Chaos Computer Club - archive feed

The security of Tesla's cars has been a hot topic in recent months. In addition to being one of the safest cars on the road, it is also well-protected from hacks and attacks. But how does Tesla make sure their vehicles are safe and secure? This case study sheds light on the inner workings of Tesla's Passive Entry System and core VCSEC protocol, and reveals possible attack vectors. The security of Tesla's cars has been a hot topic in recent months. In addition to being one of the safest cars on the road, it is also well-protected from hacks and attacks. But how does Tesla make sure their vehicles are safe and secure? Tesla is a company that has been innovating in the automobile industry for many years. They have been designing and manufacturing electric vehicles which are environmentally friendly and sustainable. Tesla has also been pioneering and implementing new technologies in the automotive industry. One of these innovations is their Bluetooth interface which is used for locking and unlocking vehicles and can be used to uniquely identify cars, as well as to track them in real-time with apps like "Tesla Radar". The introduction of Tesla's Bluetooth passive entry system, previously only used by model 3 and model y, into new product lines like the Tesla 2021 Model S/X facelift variant, shows the strategic importance of this technology for Tesla in the years to come. This case study sheds light on the inner workings of Tesla's Passive Entry System and core VCSEC protocol, and reveals possible attack vectors. about this event: https://program.mch2022.org/mch2022/talk/DCTJDE/

Only three years ago you wouldn't have had a chance to get this so-called reality past any decent editor. Now, plotting a book or movie has become increasingly hard and the next years in publishing will be interesting, since our standards in what is scary or believable or how dumb can one be to do XY as a book character, to get into whatever problems, have tremendously changed. I'm an author, writing crime novels and scifi and during the last three years, some collegues and I have often said the phrase "if this was a book, you wouldn't get that past an editor". But it seems, our standards on what is real, believable or doable have changed somewhat over the pandemic. This does not only afflict society itself (fake news, mobs, conspiracy myths etc.), but also (pop) culture and the its creators like authors of books or movie scripts. I have no forecast, on where we might end up or if movies and books will return to story worlds of our old believes, but I can share musings about society, tech and humanity's deepest desire in stories and authors who have to face a different kind of basic understanding of the world to start from when writing stories. about this event: https://program.mch2022.org/mch2022/talk/CPT3CD/

TASBot has appeared at multiple charity events raising more than $1.3M to date by hacking classic video game consoles through controller ports. In this talk, dwangoAC will show how TASBot, with help from a human speedrunner, can use a Stale Reference Manipulation exploit in the N64 game Legend of Zelda: Ocarina of Time to achieve persistent Arbitrary Code Execution to obtain the Triforce and many other surprising outcomes that have to be seen to be believed. The TASBot community, led by dwangoAC, has exploited glitches in a variety of creative ways leading to Twitch chat streamed through a Super Game Boy, Super Mario Bros. being played inside Super Mario World, and many more. Most of these exploits were on older NES and SNES consoles, but what could be done if Arbitrary Code Execution could be achieved on an N64? This talk aims to show the beautiful results that can ensue after taking complete control of Legend of Zelda: Ocarina of Time, including obtaining the Triforce itself! The talk will cover controller protocol evil maid attacks, Stale Reference Manipulation (Use After Free) exploitation, a four stage bootstrap chain to attain high speed data transfer, and more with audiovisual elements that are sure to be a surprise. about this event: https://program.mch2022.org/mch2022/talk/CNYE7A/

We know that we are in trouble as a human society, so what are we going to do about it? Showcase projects that do good things What can you do? Tension between system-level problems and the massive powers that be and the scope of individual impact. How do you leverage your privilege? imagining yourself in 2050 narratives. We know that we are in trouble as a human society, so what are we going to do about it? Showcase projects that do good things What can you do? Tension between system-level problems and the massive powers that be and the scope of individual impact. How do you leverage your privilege? imagining yourself in 2050 narratives. about this event: https://program.mch2022.org/mch2022/talk/KFEEZ7/

