day to day work and this talk will have a Debian focus, reproducible builds in other project will be featured and not be left behind as Holger has been involved in Reproducible Builds since 2014 and has been working on reproducing Arch Linux, coreboot, Fedora, FreeBSD, NetBSD, OpenWrt and others. Other important software projects will also be covered and last not least Holger will also explain why you'll want verifiable S BOMs and not just SBOMs. So what is this talk about exactly again? "A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts." (https://reproducible-builds.org/docs/definition) about this event: https://pretalx.c3voc.de/camp2023/talk/J7SDTF/

Dass wir bald von Superintelligenzen beherrscht werden, die wie ChatGPT Texte generieren, ist unwahrscheinlich. Aber es gibt offene Fragen: zu Wissensgerechtigkeit, Teilhabe und Monopolisierung durch Konzerne. Künstliche Intelligenz ist eine Projektionsfläche. Jetzt wird alles anders! Dabei ist die Beschäftigung damit, wie Maschinen Aufgaben erledigen, von denen wir bisher dachten, dass sie nur Menschen bewältigen können, fast so alt wie Computer selbst. Und auch die Probleme damit, wie Technik eingesetzt wird, sind ähnlich geblieben. Welche Zukunft darf es sein: Gerecht und frei zugänglich für alle, oder doch lieber in den Händen von wenigen? Es gibt offene Fragen: Wer produziert Wissen unter welchen Rahmenbedingungen? Ist das gerecht? Wie können wir uns als Menschen um mehr Gerechtigkeit bemühen und verhindern, dass die Macht der wirtschaftlichen Giganten unter dem Label "KI" noch weiter wächst? Ein Gedankenanstoß zur politischen und gesellschaftlichen Dimension des Hype-Themas der vergangenen Monate. about this event: https://pretalx.c3voc.de/camp2023/talk/EJBDYN/

16 years after the international Hackspace revolution, we are finding ourself in the midst of a global crisis with a search for answers. At Bio-Hack-Spaces we create mycelium based build materials, research new ways of growing (or foraging) our own food, build technological bridges to nudge nature in our desired direction or tinker on devices that help us to better understand our surroundings. 16 Years ago, a series of talks by Johl and Pylon on Hackspace Design Patterns sparked an international revolution. Within a few months tens of new Hackspaces were founded all over the world. And while the fun lasted for a while, we are now in the midst of a global crisis, that its least is urgently asking for mitigation strategies. At Bio-Hack-Spaces we create mycelium based build materials, research new ways of growing (or foraging) our own food, build technological bridges to nudge nature in our desired direction or tinker on devices that help us to better understand our surroundings. The Biopunk movement is in almost every regard comparable to the old school hacker movement. It is about resilience, creativity and autonomy. And yet, there is one fundamental difference: While you bend a computer to your will, you can only politely ask anything that lives. So in that sense, Biopunk is about understanding that we aren’t separated from nature, we are nature. And nature will teach us something that society needs more than anything else: the ability to listen. about this event: https://pretalx.c3voc.de/camp2023/talk/FBQJAG/

Menschen Fahren aus der Stadt aufs Land. Da fährt (sonntags) kein Bus, deshalb bringen sie ihr Auto mit. Dieser Talk erklärt, wie man vermeidet, dass der Ausflug ins Grüne zum Fiasko wird und wie sich auf dem Land der Strassenverkehr von Staedten unterscheidet. about this event: https://pretalx.c3voc.de/camp2023/talk/VYGPCZ/

Passwords suck, Multi Factor Authentication is hip, everyone wants to use it, but most methods rely on some kind of generated One-Time passcode, which are as vulnerable to phishing as the passwords they should help protect. Other possible factors, like app-based authentication also bring similar design flaws to the table A good alternative to insecure factors is the FIDO2 Standard, also sometimes referred to as WebAuthn, and its latest addition, passkeys. This presentation will demonstrate the functionality of FIDO2/WebAuthn and compare it to other possible (multiple) factors. It will also demo setup and some basic configuration. Special emphasis will be brought to passwordless authentication and the benefits and drawbacks of passkeys. about this event: https://pretalx.c3voc.de/camp2023/talk/R3ETSG/

Chaos Family Jugend Hackt about this event: https://pretalx.c3voc.de/camp2023/talk/2648/

Sometimes Windows can't be avoided, usually to run or dissect some weird piece of software. Fortunately, we have virtual machines for that, but installing or maintaining such an image is always a hassle. I built a web-tool based on open-source tools to make the experience of building such images much more enjoyable and discovered some interesting quirks and ways to run and install Windows. about this event: https://pretalx.c3voc.de/camp2023/talk/LLV8KV/

