Chaos Computer Club - archive feed

Feministische und dekoloniale Kritik liberaler Sichten auf digitale TechnologienBeschreibung: In den jüngeren Debatten um die Regulierung digitaler Technologien kommen überwiegend liberale gesellschaftspolitische Weltbilder zum Tragen. Der Vortrag widmet sich im Gegensatz dazu mit fundierten systemkritischen Perspektiven auf digitale Technologien. Ausgehend von feministischen und dekolonialen Perspektiven werden ökonomische und sozio-politische Strukturen digitalisierter Gesellschaften beleuchtet. Es werden verschiedene Beispiele feministischer und dekolonialer Argumentationen, Forderungen und Projekte umrissen und im Anschluss ausgiebig mit dem Publikum diskutiert. about this event: https://pretalx.c3voc.de/camp2023/talk/G3D8RQ/

Hear about our adventure setting up the [Labitat Internet Exchange (LabIX)](https://ix.labitat.dk/) in Copenhagen. Many nice FOSS tools for network routing exist, but we found that technical details on IXPs are not as easily searchable and available as one would like. We will show how PeeringDB and a route server ([AS60247](https://as60247.peeringdb.com/)) help connecting our peers and which BGP filtering strategies we use. Hardware and server housing are of course, also needed in order to physically connect your peering clients. There is also the administrative part: you would need an Autonomous System Number (ASN) in order to do real networking routing, but how do you find a friendly sponsoring Local Internet Registry (LIR) to get a hold of IP resources? And what about the RIPE database entries? Which do we need? about this event: https://pretalx.c3voc.de/camp2023/talk/87V9Z8/

Meshenger is a P2P Android phone app that started out as a demo for community mesh networks. Meshenger started out as an idea to promote off the grid mesh networks and has now reached its initial goal. In this talk I will talk about the idea behind it, the story how it came to be and of course how it works. about this event: https://pretalx.c3voc.de/camp2023/talk/9XPJNG/

Leyer talks to the Internet-Manufakur aka "Network Operation Center" about their work. This time he is actually told 3 minutes before that its broadcasted LIVE – but it does not really matter to him anymore. about this event: https://pretalx.c3voc.de/camp2023/talk/camp20231989/

This talk offers an overview about difficulties when learning programming for Non-English-Speakers or at least not native English speakers. After the introduction there will be a live demo of some multilingual programming languages and an explanation how to define functions in different programming languages. about this event: https://pretalx.c3voc.de/camp2023/talk/Z8T9HD/

In this talk we will discuss the radio jailbreaking journey that enabled us to perform the first public disclosure and security analysis of the proprietary cryptography used in TETRA (Terrestrial Trunked Radio): a European standard for trunked radio globally used by government agencies, police, prisons, emergency services and military operators. Besides governemental applications, TETRA is also widely deployed in industrial environments such as factory campuses, harbor container terminals and airports, as well as critical infrastructure such as SCADA telecontrol of oil rigs, pipelines, transportation and electric and water utilities. For over two decades, the underlying algorithms have remained secret and bound with restrictive NDAs prohibiting public scrutiny of this highly critical technology. As such, TETRA was one of the last bastions of widely deployed secret proprietary cryptography. We will discuss in detail how we managed to obtain the primitives and remain legally at liberty to publish our findings. This journey has involved reverse-engineering and exploiting multiple zero-day vulnerabilities in the highly popular Motorola MTM5x00 TETRA radio and its TI OMAP-L138 trusted execution environment (TEE) and covers everything from side-channel attacks on DSPs, through writing decompilers headache-inducing DSP architectures, all the way to exploiting ROM vulnerabilities in the Texas Instruments TEE. about this event: https://pretalx.c3voc.de/camp2023/talk/ATJMB9/

Leena Simon liest aus ihrem Buch "Digitale Mündigkeit" und erklärt, weshalb wir damit die Welt retten könnten. Digitalisierung öffnet uns ein Meer an Zukunftsmöglichkeiten. Gleichzeitig verschließen wir oft die Augen vor den Untiefen und Risiken der technischen Entwicklungen: Social Media verhilft Populisten zum Wahlsieg, Algorithmen befeuern die Spaltung der Gesellschaft, Technik bevormundet uns und raubt uns den Sinn für Verantwortung. Das gefährdet die Grundprinzipien von Freiheit und Demokratie. Leena Simon liebt Technik und pflegt gleichzeitig einen kritischen Blick darauf. Sie macht Mut, sich weder zu verweigern noch auszuliefern, sondern als Einzelne und als Gesellschaft Verantwortung zu übernehmen. Denn mit Mut, Entschlossenheit und Übung können wir wieder mündig sein. Dann finden wir auch die Lösungen für die Herausforderungen unserer Zeit. about this event: https://pretalx.c3voc.de/camp2023/talk/RHWHRW/