PolyCoin - A distributed game across MCH. The history at EMF Camp 2018 and 2022, and how it was made and works. See what is on the inside of the PolyCoin crypto miner devices, and why they were designed the way they were and what had to be compromised along the way, what can be improved, and plans for future versions. PolyCoin - is a game being deployed at MCH 2022, you'll see the PolyCoin crypto miner units installed throughout the site. This game involves "capturing" the crypto miners using an RFID card to collect the fictional crypto currency PolyCoin. Each player selects one of four fictional global corporations to support, and captures the crypto miners for their chosen company producing PolyCoins for them. The company with the most PolyCoins wins! Delving in to the brief history of the game at EMF Camp 2018 and 2022, and then explaining how it works and the various bits hang together to create the overall game. Covering PICmicro, ESP8285 (micropython), DFR0299, RC522 RFID, MQTT, Python on Raspberry Pi, and the hidden features of the game waiting to be discovered. I'll cover the problems with the original game deployed in EMF 2018 and how they were addressed with the PolyCoin game in 2022. Then the problems encountered in 2022 at EMF camp (far less issues!). This would ideally be suited to having this presentation followed by a hands-on session to see the parts that make the game. I should have enough bits to run a workshop as well to build a PolyCoin crypto miner unit, including surface mount and hand soldering all the parts and assembling the units themselves. about this event: https://program.mch2022.org/mch2022/talk/CRHHCU/

When the pandemic was declared over, Europe went into a war. This was the first major conflict in Europe where an important part of the war was waged online. Anonymous, disBalancer, IT ARMY, and the western governments. These are stories from the cyber front lines. Welcome to a panel of speakers from Ukraine and EU. We will discuss what happened on the front, how it helped to turn the war in Ukraine's favor, the international cooperation, the cyber offensive, and the how and why of it. We will discuss, DDoS, information disclosures, backdooring, psyops, and propaganda. Chris Kubecka, CEO and Founder of HypaSec, Anastasiia Voitova, security software engineer at Cossack Labs, and Peter van den Heuvel, Security analyst from Saxion, are joining us to share their stories. https://twitter.com/SecEvangelism https://twitter.com/vixentael https://twitter.com/pvdheuvel_ https://twitter.com/KirilsSolovjovs about this event: https://program.mch2022.org/mch2022/talk/PL3FTM/

Mechanical locks are everywhere and come in all shapes and flavors. But choosing the right lock can be rather difficult. For example, what is better? A lock that is hard to pick, or a lock with hard to duplicate keys. This talk will not give you the answers, but it will help you understand the trade-offs. Furthermore, we will have fun threat modeling our locks. Is lockpicking a threat you should be concerned about, or is the brick the tool you should care for? Jan-Willem, from The Open Organization of Lockpickers (Toool), will share his ideas on mechanical security and threat modeling. We will make it fun and use several case studies, starting with defining a lock, threat modeling mechanical puzzles, and use several case studies where the threat was overrated. Simply put, attacks against locks range from the trivial to mastery. I'll share multiple failed attempts of attacks that should be trivial, but were not in practice, and we will analyze them together. about this event: https://program.mch2022.org/mch2022/talk/T8MCQW/

As of today, most discussions on cyber security focus on privacy and the implications of incidents involving data. However, those of us in cyber physical security often see things differently as we study actors attempting to use computers to impact the physical world (e.g. critical infrastructure and industrial controls). Geopolitical conflicts and accessible offensive security tools make defending against these threats increasingly complex. The anthology I bring for you illustrates the evolution of cyber physical threats through several stories with topics that span from non-fiction espionage and crime thrillers to politically-motivated intrusions and master tinkerers’ ill-fated creations. By focusing on the different players involved and their motivations, I intend not to hype up the scenario, but instead to accurately describe what we observe daily in the cyber physical threat intelligence community. “First Privacy, Now Safety: An Anthology of Tales from the Front Lines of Cyber Physical Security” will consist of a series of real stories to illustrate the evolution of cyber physical threats related to topics that span from non-fiction espionage and crime thrillers to politically-motivated intrusions and master tinkerers’ ill-fated creations. The selection of topics results from my personal experience as a member of the cyber threat intelligence community in Washington, D.C. with a very pacifist perspective of life. Some example stories include: • The Unwilling Pawn – How our infrastructure gets swept up in geopolitical conflicts • Everybody Be Cool, This is a Robbery! – How criminals can make more money by getting physical. • What if I Click Here? – Errant tales from hackers learning about cyber physical systems. (And sometimes erring in the process). All of the stories I will talk about can be verified by the audience in open sources and specialized publications, although they may not appear in any popular books or videos until a couple years from now. about this event: https://program.mch2022.org/mch2022/talk/QYAUZT/