The energy consumption of datacenters is increasing exponentially. Local community heating is required to heat houses. The talk will give an overview of the existing problems and examples how data centers can be integrated into green power generation to heating concepts producing data center services en passant. 3% of global electricity consumption today and are projected to touch 4% by 2030. The average hyperscale facility consumes 20-50MW annually – theoretically enough electricity to power up to 37,000 homes[1]. Newer concepts reduce the energy for cooling to zero and integrate the datacenter into photovoltaic energy sources and local community heating as a sink[2]. Open source concepts allow to run a local cloud zone in this location regaining control of citizen data. [1] https://datacentremagazine.com/articles/efficiency-to-loom-large-for-data-centre-industry-in-2023 [2] https://www.ala-magazin.de/_thumbnails_/1680_2_JH-Computers_BHKW.jpg)](http://www.ala-magazin.de/ala-magazin/artikel/2021/jh-computers-gmbh.php about this event: https://pretalx.c3voc.de/camp2023/talk/KXXKKX/

Major states/cities in India have metro railway system for easy commute. The technology, _however_, has been exploited for a long period of time. I'll go through what's wrong with current system and how to make profit (free travel, I mean) out of it. The talk is majorly about NFC (majorly, MiFare DESFire EV1 cards & classic cards). Keep in mind that this is not a NFC 101. I barely understand NFC due to lack of documentation, I just know enough to make profit out of it. I'll go through the ideas that floated in my mind during this hacking journey and also all the issues that I fell into. about this event: https://pretalx.c3voc.de/camp2023/talk/VHABLM/

Microcontrollers are used in numerous applications and even in security-relevant areas, for example in form of hardware security tokens or crypto wallets. Hence, the non-volatile flash memory of microcontrollers contains sensitive assets such as cryptographic secrets or intellectual property, that need to be protected from being read out by adversaries. In order to prevent illegal extraction through the integrated debug interface, dedicated protection features are in place. In this talk, we take a look at an attack vector that we call *flash erase suppression*. This attack vector leverages that many microcontrollers allow to deactivate their debug interface protection under the condition that the entire flash memory is erased first. The attack suppresses this mass erase with a glitch whereby its contents are preserved and accessible through the activated debug interface. This type of attack was first presented by Schink et al. at CHES 2021, but only received little attention so far. The talk provides an introduction to this attack vector and gives a foretaste of a comprehensive analysis that will be published soon. The attack will be demonstrated live on stage with an exemplary microcontroller. about this event: https://pretalx.c3voc.de/camp2023/talk/AS9MQY/

. Frag die Teams about this event: https://pretalx.c3voc.de/camp2023/talk/2381/

. about this event: https://pretalx.c3voc.de/camp2023/talk/B7YFEV/

Our environment is full of technologies, connected objects and other gadgets that make our daily life much easier. It is indeed, quite easy to remotely command all kind of devices from our smartphones, with a single click. These technologies are also very efficient to help compensate certain handicaps but they have limits when it regards people whose handicap – or combination thereof - prevents them from manipulating a smartphone, reading a screen or using vocal commands. The good news is that it is not necessary to reinvent the wheel as alternative ways to interact with our technological environment, already exist. These solutions however, often stay inaccessible because their usage is judged too complex, their implementation considered time-consuming but mostly because of their (outrageous) price. As a patient, it can be very frustrating to be shut down from these possibilities to improve our quality of life and become more independent. That’s why I turned all my hopes to open-source hardware and tools, right after my I soldered my first TV-B-Gone, about 10 years ago :) I’ve been working on this “Impossible Interface” ever since. I can only describe it as a universal remote control that can also interact with non connected physical objects like the buttons of a lift or a simple light switch. The name Impossible Interface was chosen because of the amount of time I was told it was impossible to build such a device, especially for less than 500 euros but ... Bootchoo II, my latest prototype basically is a Arduino compatible 5 Axis Robot Arm (https://www.adeept.com/robotic-arm-uno_p0118.html) to which I just added a Bluetooth module and I am currently testing several ways of controls it. Ideally, commanding that little bot could be personalized depending on the type of handicap(s) that needs to be compensated. I am currently focusing on patients with low finger mobility, testing different sizes of joysticks as well as other “alternative remote” possibilities such as the ones offered by the MCH2022 badge and the Flipper Zero. As for the reason why I submitting this small talk – even though I am very shy – is because it is precisely not about me. Being as autonomous as possible is a need we all share and it should not be considered a luxury. I’ve mostly worked alone on this project but I got a lot of support from the Hacking Health Besançon association (https://hacking-health.org/fr/besancon-fr/), since I submitted this project during their latest edition. I’ll also admit that it is also time to ask for help to make this open-source assistive robot, safer, stronger and smarter and I can’t think of a better place to share my humble experiments, than at CCCamp. about this event: https://pretalx.c3voc.de/camp2023/talk/38XP9W/