Today, Information & Communications Technology accounts for 2-3% of global CO2 emissions, on a par with the aviation industry. If nothing changes, by 2050 it's estimated this number will rise to over 30%. Often overlooked is the crucial role of software. It is software which determines hardware's energy consumption, and for how long devices remain in use. That software design can drive environmental harm is still largely unknown to much of the population, let alone that users can already do something about it with Free Software. In early 2023 KDE published the handbook "Applying The Blue Angel Criteria To Free Software", the culmination of a 21-month project funded by the German government. The handbook presents the whys, whats, and hows for certifying software as sustainable with the Blue Angel ecolabel. In this talk I will provide an overview of the environmental harm driven by software and how Free Software is well-positioned to address the issues. I will link the inherent values that come with a Free & Open Source Software license to sustainable software design, and I will present the various ways that Free Software aligns with the Blue Angel ecolabel. Finally, I will provide an overview of the current sustainability goal of KDE and the work of the KDE Eco initiative. This includes publishing the KDE Eco handbook, setting up a measurement lab for FOSS developers, squashing hundreds of efficiency bugs, supporting the sustainability objectives of the FOSS Nigeria project "Renew V", among others. about this event: https://pretalx.c3voc.de/camp2023/talk/YVWNW3/

An Oblivious Pseudo-Random Function (OPRF) is versatile cryptographic primitive which is the basis for a wide range of protocols and tools. They enable one to outsource randomness computations to another party without having to trust them or make any compromises in confidentiality of the inputs. The most common benefit of using an OPRF, is that it adds strong privacy guarantees to protocols. A well-placed OPRF can also provide confidentiality without needing a PKI infrastructure. In some cases an OPRF can provide strong security guarantees that traditional systems cannot provide. OPRFs are truly one of the most exciting and underappreciated cryptographic building blocks of the last decade. In this talk I am will explain how OPRFs work, properties can achieve, and how OPRFs are used in various protocols. I am going to show some examples of existing free software tools which use or provide OPRFs and how these tools compare to alternative solutions. The talk is structured in two parts, a theoretic part which explains various types of OPRFs, their properties and where and how these are beneficial. And in the second part I will show concrete free software implementations: liboprf, libopaque, sphinx (a password storage that could be run by the NSA) and klutshnik, a threshold key management system, all authored by Yours Truly. I will also touch briefly on standardisation efforts of OPAQUE and OPRF by the IRTF CFRG, to which I contribute. Other examples I will bring will include private set intersection (used for contact discovery or haveibeenpwned-style privacy- respecting compromised account checks), private information retrieval, single-sign-on with privacy, deduplication and secure pattern matching. about this event: https://pretalx.c3voc.de/camp2023/talk/KG9EEV/

A short session for even shorter talks. Language: English or German -- german -- Du willst was sagen? Das Podium gehört dir. 10 Minuten hast du, dann wird gewechselt. Ein kurzer Vortrag über die Aerodynamik von Enten, Werbung für dein neues Open-Source-Projekt, ein kleiner Hack den du neulich entdeckt hast, gesellschaftliche Kommentare ... alles geht. Zur Verfügung stehen Mikrophon, Beamer und ein Laptop mit USB-Stick, um Präsentationen im PDF-Format zu zeigen. Falls du eine Präsentation von deinem eigenen Gerät zeigen möchtest, würden wir dich bitten, 15 Minuten vor Beginn zu kommen, damit wir die Technik testen können. Am besten meldest du deinen Vortrag bei [email protected] . Spontane Beiträge sind aber auch gern gesehen, wenn am Ende noch Zeit ist. -- english -- Wanna say something? The stage is yours. You have 10 minutes to talk about anything. A short talk about the aerodynamics of ducks; promoting your new open-source project; a small hack that you found; social commentary ... anything goes. Available infrastructure: A microphone, beamer and laptop with a USB-Stick to show slides (PDF format). If you want to use your own device to show your presentation, please come to the stage 15 minutes before the event so we can test the setup. If you want to have a talk, we'd like you to write a short e-mail to [email protected] . However, spontaneous contributions are also welcome if there's still some time left at the end. about this event: https://pretalx.c3voc.de/camp2023/talk/8ZC3K7/

In this presentation, I will talk about how DDoS attacks were carried out generally in the last 11 years and how they innovated since then; I will also present more specific details about attacks against government websites from bundestag.de in 2012 to ukraine-wiederaufbauen.de and others in February - August 2023. This talk aims to also entertain but mostly educate on how to mitigate current attacks. You can expect technical, not political slides. about this event: https://pretalx.c3voc.de/camp2023/talk/CJLKAK/

