Chaos Computer Club - archive feed

In this talk, we will revisit some of the scariest stories we faced during more than 50 penetration testing and security research projects, with a twist. In the ever-emerging industry of automotive, with old and new OEMs trying to get a share of the pie, many things are at stake, with many things getting overlooked, forgotten, or even deliberately covered. We will go through a journey of critical findings in different targets and the constant battle between penetration testers, developers, and mid to upper management. This will help the audience get an understanding of how the industry behaves right now, what they (and what we) are doing wrong, and how the future of automotive security should be shaped, not only for the sake of security, but also for the sake of safety and reliability. This talk will try to raise awareness on the current state of automotive security, how does the industry behave in the whole spectrum of it (100-year-old OEMs to 2-year-old OEMs and Tier 1 suppliers) and ultimately try to propose a way forward for both the automotive and security industries, with the goal being a safer and more reliable future for everyone, in and out of the streets. Working with some of the biggest OEMs and Tier 1 suppliers on pre-production vehicles gave us an understanding and experience of the whole spectrum of developing a vehicle, from architectural design to homologation and sales. This led us in many realizations and pitfals that the automotive industry falls into, and in order to avoid another Miller/Valasek we have to educate the people of the industry. While most of the people/companies in this industry try to keep the gates closed for apparent reasons, we try to share as much as possible, with the hope of making a change to the industry that will have an impact on how and where it progresses in the future. about this event: https://pretalx.c3voc.de/camp2023/talk/UEHEVD/

Sex workers have always been at the vanguard of technology—in ways that protect and restrict their rights. Laws and policies that impact sex workers never stop at this population so it is imperative that these case studies reach general audiences concerned with human rights as a whole. This talk will include a history of surveillance mechanisms directed against sex workers and will focus on the ways and means that digital surveillance has been impacting sex worker rights of mobility and free expression in recent years. New laws enforcing the censorship of pornography and the collateral damages they levy on reproductive health and LGBTQ+ community building will be discussed as well as border crossing and payment processing. Information about how AI and facial recognition software target sex workers will be detailed as well as the tools, advocacy, social engineering strategies sex workers can use to fight back. This talk is not limited to sex workers and their allies. It will include a primer on why sex worker rights include all human rights and show evidence that these laws are not limited to sex workers at all. LGBTQI+ people and reproductive health activists will be immediately impacted as well as all people who believe in the freedom of information. about this event: https://pretalx.c3voc.de/camp2023/talk/8HF9X9/

Chiptune , 16 step looper, live performed on a NDSLite I make chiptune using Game Boys with the software called Nanoloop2. I will play for 1 hour. You might have heard my loops at Congress, GPN, SHA, CPU and MRMCD. I wrote a few new ones that I presented at GPN21 which can be heard here: https://www.youtube.com/watch?v=-VNmZGe2SN0 For other sound samples please visit my profile https://chaos.social/@bobo_pk or have a look at https://peertube.1312.media/w/cu1fPFfy49kgFhzs8NrgJp UPDATE: btr and nr4 will perform live visuals. I gave this workshop and am planning on doing it again on camp as SOS if you are interested. https://cfp.gulas.ch/gpn21/talk/L8CRA8/ about this event: https://pretalx.c3voc.de/camp2023/talk/MEMSEH/

Apple strongly emphasizes the security and privacy of its devices and services. I analyze the dual-hop architecture, deployed protocols, and inner workings of their privacy-centric, VPN/Tor-alike service iCloud Private Relay. I will talk about my reverse engineering process and falsify Apple's privacy by design and access control claims. Apple's iCloud Private Relay is a novel Internet privacy service allowing users to securely and privately browse the Internet. It is directly implemented into Apple's operating systems and included with all iCloud+ subscriptions. Compared to traditional VPN services, Private Relay's dual-hop architecture separates the knowledge of the user's IP address and their destination website between two different Relays. Apple operates the first Relay while the second one is by one of its four partners: Akamai, CloudFlare, or Fastly. Apple claims its architecture enforces enhanced protection of users' privacy ("privacy by design") while still providing a high-performance browsing experience. Their president of software engineering, Craig Federighi, even mentions that Apple does not want users to have trust in them. Further, the company claims its service incorporates anti-abuse and fraud prevention mechanisms. As Private Relay validates any connection at the account and device level, website operators can trust them. I reverse engineer Private Relay's macOS implementation, present its involved technical components and how they collaborate. With that gained knowledge, I analyze authentication and authorization mechanisms deployed by Private Relay regarding potential ways of abuse. Furthermore, I review the privacy claims regarding the architecture and its deployment. about this event: https://pretalx.c3voc.de/camp2023/talk/7RDPNH/