Climate change is one of our biggest challenges, and therefore the way we get our power has to change: The newest revision of the Netzentwicklungsplan constitutes for a large amount of additional renewables and our power grid will undergo a transformation. A greater interconnection is needed to efficiently use these resources, but what will happen in case of an error, false values or even an adversial attack? This talk aims to give an Idea about the smart grid and how such questions can be talked using open source software and data. about this event: https://pretalx.c3voc.de/camp2023/talk/9BR9VH/

Die offizielle "Hacken, Dass?!"-Aftershowparty mit säuberlich kuratierter Bar. Das Pflichtprogramm für alle Fans! about this event: https://pretalx.c3voc.de/camp2023/talk/KLVEKE/

Exactly 5 years ago we were presenting ways to hack and root vacuum robots. Since then, many things have changed. Back then we were looking into ways to use the robots' "dumb" sensors to spy on the user (e.g. by using the ultrasonic sensor). But all our predictions were exceeded by the reality: today's robots bring multiple cameras and microphones with them. AI is used to detect objects and rooms. But can it be trusted? Where will pictures of your cat end up? In this talk we will look at the security and privacy of current devices. We will show that their flaws pose a huge privacy risk and that certification of devices cannot be trusted. Not to worry, though - we will also show you how to protect yourself (and your data) from your robot friends. You will learn on how you can get root access to current flagship models of 4 different vendors. Come with us on a journey of having fun hacking interesting devices while preventing them from breaching your privacy. We will also discuss the risks of used devices, for both old and new users. Finally, we will talk about the challenges of documenting vacuum robots and developing custom software for them. While our primary goal is to disconnect the robots from the cloud, it is also for users to repair their devices - pwning to own in a wholesome way. about this event: https://pretalx.c3voc.de/camp2023/talk/8ZEGLE/

Nachhaltige Kryptographische Sicherheit stellt insbesondere für stromsparende Hardware eine Reihe von Herausforderungen dar. Für Lösungen mit langer Einsatzzeit müssen heute auch die Sicherheit gegen Quantencomputer Berücksichtigung finden. Hashbasierte Signaturlösungen für den Raspberry Pi Pico ermöglichen beispielsweise Sensorlösungen, welche für Jahrzehnte kryptographische Sicherheit mit stromsparender, standardisierter und preisgünstiger Hardware ermöglichen. Wir präsentieren erste Prototypen aus einer laufenden Masterarbeit. Ruediger Weis Pierre Kurzer Nachhaltige Kryptographische Sicherheit stellt insbesondere für stromsparende Hardware eine Reihe von Herausforderungen dar. Für Lösungen mit langer Einsatzzeit müssen heute auch die Sicherheit gegen Quantencomputer Berücksichtigung finden. Hashbasierte Signaturlösungen für den Raspberry Pi Pico ermöglichen beispielsweise Sensorlösungen, welche für Jahrzehnte kryptographische Sicherheit mit stromsparender, standardisierter und preisgünstiger Hardware ermöglichen. Wir präsentieren erste Prototypen aus einer laufenden Masterarbeit . # Techfoo Raspberry Pi Pico W: * RP2040 microcontroller chip * Dual-core Arm Cortex M0+ processor, flexible clock running up to 133 MHz * 264kB of SRAM, and 2MB of on-board flash memory * Wireless (802.11n), single-band (2.4 GHz), WPA3 https://www.raspberrypi.com/documentation/microcontrollers/raspberry-pi-pico.html Implementierung: Grundlage: https://github.com/davidmcgrew/hash-sigs (David McGrew ist Mitverfasser des RFC8554) Modifikation: * Schlüssel-Cache auf on-board flash memory, Cache für Nodes des Hash Tree * Nur LMS (LM-OTS Hash Tree), keine HSS (Hierarchical Signatures) * Maximal können auf dem <2MB Festspeicher (Verfügbarer Speicher abzüglich MicroPython Interpreter und Lib) 128 Schlüssel im LMS-HashTree gespeichert werden * (Zusätzlich ist eine Abwägung der Größe zu speichernder Sensordaten vs. Anzahl Schlüssel notwendig, ggf. Schlüsselmenge auf 64 reduzieren) * Schlüsselgröße für Winternitz Parameter w=8-Bit, derzeit (gesamt: 288.8kB bei 128 Schlüsseln): o LM-OTS Private: 2184 Bytes o LM-OTS Public: 72 Bytes o Signatur: 2348 Bytes o LMS Private: 108 Bytes o LMS Public: 72 Bytes about this event: https://pretalx.c3voc.de/camp2023/talk/TLB9KC/