drand is an opensource project allowing anybody to run a “randomness beacon”. Its goal? Providing a trustable, verifiable source of public randomness that would enable full transparency in online lotteries, leader election or blockchain smart contracts. This talk is about what distributed randomness is, what it means for developers, and users, and why you’d want to use it. I will also present to you the current ecosystem around drand, and what it enables you to do differently and why it is desirable in a distributed, decentralized web to have public, verifiable randomness. Don’t worry though: we will first go through an easy overview of how it works without diving too much into the gory cryptographic details. In addition, I’ll demo how drand works in practice, and explain you how you can easily use it in your applications since drand nodes can be queried by anybody. Disclaimer: this is NOT a blockchain talk, but rather a distributed system one. [drand](https://drand.love/) (pronounced "dee-rand") is a distributed randomness beacon daemon written in Golang. It has been used by Cloudflare, EPFL, Kudelski Security, UCL and other partners to setup a distributed randomness project that was unveiled in June 2019: the ["League of Entropy"](https://blog.cloudflare.com/league-of-entropy). Since then even more members have joined the league. Servers running drand can be linked with each other to produce collective, publicly verifiable, unbiasable, unpredictable random values at fixed intervals using bilinear pairings and threshold cryptography. Drand nodes can also serve locally-generated private randomness to clients. Generating public randomness is the primary functionality of drand. Public randomness is generated collectively by drand nodes and publicly available. The main challenge in generating good randomness is that no party involved in the randomness generation process should be able to predict or bias the final output. Additionally, the final result has to be third-party verifiable to make it actually useful for applications like lotteries, sharding, or even "nothing up my sleeves" parameter generation for security protocols. drand relies on the following cryptographic constructions: - Pairing-based cryptography and Barreto-Naehrig curves. - Pedersen's distributed key generation protocol for the setup. - Threshold BLS signatures for the generation of public randomness. - ECIES for the encryption of private randomness. These are well known, while still relatively cutting edge cryptographic schemes. Why do we need such randomness? A lot of reasons actually: - Lotteries, jury selection, election event, random sampling for audits, ... - Protocols & cryptography: - Verifiable gossip: randomly choosing peers in a verifiable way in a network to disseminate information - Parameters: Nonces & IV for symmetric encryptions, composite or prime numbers for selecting a field for RSA, or even ECC - Schemes: Diffie Hellman exchange, Schnorr signatures, more generally for zero knowledge proofs, - Protocols: Tor (e.g. path selection), sharding (Omniledger), leader election for consensus - Statistics: verifiable random sampling, reducing bias e.g. in controlled trials in medicine, etc. Now, drand is a software ran by a set of independent nodes that collectively produce randomness and whose long term goal is to implement Randomness-as-a-Service: - Fetching randomness should be as simple as fetching time from NTP servers. - Nodes can serve both private randomness and public randomness: - Unpredictable and bias-resistant - Publicly Verifiable - Decentralized service using threshold cryptography, with high availablity, reliability and trust. This talk will NOT be about just the cryptography behind drand, but I will cover some of the basics in a simple way in order to tease the people that could be interested, while introducing cool cryptographic constructions to the rest. It will NOT be about how drand is built, but it will really be about the **practical use-cases for drand**, how to use it, its kind of randomness, what it means and why you might want to use it. about this event: https://program.mch2022.org/mch2022/talk/YWHF7Z/

There’s no quick fix for the misinformation, disinformation, and lies were seeing in the world these days, and its natural for hackers want to work on the problems with the skills at hand. I’m going to talk about why, for hackers, that’s not necessarily a good move to do solo. I’ll go over mistakes I’ve seen way too many technologists and academics make when approaching the subject, where misinformation *really* comes from, and where the audience can harness what they’re good at. It is deceptively easy to see misinformation as a data problem, as a societal issue of algorithms run amok on soulless social media platforms. However, just because the delivery of misinformation is purely technical, it doesn’t mean that the cause, or solution, is also technical. In the more than half a decade I have been working on factchecking misinformation and disinformation I have see this point lost over and over to technologist, hackers, hobbyists and academics. This is a huge waste of talented resources, and in this talk I will go over why this is the case and explain the most serious problems that journalists, fact-checkers and politicians are facing. Hackers have been addressing large-scale issues for decades, and my talk will lay a framework down for how the MCH community and beyond can work on the lies that are propagated across the internet and the world. There’s never been more of a need for help, and I will explain how to get the most bang for your buck. about this event: https://program.mch2022.org/mch2022/talk/MLVGMM/