Rebuilding target files when source files have changed is seems easy, but is not. Commonly used build systems (make, ninja, etc.) are often unable to guarantee both that they rebuild only what needs to be rebuilt and that they do not rebuild what does not need to be rebuilt. I will show how to reliably encounter common build system failure modes and explain which architectural choices lead to those. Using DJB's “redo” design as an example, I will show how build system architecture determines if failure modes can be addressed at all. Lastly, I will speculate why many developers dismiss such issues before encountering them – and some even do afterwards. ”Listen Morty, I hate to break it to you, but what people call a build system is just a bunch of rules that compel computers to output garbage. It hits hard, Morty, then it slowly fades, leaving you stranded with a mis-compiled binary. I did it. Your friends are gonna do it. Break the cycle, Morty. Rise above. Focus on build correctness.” about this event: https://pretalx.c3voc.de/camp2023/talk/CFASNP/

Fireside Talk about the birth, life, death and rebirth of Hackerspaces about this event: https://pretalx.c3voc.de/camp2023/talk/8544/

Because a scheduled speaker didn't appear, BoboPK steps in and gives a short introduction und wrap up of the demoscene. The scene started with the home computer revolution of the early 1980s, and the subsequent advent of software cracking. Crackers altered the code of computer games to remove copy protection, claiming credit by adding introduction screens of their own ("cracktros"). They soon started competing for the best visual presentation of these additions. Through the making of intros and stand-alone demos, a new community eventually evolved, independent of the gaming: and software sharing scenes. about this event: https://pretalx.c3voc.de/camp2023/talk/ZHFJ7Q/

Warum brauchen wir digitales (Bar-)geld? Welche Eigenschaften müsste eine gute digitale Währung haben? Wie könnte sich unser Alltag dadurch verändern? Und wie funktioniert das in der Praxis? Christian Grothoff (GNU Taler), Leena Simon (Digitalcourage) und padeluun (Digitalcourage) diskutieren, Publikumsbeteiligung erwünscht. Die etablierten bisherigen digitale Bezahlmethoden sind alles andere als anonym. Neben den klassischen nicht anonymen Bezahlmethoden durch Überweisung und Kreditkarte (die zunehmend nur noch über den Umweg großer Finanzdienstleister angeboten werden), gibt es privatwirtschaftliche Finanzdienstleister wie Paypal, Amazon Pay und Klarna, die jede Menge Daten sammeln und mit ihrer Marktmacht immer unausweichlicher werden. Darüber hinaus gibt es verschiedene Crypto-Währungen wie den Bitcoin, die aber auch nicht wirklich anonym sind. padeluun und Leena Simon erklären, wie sie sich digitales Bargeld vorstellen. Christian Grothoff ist einer der Erfinder des [GNU Taler](https://taler.net/de/index.html) und berichtet, welches Konzept hinter dem Freie Software-Bezahlsystem steckt und welche praktischen Feldversuche es damit bisher schon gab. about this event: https://pretalx.c3voc.de/camp2023/talk/CVYSWW/

Logbuch:Netzpolitik (LNP) ist der Versuch, das netzpolitische Geschehen im deutschsprachigen Raum weitgehend neutral, unaufgeregt und meist gut gelaunt in einem regelmässigen Podcast einzufangen. Der Podcast soll Einblicke in die Themen aber auch Verständnis für die Hintergründe bieten. Aufzeichnung einer Live-Sendung auf dem Chaos Communication Camp 2023 in Mildenberg. Vor zahlreichen Gästen haben wir mit Julian Hessenthaler gesprochen, dem Initiator des Ibiza-Videos, das die Korruption der FPÖ-Eliten im allgemeinen und Heinz-Christian Strache im besonderen plastisch demonstriert hat und letztlich zum Scheitern der damaligen ÖVP-FPÖ-Koalition geführt hat. Wir sprechen mit Julian über seine Motivation, seine Erlebnisse, seine Erfahrungen, die Verfolgung, Anklage und Haft, die er letztlich erleiden musste und das System Österreich. about this event: https://logbuch-netzpolitik.de/lnp466-wodka-red-bull