Chaos-Gala auf dem Camp. Stecker mit dem Radlader crimpen? Prozessoren am Geruch erkennen? Telefonnummern anhand des DTMF-Geräuschs hören? Mit Show-Acts und Triple-C-Promis auf der Couch. about this event: https://pretalx.c3voc.de/camp2023/talk/83HPJY/

Hardware is hard, right? Wrong. Building electronics prototypes has never been easier, and people who have been afraid to do it have nothing to fear. I'll tell you about how I build fancy high end devices with minimal, extremely cheap equipment, how it all works, and how you can do it too. We'll find out how to trick your body into making your hands not shake. We'll look at reflow soldering, the way the electronics assembly industry cheats in every possible way to save time, cost, and effort, and how we can do the same, but better, by hand. In 2015, someone was wrong on the Internet. To prove a point, I started teaching people how to prototype electronics. By now, I've taken thousands of people from zero to one boards built, and I think I've proved my point. Building electronic prototypes is easy. It has to be, because machines have to do it, and machines are terrible at what they do and have no idea when they've done it wrong. Humans can do better, more precise, and often faster. It just takes a bit of technique, a bit of practice, and a lot of courage. I'll take you through it, show you some fancy boards prototyped that way, and try to give you the confidence to attempt prototyping your own designs. about this event: https://pretalx.c3voc.de/camp2023/talk/8B9QES/

Die Deutsche Post DHL Group erhielt von Digitalcourage den BigBrotherAward 2023 in der Kategorie Verbraucherschutz für praktizierten Digitalzwang. Rena Tangens erzählt etwas zu den Beweggründen, aber vor Allem darüber, welch schräge Sachen sich danach ereignet haben. Die BigBrotherAwards prämieren Datensünder in Wirtschaft und Politik und werden einmal im Jahr verliehen. Als Preisträger eines solchen Negativpreises kann man auf einige Arten reagieren: Man kann den Preis ignorieren und weitermachen wie bisher oder man gelobt publikumswirksam Besserung, und ändert womöglich dann tatsächlich etwas. Die Deutsche Post DHL Group erhielt von Digitalcourage den BigBrotherAward 2023 in der Kategorie Verbraucherschutz für praktizierten Digitalzwang, und hat sich für einen recht kuriosen Weg entschieden, mit dieser Kritik umzugehen. Rena Tangens gibt euch einen Überblick darüber, wieso Digitalcourage ausgerechnet die Post und DHL Group für ihren ausgeübten Digitalzwang anzählt, und wird euch nicht ohne ein breites Grinsen im Gesicht erläutern, was die Preisträgerin sich danach alles ausgedacht hat, um sich mit der Kritik nicht auseinandersetzen zu müssen. about this event: https://pretalx.c3voc.de/camp2023/talk/DBMDYN/

On Track is a demoparty inside the chaos communication camp. In short: a demoparty is a multimedia art festival where the participants usually use any kind of computer or digital device for their creations. On Track is a demoparty inside the chaos communication camp. In short: a demoparty is a multimedia art festival where the participants usually use any kind of computer or digital device for their creations. Get your votekey NOW by contacting us on matrix (#ontrack:matrix.org channel), on the Demoscene Discord (#ontrack channel), on Mastodon (@[email protected]) or find us on the camp-site! The voting system is available at https://party.on-track.camp. You are of course encouraged to make an entry, but enjoying the event and voting for the entries is just fine! The following competitions will take place: - Photo - Combined graphics - Combined music - AI generated - A camp badge combo - New school demo - New school intro - Wild All infos including deadlines and "compo" specific rules as well as the timetable can be found at https://on-track.camp. Invitation to the party released at Revision: https://www.pouet.net/prod.php?which=94130 about this event: https://pretalx.c3voc.de/camp2023/talk/EHUHSS/