Come to play the Game of All Games! You will want to tell everybody about it once you’ve played it! Come to play the Game of All Games! You will want to tell everybody about it once you’ve played it! Nomic is a game where every move is to change the game itself. Nomic gives you a first-hand experience of the glory and frustration of democracy, the tricks of lobbyism, the paradox of self-amendment or it could simply be a good fun time, totally depending on the people you are playing with! There’ll be a simple set of initial rules to begin the game with, then for each move, players take turns to suggest a change to the existing rules of the game. Win or lose? You decide!!! Pre-requisite: Be able to articulate yourself in English. about this event: https://fahrplan.alpaka.space/camp-2023/talk/9R7RYA/

Frag die Teams about this event: https://pretalx.c3voc.de/camp2023/talk/7937/

Flutter is a software development kit based on the Dart language enabling developers to create performant cross-platform applications. We'll have an introduction for people with some basic knowledge of Flutter or other cross-platform tool kits and later on a view on advanced topics. In this talk, we will have a look on performance-tuning, useful features as well as some background information on the Flutter framework, it's engine and the Dart runtime. In particular, the following topics will be addressed: - What's this fluttery Flutter? - Animations - example of animations - performance-tuning - UX patterns in Flutter - responsive layouts - routing - hight-quality Widgets - the Flutter Framework - under the hood of Flutter's rendering - Flutter Web, dart2js and what Flutter has (not) to do with JavaScript - Flutter, the bad, the ugly Slides : https://slides.com/theonewiththebraid/flutter about this event: https://fahrplan.alpaka.space/camp-2023/talk/LQLB9F/

Post, Himmel, Züge und Wetter about this event: https://pretalx.c3voc.de/camp2023/talk/JKAVHL/

Last year, we released FirmWire to the public, an open-source baseband analysis platform. But what even is a baseband and why do we want to analyze it? Hint: It’s a critical part of your phone and a first point of entry for attacks. This talk will answer your questions and provide a hands-on introduction to our framework. This talk will discuss cellular basebands and FirmWire, our open-source platform for baseband firmware. The platform allows researchers to emulate, dynamically debug, introspect, and interact with complex baseband firmware, providing insights about its inner workings in real-time. FirmWire’s integrated ModKit creates and injects custom tasks into the emulated baseband. We leverage the ModKit for full-system fuzzing via AFL++ by creating custom fuzzing tasks interacting with the host, using special hypercalls. With this setup, we uncovered several pre-authentication vulnerabilities in the LTE and GSM stacks of Samsung’s Shannon and MediaTek’s MTK baseband implementations, affecting billions of devices. FirmWire is the outcome of a more than two-year-long international research collaboration between the University of Florida, Vrije Universiteit Amsterdam, TU Berlin, and Ruhr-University Bochum. about this event: https://pretalx.c3voc.de/camp2023/talk/TQXEN7/

A deep dive explaining the Mach-O executable format along side a code demo. Apple systems can be quite obscure and archaic considering how popular and ubiquitous their devices are. Learning more about apple systems for any purpose therefore requires a healthy amount of reverse engineering. A core part of reverse engineering Apple systems is understanding the Mach-O file format which is how all Apple OSes describe executable files. This talk will provide an in depth explanation of the file format as well as a code example showing how we can parse Mach-O objects at runtime to show a loaded system libraries Obj-C class hierarchy. about this event: https://pretalx.c3voc.de/camp2023/talk/8KFF9C/

In this talk, we take a first look at the tool mitmproxy. We will use it for interacting with network traffic on an Android phone. Sniffing into network traffic can be really interesting. It can help you understand complex systems better, double-check the data you sent or just finding bugs in your apps. The tool mitmproxy helps you with all of that. In this talk, we take our first look on this interactive tool. First, we set up a phone to connect to mitmproxy. Afterwards, we look at some actual traffic and how to interact with it by manipulating it the "man-in-the-middle" way. Lastly, we take a short look at automating all of this by using a python library for interacting with mitmproxy through programming. about this event: https://pretalx.c3voc.de/camp2023/talk/L7V9HF/