. Chaos Family about this event: https://pretalx.c3voc.de/camp2023/talk/1852/

Since the last time, we were all at camp, several significant changes have happened within the Tor network ecosystem, both technically and socially. In this presentation, we will review some exciting recent updates to the Tor network and look into the world of bad relay tracking, general network health observations, and the situation where multiple extensive Denial of Service attacks have caused a slowdown of the overall network performance. We wish to guide the audience through a number of new technologies that have been added to the network. These innovations include a modern congestion control mechanism, our multi-path circuit feature, Conflux, and a Proof-of-Work (PoW) mechanism to help against Onion Services attacks. Additionally, we will discuss some upcoming changes to the current C Tor code base and our journey towards a Rust Tor relay implementation as part of our Arti re-implementation of Tor. Finally, in addition to the technology modifications, we also would like to talk about some of the social developments happening with the network, amongst others, a new mechanism for handling incoming technical and social proposals from the greater Tor community. about this event: https://pretalx.c3voc.de/camp2023/talk/SMB8SM/

Die Themen von Tag 3 about this event: https://pretalx.c3voc.de/camp2023/talk/W7LLWD/

Aus dem Leben und der Arbeit einer Bundestagsabgeordneten Nach kurzer Vorstellung und Intro könnt Ihr mich alles fragen. Als digitalpolitische Sprecherin der Linksfraktion im Bundestag beantworte ich gern Eure Fragen zum Geschehen im Bundestag, zu digitalpolitischen Themen oder zu allem, was Ihr mich schon immer mal fragen wolltet. about this event: https://fahrplan.alpaka.space/camp-2023/talk/SDESSA/

Freifunk Open-MPPT is an expanding Open-Hardware and Open-Software development project for efficient and resilient energy autonomous infrastructure like communication nodes, environment monitoring, irrigation – and more. The talk presents the currently available models, evolution, scope of current use and presents an outlook of what might follow in the future. The OpenMPPT development project was initiated by Freifunk in 2017 with the first design handling up to 50 Watt PV (solar) power. The intended application was to build cheap and effective solar WiFi mesh nodes with telemetry. At the time of the project's initiation, there were no small and low-cost solar charge controllers available that included maximum power point tracking. Maximum Power Point Tracking is a technique used in solar power systems to optimize the power output from the solar panels by tracking the point where the panels can deliver the maximum amount of power. The OpenMPPT project aimed to fill this gap and provide an open, cost-effective, and repairable DIY alternative for individuals and development NGOs who look for open hardware and software solutions. Initially, the idea was not to replace or compete with more powerful closed hardware and closed software Maximum Power Point Trackers on the market. However, people and development NGOs kept asking for more power and features like the possibility of adding sensors or building irrigation systems, because they want open hardware and software solutions. The development of the Freifunk-OpenMPPTs is following sue. The newer and expanded FF-ESP32 generations of OpenMPPT controllers are based on the ESP32 MCU by Espressif and can handle up to 400 Watt solar power. They can not only power communication nodes, but also solar powered servers in communities that live off-grid or have unstable power. However, people keep on asking for more power... about this event: https://pretalx.c3voc.de/camp2023/talk/EMBRHS/