We will take a cursory look at the protocols that underpin audio over IP from studios to stages and on to broadcast. Focusing on AES67 the you will gain a basic understanding of what it is, how it works and how it is inherently vulnerable to attack. At a high level this talk should be accessible and entertaining to all, although to grasp the more nuanced details a rudimentary knowledge of IP networking and audio digitisation will be helpful. Description: In the professional audio space the heavy and expensive XLR snakes of old have largely been replaced with audio over IP. Operationally this move to audio over IP has provided many benefits, such as being able to use the same equipment for audio as they use for video and lighting rather than special sets of gear for each aspect of a production. However with the increased use of commodity IT hardware in this operational technology (OT) environment comes an increase in attack surface from more software, easier access and less segmentation. As with many places where IT components get re-purposed for OT the administration practices and development practices of the vendors haven’t necessarily caught up with the with the best practices of there IT counterparts. There are some hard problems to solve for audio over IP such as multicast encryption and authentication but also much simpler but more cultural things like updating a working system. It is hoped that by presenting this topic to the broader community of hackers that more talented people get interested in the hard bits, and perhaps we can even reach the folks on the operational technology side to see what measures can be taken to improve the security of existing systems. about this event: https://program.mch2022.org/mch2022/talk/JKSE7N/

If the perfect Blue Team exists, does that mean the Red Team doesn’t stand a chance against it or is there still a way to sneak their phish in the mailbox of their target? Well in this talk we investigate how a Red Team could sneak past even the best Blue Team imaginable. We analyse how a perfect Blue Team would detect malicious domains targeting their organization, how they would correlate these to other threat infrastructure to burn the whole campaign and how they would block a successful initial foothold in case they did not detect the phish campaign before its launch. By assuming the perfect adversary, we discuss techniques and important OPSEC measures Red Teams need to use to get a successful and undetected initial foothold in their targeted organization. Through practical demos and real-life examples, attendees will learn invaluable techniques and OPSEC measures to improve their Blue or Red Team tradecraft. If the perfect Blue Team exists, does that mean the Red Team doesn’t stand a chance against it or is there still a way to sneak their phish in the mailbox of their target? Well in this talk we will investigate how a Red Team could sneak past the best Blue Team imaginable. By analyzing techniques the perfect Blue Team would use, we define OPSEC measures and techniques to remain undetected and accomplish a successful initial foothold. How would a perfect Blue Team detect malicious domains targeting their organization? o BLUE: By dissecting patterns of adversaries and resulting OPSEC mistakes, we specify how domain and Certificate Transparency Log monitoring can unveil domains impersonating your organization. o RED: We explain measures the Red Team can take to avoid being caught through domain and CTL monitoring by using wildcard SSL certificates and avoiding typosquatting. How would a perfect Blue Team correlate detected malicious domains to related threat infrastructure? o BLUE: Once a suspicious domain is identified, we can correlate this to other threat infrastructure using NetLoc intelligence techniques. Through correlation, Blue Teams can leverage OPSEC mistakes to uncover and potentially burn the whole campaign. o RED: We explain measures the Red Team can take to avoid the correlation between their threat infrastructure and avoid the detection of one domain leading to the whole threat infra being burned. How would the perfect Blue Team attempt to block undetected phishing campaigns during their launch. o BLUE: We analyze how the use of reputational scoring based on IP, Domain and Mail server, can block many phishing campaigns during the launch itself. o RED: We explain how Red Teams can age and categorize their domains to pass IP/Domain/Mail based reputation detections. What if a phishing mail sneaks by the Blue Team and lands in the inbox of one of their employees, has Red Team won? Not yet: o BLUE: The perfect Blue Team has hardened employee endpoints to make a successful exploitation after a click almost impossible. We discuss several defensive techniques on how to block successful initial foothold through Macro execution hardening, Applocker, Exploit Guard and endpoint security solutions. o RED: Assuming a fully hardened system, we discuss strategies that could bypass all off these hardening measures and have been proven to be successful in past engagements We conclude with a summary of techniques both Blue and Red Teamers can use to perfect their tradecraft. about this event: https://program.mch2022.org/mch2022/talk/HKJCGA/

The talk is on Introduction to opens source investigations. Aiganysh will explain what "open source" is, what kind of research you can do with it, and the challenges it entails from Bellingcat's experience. The presentation will be full of case studies and exercises such as geolocating ISIS supporters from Twitter and identifying neo-nazi criminals in the US. Bellingcat has conducted open source investigations into the downing of MH17, syrian chemical attacks, high level poisonings, corruption investigations, ecological research, war monitoring and etc. So what is open source investigations, how can you do it and what challenges come with it? To learn more about that join the talk by Aiganysh Aidarbekova, Bellingcat's researcher and trainer. The talk will also have case studies and exercises such as geolocating ISIS supporters from Twitter and identifying neo-nazi criminals in the US. about this event: https://program.mch2022.org/mch2022/talk/RSAY8Q/