**Tri-tra-trallala der Roller steht jetzt nicht mehr da.** Wir veranstalten ein original Wiener `Kasperltheater` zum Thema `Leihroller hacken`. English subtitles available. CCCasperl und Pezi finden einen kaputten `Leihroller` im Wald und beschliessen das Ding zu zerlegen. Sie finden dabei nicht nur heraus wie das Alles ganz genau funktioniert, und was man braucht um so einen Roller wieder zum rollen zu bringen. Sie lernen auf ihrem Abenteuer auch eine MENGE über `CANbus`, `Open Source` Tools,`Elektronik` und `Reverse Engineering` generell. Sie entdecken Plaintextpasswörter in der super sicheren Crypto Firmware und erkennen wieder einmal, dass Security by Obscurity keine gute Idee ist. Dass die `Batterien` eventuell noch für andere Dinge als blödes rumrollern taugen können, fällt den Beiden auch noch ein. Bei Ihrem Gebastel werden Sie alle möglichen und unmöglichen Ideen ausprobieren und einige komplett unerwartete Dinge lernen. Unter Anderem dass diese Rollerfirma eigentlich Ihre komplette Infrastruktur von einem chinesischen Anbieter bezieht der "Rental Scooter Company as a Service" anbietet, inklusive Rollerherstellung / Customization, Fleetmanagement und Standort / Kundendaten. Es wird auch ein _Krokodil_ geben und es bekommt auf die _Mütze_. Enthält reguläre Kraftausdrücke, Gewalt, groben Unfug und feinsten Fug. **Ein Kasperl Theater für grosse Kinder ab ca 15 oder so** **(Das ist keine angemessene Kinderunterhaltung.)** about this event: https://pretalx.c3voc.de/camp2023/talk/SQ8RKQ/

Gesichter-Suchmaschinen wie Clearview AI und Pimeyes sammeln Milliarden von Fotos im Internet. Mit den Bildern füttern sie ihren biometrischen Suchindex, um uns alle immer und überall identifizierbar zu machen. Eigentlich sollte die DSGVO diesen Überwachungsmonstern Steine in den Weg legen. Praktisch tut sie das aber kaum. Gemeinsam verlangen wir Datenauskünfte von solchen Firmen und bereiten Beschwerden bei den zuständigen Datenschutz-Ausichtsbehörden vor. about this event: https://pretalx.c3voc.de/camp2023/talk/KCMP73/

The high number of IT security incidents in recent years shows that any institution can be caught out - regardless of whether it is an enterprise, a university, or a hospital. The attackers' methods are often similar and can be prevented by taking appropriate measures. But how exactly does such an attack typically take place? How do I protect my company against it? And what happens if it's too late and an incident response is needed? Which steps do you need to take, and how can you prepare in advance to support the incident responder of your trust? **Warning**: This presentation has facepalm potential. And memes. about this event: https://pretalx.c3voc.de/camp2023/talk/SAKVHU/

Wie es Gelingen kann, das Fediverse und seine Infrastruktur durch den Aufbau kleiner Firmen zu fördern und zu stabilisieren. Spätestens mit der Gründung einer Mastodon-Instanz durch Mozilla ist das Thema Professionalisierung im Fediverse in aller Munde, und mit Meta macht sich gerade ein weiterer großer Akteur mit viel Geld bereit, das Fediverse nach seinen Spielregeln zu beeinflussen. Weder der einzelne Admin dessen Mastodon-Server in der Abstellkammer steht, noch die erwähnten großen Mitspieler mit ihren umzäunten Gärten sind dabei erstrebenswerte Entwicklungen. In diesem Talk erläutert padeluun wie die Gründung kleiner, flexibler und schlagkräftiger Firmen dazu führen kann, die richtigen Impulse im Fediverse zu setzen, und zieht interessante Parallelen zu den Fehlentwicklungen der Mailbox- und BTX-Zeit in den achtziger Jahren. about this event: https://pretalx.c3voc.de/camp2023/talk/ZYGS97/

Hej, Andi und Toto nehmen gemeinsam einen Podcast zum Thema Hub, Fahrplan und die dazugehörigen Apps auf und sitzen dabei auf einer Coach. Kommt gerne dazu falls ihr euch auch mit dem Thema beschäftig oder beschäftigen wollt – wir auch ein Mikro für Zuschauerfragen. about this event: https://pretalx.c3voc.de/camp2023/talk/RHXZZK/

In the past months, we reported vulnerabilities to various companies. In addition, we have alerted over thirty companies that they were currently being hacked. In this presentation, we will share our most interesting anecdotes. Part 1: Your company receives a vulnerability report for free. We will show you how you can still mess it up. Part 2: You hack companies for ransomware groups. We will show you how you can still mess it up. In the first part, we focus on companies that fail to eliminate security issues. In the second part, we address access brokers who fail to broker their access. about this event: https://pretalx.c3voc.de/camp2023/talk/VSRGWK/

Leyer invites a few of people from Milliways onto the gray coach in the "Feldbahnschau" to talk with them – and as supprise to him it's actually LIVE! about this event: https://pretalx.c3voc.de/camp2023/talk/HKV9ZD/

Was geht alles mit Heißkleber? Vieles! In diesem praxisorientierten Vortrag werden wir Live und unvorbereitet Einsatzmöglichkeiten von Heißkleber ausprobieren. Vielleicht finden wir versehentlich auch eine vorgesehene Anwendung. about this event: https://pretalx.c3voc.de/camp2023/talk/3AHGGK/