Seit 2018 gilt in Europa die DSGVO. Doch kaum einer hält sich daran. Datengetriebenes Online-Marketing verstößt jeden Tag millionenfach gegen Datenschutzrecht. Nicht nur die bekannten Big Player wie Google und Meta handeln mit Profilen von Millionen von Menschen und analysieren jede Interaktion beim Surfen. Spätestens seit der Corona-Pandemie setzen auch öffentliche Stellen wie Universitäten im Zuge einer fehlgeleiteten Digitalisierung Werkzeuge ein, mit denen Menschen überwacht werden. Viele Unternehmen nutzen IT-Tools, deren Funktionsweise sie kaum durchsteigen und deren Sicherheit sie nicht gewährleisten können. So sorgen sie dafür, dass sensible Daten über Betroffene offengelegt werden. Behörden und die Zivilgesellschaft gehen seit mehreren Jahren gegen Verstöße gegen die DSGVO vor. Doch die behördliche Rechtsdurchsetzung verläuft schleppend. Es gibt einen weiteren Weg: Betroffene und Verbände können vor Zivilgerichten ihre Rechte einklagen. Zum Beispiel die Unterlassung einer Datenverarbeitung, die Löschung personenbezogener Daten und sogar Schadenersatz. Wie datenschutzrechtliche Gerichtsverfahren ablaufen, wie Tracking und Datenhandel im Zivilverfahren nachgewiesen werden können und wie man Richter:innen das Internet erklärt, berichten die Rechtsanwält:innen Elisabeth Niekrenz und Tilman Herbrich. about this event: https://pretalx.c3voc.de/camp2023/talk/S7DPYT/

Three years ago, I started what I thought would be a six month project to implement some CAM software for 3D printing purposes, without using any of the existing geometry kernels. How hard can it be, right? I made some choices that seem weird but were done for very good reasons, and ended up implementing some things that are actually new and exciting. Here’s the story of the adventure so far. As the adoptive maintainer of one piece of 3D printing toolchain (ImplicitCAD, a programmable 3D modelling tool), I made the possibly unwise decision to implement another part of the toolchain - HSlice, a slicer. For a number of reasons I’ll get into in detail later, I decided to not use any of the existing multi-million-LoC geometry kernels, to implement the whole thing from first principles in Haskell, and to use some exciting new mathematics. All of those decisions were made for good reasons, and all of them came back to bite me. I’m here to tell you about what I’ve built so far, how I ended up as the singular intersection of these technologies, and how much I hate floating point. Then, I’ll tell you what it’s like implementing things whose only documentation is research papers, with math developed this century and algorithms that are still in development now. I’ll tell you about some incredibly cool algorithms involving crashing Austrian motorcycles and attempt to recruit you to work on this stuff too, for free. about this event: https://pretalx.c3voc.de/camp2023/talk/7KRCLF/

Stopping global heating does not just mean building solar panels and wind turbines, and switching to electric vehicles. Many industrial processes have carbon emissions that cannot be avoided with today's technology. Producing cement, steel, glass, plastics, aluminium, and many other products will require new production processes. In the talk, I will discuss some of these examples and the huge challenges that come with these changes. Some background: * https://industrydecarbonization.com/ * https://www.golem.de/news/die-fossilfreie-chemiefabrik-von-elektrischen-crackern-und-gruenen-olefinen-2204-163344.html * https://www.golem.de/news/industrie-wie-die-glasindustrie-vom-erdgas-abhaengt-2206-165969.html about this event: https://pretalx.c3voc.de/camp2023/talk/MRSFXH/

Die Sondersendung ist ein Podcast-Format des Sendezentrums. Bei dieser Sondersendung wollen wie mit Jugendlichen über ihre Erlebnisse vom Camp sprechen. Wir (Simon, Ebu und Gero) vom [Sondersendung Podcast](https://das-sendezentrum.de/sondersendung) erklären erstmal, was **Live-Podcasting** von einem normalen Vortragsprogramm unterscheidet und wie wir Gero und Ebu von remote zuschalten und trotzdem unsere einzelnen Spuren aufnehmen können. Wir sprechen darüber, wie man Podcasts verwenden kann, um Wissen und Ideen zu verbreiten. Außerdem haben wir **auf der Bühne zwei Plätze frei**, auf die ihr Euch setzen und mit uns sprechen könnt (Achtung: ihr seid dann live und im Nachgang als Aufzeichnung offen im Internet zu sehen). Wir werden mit Euch über zwei Frage sprechen: 1. Hört Ihr Podcast? Wenn ja, welche und was sind Eure Lieblings-Podcasts? Habt ihr selber schon mal Podcasts gemacht? 1. Was habt ihr hier auf dem Camp schon gemacht? Habt ihr Tipps, was die anderen auf jeden Fall bis Samstag noch erleben sollten? Wer dann Fragen zu Podcasting hat, kann direkt auf uns zukommen, auf dem Camp ins [Sendezentrum Village](https://events.ccc.de/camp/2023/hub/camp23/de/assembly/sendezentrum/) kommen oder sich jederzeit in der [Sendegate-Community](https://sendegate.de) anmelden. about this event: https://fahrplan.alpaka.space/camp-2023/talk/EJVJ3P/