Panoramic 360° video offers more immersion, but has unique challenges. There are plug and play solutions, however they use centralized services such as Facebook and YouTube. In this talk (live streamed in 360° video) i will explain how to setup your own 360° live stream using your own streaming servers and viewing the 360° stream on desktops, mobile devices and VR headsets in the browser. The pandemic has brought live streaming video to the masses. Panoramic 360° video offers more immersion, but has unique challenges. There are plug and play solutions, however they use centralized services such as Facebook and YouTube that invade our privacy and spam us with ads. In this talk (live streamed in 360° video) i will explain how to setup your own 360° live stream using your own free software streaming servers and viewing the 360° stream on desktops, mobile devices and VR headsets in the browser. If you want to setup your own stream you'll need a camera (i tested with Insta360 One R and HumanEyes Vuze). The talk will cover all parts: 1. Camera setup 2. Setting up the RTMP streaming server 3. Adding HTML5 Live Streaming (HLS) 4. Setting up browser based clients for desktop, mobile and VR about this event: https://program.mch2022.org/mch2022/talk/EBKZRV/

Meta-Press.es is a WebExtention to help you exploring the online press, with no middlemen between the newspapers and your web browser. It allows you to discover millions of results within seconds and lists the last ones of each sources. Searches can be scheduled and results can be selected and exported. Meta-Press.es is a free software project built as a decentralized alternative to Google News. It is developed by Simon Descarpentries, ex-member of La Quadrature du Net, treasurer of the Fund for Defense of Net Neutrality FDN2.org and web artisan with 20 years of experience. Meta-Press.es runs entirely from your web browser and requires nothing else than online newspapers with internal search features to run. It supports currently more than 500 sources (newspapers, scientific press, online agendas…) but everything is made to help users contributing more sources. Using Meta-Press.es, there is no data sent to third parties (including our servers). We're not asking the users to believe us about the respect of their privacy, it's a matter of verifiable fact. No Meta-Press.es servers also means that Meta-Press.es is not a single point of failure, surveillance or censorship, like GAFAM are. Meta-Press.es helps you evading the swamp of third-party trackers and it works great from a Tor Browser. about this event: https://program.mch2022.org/mch2022/talk/ZRSJMG/

Hardware attacks on security relevant components, such as fault injection, have been known for decades and have been shown to be successful on a wide range of devices ranging from general purpose microcontrollers to dedicated security engines. In this work we give an overview of different methods used for fault injection and the effectiveness of these methods. We discuss electromagnetic fault injection in more detail. Most of the published research focuses on attacking low performance secure devices. However, we present the results of electromagnetic fault injection on a modern multicore system on chip running at gigahertz speed and discuss its effectiveness. In this presentation we discuss hardware attacks in general, their use cases, and real-world examples. We then discuss electromagnetic fault injection in detail. We compare the results of the previous research on microcontrollers and secure elements to more modern high performance system on chip devices. We discuss relevant features of modern Arm systems on chip and answer the two main questions of this research. Are electromagnetic fault injection attacks applicable and efficient when applied to software running at gigahertz speed on a modern multicore system on a chip? And to what extent does the operating frequency change the effectiveness of electromagnetic fault injection attacks? about this event: https://program.mch2022.org/mch2022/talk/9NZHED/

The Gigatron is a microcomputer without a microprocessor. It was made into a DIY electronics kit and sold over 1000 pieces from 2018 to 2020. It is now open source. In this talk, I will not go into the working of the kit, but explain what you need to think about when creating a kit and keeping it manageable. Think of what to design, sourcing components, testing, preventing too many support calls and more. The Gigatron is a microcomputer without a microprocessor. During the design phase, a decision was made to maybe make it into a Do-It-Yourself electronics kit. Many design decisions have been influenced by that decision, as creating a unique prototype is a lot different from creating a succesful kit. In this talk, I will go over some of these design decisions. I think the majority of them worked out very well, as over 1000 kits were sold between 2018 and 2020, before the Gigatron becoming open source. These design decisions were influenced by other kit builders, who had already gone through that process, like the people behind the PiDP-8 and Enigma-E. I would like to share some of that knowledge, so you can also stand on the shoulders of the giants before me. And of course to also stimulate the attendees to make their hobby project into a kit. No previous knowledge is needed. The talk is aimed at people wanting to turn their hobby project into a kit project. about this event: https://program.mch2022.org/mch2022/talk/33EPHD/