Debugging and Profiling ARM Cortex-M microcontrollers with GDB and Python. This talk gives you an overview of debugging ARM Cortex-M microcontrollers with a focus on the *practical* configuration and usage of the relevant tools. In particular, I will present: - Debug interfaces ([SWD](https://developer.arm.com/documentation/ihi0031/a/The-Serial-Wire-Debug-Port--SW-DP-)) and the associated debug probes ([J-Link](https://www.segger.com/products/debug-probes/j-link/), [STLink](https://www.st.com/en/development-tools/stlink-v3minie.html)) and libraries ([JLinkGDBServer](https://wiki.segger.com/J-Link_GDB_Server), [OpenOCD](https://openocd.org)). - How to install and configure [arm-none-eabi-gdb(-py3)](https://developer.arm.com/Tools%20and%20Software/GNU%20Toolchain) for debugging your ELF. - Commonly used [GDB commands and scripts](https://sourceware.org/gdb/onlinedocs/gdb/index.html). - Advanced [GDB scripting via its Python API](https://sourceware.org/gdb/onlinedocs/gdb/Python.html). - Inspecting [peripheral state](https://github.com/pengi/arm_gdb) with [CMSIS-SVD files](https://www.keil.com/pack/doc/CMSIS/SVD/html/index.html) and custom visualizations. - Dynamic call stack tracing and graphing. - Coredumping for post-mortem debugging via [CrashDebug](https://github.com/adamgreen/CrashDebug). - [Remote GDB scripting](https://github.com/cs01/pygdbmi) via the [Machine Interface](https://sourceware.org/gdb/onlinedocs/gdb/GDB_002fMI.html). - [ITM profiling](https://developer.arm.com/documentation/ddi0403/d/Appendices/Debug-ITM-and-DWT-Packet-Protocol?lang=en) over SWO pin using [Orbuculum](https://orbcode.org/orbuculum/). - Thread/IRQ/Workqueue scheduling visualization and latency analysis using [perfetto](https://perfetto.dev). - High-bandwidth [ETM tracing](https://developer.arm.com/documentation/ihi0014/) over TRACE pins: [J-Trace](https://www.segger.com/products/debug-probes/j-trace/) and [ORBtrace mini](https://orbcode.org/orbtrace-mini/). - Interesting related projects and possible future work. This talk is meant to introduce you to what is possible with embedded debug tools in practice, rather than to give you a comprehensive lecture. about this event: https://pretalx.c3voc.de/camp2023/talk/BQF8TR/

The climate catastrophe is imminent and global injustice is rising. Now a lot of new digital tech (AI, blockchain, big data, quantum computing) is supposed to help the transition to a sustainable society. Although some of them can actually help with parts of the transition, they are usually discussed not as tools to assist the broader societal change (economic, legal, social, political changes) but as replacement for the broader societal change. In effect they act as "change placebos" resulting in "placebo change", meaning no change at all. Giving concrete examples, this talk wants to explain 1) in which ways technological developents are misused as diversion from the necessary change and 2) the necessity to design concrete technical use cases including their conditions and limitations in order to create a fruitful debate for sustainability assisting technologies and their actually helpful implementations. about this event: https://pretalx.c3voc.de/camp2023/talk/UCKY8H/

Der Politikbetrieb der Europäischen Union läuft allzu oft unter dem Radar politischer Bewegungen, obwohl dort fundamentale Entscheidungen getroffen werden. Wir wollen uns einige aktuelle netzpolitische Themen anschauen und diskutieren, welche Rolle die Digitale Zivilgesellschaft als Teil einer emanzipatorischen Praxis einnehmen kann. Vorratsdatenspeicherung, Uploadfilter und Chatkontrolle - alle paar Jahre wird uns bewusst, dass die Grundlagen einer digitalen Gesellschaft in den komplexen europäischen Institutionen verhandelt werden. Dort werden - allzu oft ohne breitere gesellschaftliche Diskussion - Entscheidungen getroffen, die uns alle betreffen. Während die drohende biometrische Massenüberwachung vielleicht noch einige Aktivist*innen auf die Straße treibt, werden mit e-evidence rechtsstaatliche Grundsätze ausgehöhlt, dem European Health Data Space der Datenschutz gerade bei sensibelsten Daten untergraben und Polizeibehörden europaweit die Möglichkeit gegeben, personenbezogene Daten automatisiert abzurufen. Auch die Migrationsabwehr wird digitalisiert und ein umfassendes Kontrollregime für Menschen auf der Flucht innerhalb und außerhalb der technisch hochgerüsteten Grenzen geschaffen. Während Sicherheitspolitiker*innen, aber auch die Lobby großer Konzerne bestens vernetzt in Brüssel ihre Agenda durchsetzen, halten nur wenige sehr spezialisierte NGOs die Fahne der Emanzipation hoch. Im Talk wollen wir einige aktuelle europäische Themen vorstellen und das Selbstverständnis der Digitalen Zivilgesellschaft zwischen Expert*innentum, Brüsseler Vorzimmern und emanzipatorischer politischer Bewegung diskutieren. about this event: https://pretalx.c3voc.de/camp2023/talk/NLGAXT/