Space missions need data networks, and it's not exactly a TCP/IP world up there. This talk will give an introduction to space data networks. Challenges at the physical layer are not in scope. Instead I will illustrate protocols, routing algorithms, and other schemes that were designed for networking in space. Space Communication is, as many others, a fractured discipline, with many idiosyncratic solutions built for the needs of specific missions. Someone with decades of specialized industry experience could surely give a good picture of recurring problems and industry practices. Unfortunately I don't have those, but thankfully the people who do have been writing standards. (The presupposition becomes less and less true with time anyway, as agencies look towards inter-mission and inter-agency interoperability.) The primary basis for this talk are various documents, published by relevant working groups of the CCSDS and IETF. This talk will be about the protocol ecosystem used in space networking, highlighting some clever technical solutions, and ending on some visions and challenges for the future. I presuppose some knowledge of classic internet protocols and the ISO-OSI layer model, but you should be able to follow the talk without it. (also check out: https://pretalx.c3voc.de/camp2023/talk/YZQYW9/ (german)) about this event: https://pretalx.c3voc.de/camp2023/talk/7FHFZA/

Über die Konstruktion und den Bau eines Scanners, um die Überwachung durch die sogenannte Chatkontrolle zu verdeutlichen Regelmäßig gibt es politische Vorhaben, die Kommunikation von Bürger:innen massenhaft zu durchleuchten und auszuwerten. Wie verdeutlicht man Menschen die Gefahren, die derartige Systeme darstellen, wo die Technik dahinter sich doch so abstrakt anfühlt, nicht greifbar ist und "man ja sowieso nichts zu verbergen hat"? Anlässlich des neuesten Vorstoßes der EU-Kommission, der sogenannten Chatkontrolle, versucht Digitalcourage diese Überwachung greif- und sichtbar zu machen. Entstanden ist eine kleine Maschine, die die auf einem Smartphone gespeicherten Inhalte scannt und auswertet. In diesem Talk werden wir über die Idee, Planung und den eigentlichen Bau der Elektronik, Hard- und Software sprechen. Selbstverständlich ist auch jede:r eingeladen, sein mobiles Endgerät zum Schluss selbst auf illegales Material zu prüfen. about this event: https://pretalx.c3voc.de/camp2023/talk/KGKGBB/

A discussion with Jeremy Hammond and Gabriella Coleman on the evolution of digital resistance, from direct action hacking to whistleblowing. How can hacktivists synergize with street activism to enact revolution? Can the lulz beat back the techno-fascist dystopia and their infosec enablers? We'll present strategies to strengthen decentralized networks, challenge government repression, and practice international solidarity. A discussion on the evolution of digital resistance, from direct action hacking to whistleblowing. How can hacktivists synergize with street activism to enact revolution? Can the lulz beat back the techno-fascist dystopia and their infosec enablers? We'll present strategies to strengthen decentralized networks, challenge government repression, and practice international solidarity. about this event: https://pretalx.c3voc.de/camp2023/talk/CLKXXG/

about this event: https://pretalx.c3voc.de/camp2023/talk/8830/

Kurze Erklärung wie DNA bzw Phosphoramiditsynthese funktioniert. DNA ist der code des Lebens. Theoretisch kann jeder im Labor DNA synthetisieren. Die Technik dahinter heißt Phosphoramidit-Synthese und ist auch für Informatiker spannend. about this event: https://pretalx.c3voc.de/camp2023/talk/3YQS3E/

Politik und Verwaltung sind auf kompakte Informationen angewiesen. Ist die Wirklichkeit zu komplex, so wird sie auf Indikatoren reduziert. Dieser Talk beleuchtet den Digitalisierungsprozess am Beispiel des "Monitoring häufiger Brutvögel", dessen Zahlen in Indikatoren auf Bundes- und EU-Ebene eingehen. Die Erfassung von Rohdaten im Gelände war lange Handarbeit, seit letztem Jahr läuft sie fast automatisch. about this event: https://pretalx.c3voc.de/camp2023/talk/JECUTC/