Governments should be radically more transparent. While calls for more open data and initiatives like the Open Government Partnership have existed for more than a decade, there is still much to be desired. Where do we stand? And, fun to imagine, where could and should we go? It is hard to have a perfect overview of the status of open government across the world. We at [Open State Foundation](https://openstate.eu/) focus mostly on accelerating digital transparency in the Netherlands. We will explain things like: - Why is the **Handelsregister** (company register) still only fully accessible for those with a lot of money? - Why are **Wob-verzoeken** (Freedom of Information requests) on average not answered within the legal deadline? - How transparent are the **external meetings of ministers** and who do they talk to? On the other hand we show why the Netherlands is a great place if you want to know how your municipalities spend their money or want to access national statistics. Still there is much to learn from other countries: - **How does Norway manage their information so well** that they respond to Freedom of Information requests much faster? - What country has **a minister that deals in the most open way with lobbyists**? - Can governments produce **modern open source software**? These examples can show us a future of a digitally transparent democracy. We end the talk by opening up the floor to the audience and love to hear about positive examples of transparent forms of governments around the world. about this event: https://program.mch2022.org/mch2022/talk/LFVBN3/

Digital maps are ubiquitous tools in our everyday life. In the early 90s, the idea of browsing the world digitally and visiting any place was groundbreaking. The first solution to this problem is known as "TerraVision", which was breathtaking at that time. Today, the idea of exploring your surroundings using digital maps has become pretty normal. But how do these maps work? In this talk, I want to provide an overview of the foundations of digital mapping solutions. Differences between maps which use vector data and rasterized satellite imaginary will be outlined. Furthermore, a new and open-source map renderer called [maplibre-rs](https://github.com/maplibre/maplibre-rs) will be presented, which is created using Rust and modern web technologies like WebWorkers and WebAssembly. Lastly, I want to show differences between commercial solutions and free and open-source ones. A lot of mobile and web applications depend on customizing and displaying maps. There are not many cross-platform solutions available. Some only work in the web. Some only work on mobile devices. Furthermore, there are only a few truly free and open-source mapping stacks available. I want to explain how [maplibre-rs](https://github.com/maplibre/maplibre-rs) can solve current challenges by leveraging a modern rendering stack. Last year I had a lot of spare time and decided to kick-start a project which combines different areas of interest: Rust, 3D rendering, Geo data This project was adopted recently by the [MapLibre](https://maplibre.org/) project and is now known as [maplibre-rs](https://github.com/maplibre/maplibre-rs). The [maplibre-rs](https://github.com/maplibre/maplibre-rs) library is a proof of concept which showed me the complexity of mapping solutions. It takes a lot of steps until edits from OpenStreetMap contributors are finally rendered in consumer applications. With this task I want to take listeners on a journey from drawing changes in the OpenStreetMap editor all the way until vectors are uploaded to from memory to GPUs. Like outlined in the abstract, I want to cover multiple topics: * Foundations of digital maps (How to determine which data should be loaded? What are vector and raster tiles?) * Show the technology stack which allows us to design and develop a cross-platform map renderer (Web, Mobile, Desktop) Lastly, I want to provide a software developer perspective on mapping technologies. about this event: https://program.mch2022.org/mch2022/talk/BRHLYE/

IRMA is a system in which you are in control of sharing specific personal properties (aka attributes) such as your age, address and gender which are stored in the IRMA app on your phone. Technically, IRMA is a set of free and open source software projects implementing the Idemix attribute-based credential scheme. Although the Idemix credential system has been around for a while it is still relevant today. In this talk, we walk you through the crypto behind Idemix, explain how it works, why it is safe and give you the means to understand Gabi, the Go implementation of Idemix that is used in IRMA. Presentations on privacy products often focus on the principles of why we should want to protect our privacy and how the product does this from a birds-eye or user perspective. In case of IRMA, this focus would be on storing your attributes on your local device and on the information flow when the IRMA app is used. However, in this talk we want to dig deeper, demonstrate the crypto behind the curtains and give you the means to reason why IRMA is a neat solution. Note that the talk is very technical. We will cover the theory of the zero-knowledge proofs, the Camenisch-Lysyankaya signature and the Idemix credential verification, all so you can understand the Go implementation of the Gabi library. If time allows, we'll also cover IRMA-specific solutions such as the keyshare protocol and revocation. We will cover a lot of ground very quickly but after this talk you will have an excellent starting point for truely understanding this anonymous credential system. Of course we'll provide you with follow-up material and are happy to chat some more after the talk with a beer or two. Background knowledge that will help in understanding this talk: - General understanding of public key cryptography, especially RSA (https://www.youtube.com/watch?v=MsqqpO9R5Hc, https://www.youtube.com/watch?v=SL7J8hPKEWY) - Basic algebra, namely the laws of exponentiation - Some context on IRMA (https://irma.app/docs/overview/) about this event: https://program.mch2022.org/mch2022/talk/AFD3XT/

Microbes are everywhere. They are part of nature, both around us and inside of us. When you provide their desired niche, you can make them do something for you, in a mutually beneficial arrangement. This talk will take you into their realm, and show a few practical examples and hacking opportunities. Our climate is on fire, but we are still reaching for an Ultimate Solution. We don't move until we get a drop-in replacement to sustain current habits, at no extra cost. Our cognitive dissonance makes us trust politicians to deliver on promises, and energy vendors to withstand lucrative green washing. But it is both interesting and profitable to be part of the solution, and not of the problem. I have a long-standing fascination with microbial processes. They are adaptive and resilient while they modestly take on chores that pull things back to nature's standards. I think many problems that we are facing now can be solved locally and efficiently with clever combinations of technology and microbiology. Not always complete solutions and not everything is simple, but they certainly add to resilience and taking ownership of problem *and* solution. In a perfect situation, energy is harvested when&where it is abundant and moved to when&where it is needed. This talk demonstrates ways of doing at least some of that with the help of microbial systems. We will demonstrate overlap and connections, and conditions under which they may be hacked: Outline: * Beer. Vinegar. Innoculation. Permaculture. * Gut. Fiber or Fat. SCFA. Immune system. Epigenetics. * Biogas. Acetate. Sulphur and ammonia. Garbage in, garbage out. * Microbial fuel cell. Clay and carbon. Training. * Pee. Urea. Energy calculations for a Raspberry Pee. * Poo. Phosphate. Energy calculations for iPoo mobility. * Compost. Worms. Energy calculations for heat generation. * Climate change & zoonose. Cramming sick animals. Antibiotics. Government ignorance. Summary: * Making beer uses yeast to turn sugar to alcohol. Yeast can flexibly adapt from/to glucose via DNA switching to generate different enzymes. Let fruit flies in, and they bring along Acetobacter that reduce alcohol to vinegar. Wild fermentation is more natural, and yields a lambic beer. Save work by going for stable, naturally mixed processes. * Our gut processes whatever we can't. Two rough kinds of colonies co-exist. One consumes cholesterol/bile and the other plants/fiber. They tune our body via SCFA, the immune system and epigenetics. You can hack by changing your food (and after a few weeks, the microbes are thought to hack you by asking for more; so much for free will?!?) * Biogas works like a gut. It forms/consumes acetate CH₃COOH to produce CO₂ and methane CH₄ with byproducts hydrogen H₂, hydrosulphide H₂S and ammonia NH₃. Local cycles can process known sludge and produce usable liquid output, but large-scale anonymity destroys that. Some influences are possible, but the process is basically difficult, smelly and a bit dangerous. * Microbes can live in a fuel cell, which then accepts electrons and passes H+ through a membrane. Urine can be broken down with just clay and carbon -- and a culture. What are researchers doing? A variant to produce hydrogen H₂. And the potential of driving microbes by passing in a current. * Pee contains urea (NH₂)CO(NH₂), a hydrogen carrier. Urea is stable when dried, but otherwise reduces to ammonia NH₃. Soil microbes normally turn ammonia into atmospheric N₂ and water. But we can also use urea in a fuel cell to extract electricity or hydrogen. * Poo contains many microbes, some of which are pathogenic. But it is also our disposal channel for phosphorous (which we mine to grow food) and nitrogen. Troubled hygiene, but can this be safe? Is it a good idea? * Compost is incredibly straightforward and safe. The nutrient cycle is so short that nature could have invented it... oh wait, it did. Spring brings a gradual start, Summer collects energy, Autumn sheds it off and Winter benefits from the captured energy. Because composting generates heat, and has been used for heating homes, or parts of homes. Though mostly self-controlled, there are broad requirements for heat retention, moisture, oxygenation and C:N ratio. Working with these, you can have some degree of control over this process. * Microbes mutate if we force them into another environment. Like a sick animal. Or 3000 of them. Antibiotics form a bonus challenge. Many animal farmers carry resistent microbes. Zoonoses are on the rise due to climate change, and they are the common source of infectious diseases. Government practices [best effort management](https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/wob-verzoeken/2020/10/28/besluit-wob-verzoek-prognoses-ziektekiemen-uit-dierhouderijen/Besluit+Wob-verzoek+prognoses+ziektekiemen+uit+dierhouderijen.pdf) by chasing for *known* diseases; they are generally clueless about possible future zoonoses and any involved risk to humans. [S

Predictive policing is hip and happening. In the last few years we have seen a number of experiments with predictive policing in The Netherlands. How does that technology work? What were the outcomes of the experiments? And what is the legal status of a suspicion generated by a computer? "Predictive policing" is the name of a family of technology that use historical crime data to make predictions about future crimes (cue Minority Report). Police departments all over the world are very interested in this technology because it promises better results (more crimes prevented) at lower cost. In the Netherlands we have seen a number of experiments with predictive policing, and one of these systems (CAS) is currently being rolled out throughout the country. But how do these systems work? And how _well_ do they work? And what is actually the legal status of a suspicion generated by a computer? This talk will give discuss relevant predictive policing experiments in the Netherlands and abroad and will discuss the results of these experiments. The talk will also cover the legal status of suspicions generated by this technology in the Netherlands. about this event: https://program.mch2022.org/mch2022/talk/DJ8FCY/

Enterprise web applications have been deployed rapidly to the internet over the last ten years. Often, these applications remain secure, purely due to how difficult it is getting a copy of the source code. Unsurprisingly, some of the most popular enterprise web applications contain critical pre-authentication vulnerabilities. This presentation discusses how to get your hands on enterprise web applications and how to audit them for vulnerabilities, demonstrated through the disclosure of multiple 0days in popular enterprise web applications. When performing offensive source code analysis, the road to critical pre-authentication vulnerabilities usually involves a treacherous journey. From obtaining the source code, to mapping out sources and sinks, this presentation will take you on this journey to finding critical bugs in the following software: - IBM Websphere Portal / HCL Digital Experiences - Solarwinds Web Help Desk - Sitecore Experience Platform - VMWare Workspace One UEM (AirWatch) By experiencing the discovery process of 0days in popular enterprise web applications, this process can be repeated on the enterprise applications your company uses. The vulnerabilities discussed in this presentation have all gone through a responsible disclosure process. about this event: https://program.mch2022.org/mch2022/talk/EF7VSC/

This talk will investigate how the concept of private property has fundamentally altered our behavior towards the environment. We will investigate how an alternative ontology of electronic waste is needed and argue why dumpster diving, hacking and reverse engineering abandoned electronics is more relevant than ever to tackle this problem. Within the discourse that surrounds the global rise in electronic waste, only a select range of subjects receive attention from the public - international relations, global waste management strategies and corporate greenwashing rhetoric that emphasizes a ‘circular’ economy. Although the legitimacy of these strategies can be debated, they fail to address the root of the problem. Following the pervasive concept of private property and how it has infiltrated the ways in which we think about ourselves, our relationships between each other and the environment, we will arrive at how this concept has solidified itself within the ontological frameworks we use to make sense of waste and electronic waste in particular. We will discuss how, when we get rid of the concept of private property (and subsequently the concept of waste), we can reimagine what abandoned electronics mean to us and how we can best address the incessant pressure from manufacturers to treat them as expendable, throw-away objects. We will discuss how collective dumpster diving, hacking and reverse engineering abandoned electronics might be a possible solution and present free and open source tools that could aid us in the process. about this event: https://program.mch2022.org/mch2022/talk/QZDECX/

Building Web-Applications is hard. Making them scale is even harder. And nobody said anything about robust yet. Looking back over the past 25 years of Web-Development, not much has changed, except for tooling and languages. The approaches we use, also have not changed much. We still write lots of JavaScript, put special glue in between layers of languages, it's bleak. Building Web-Applications is hard. Making them scale is even harder. And nobody said anything about robust yet. Looking back over the past 25 years of Web-Development, not much has changed, except for tooling and languages. The approaches we use, also have not changed much. We still write lots of JavaScript, put special glue in between layers of languages, it's bleak. Let's have a look at the Phoenix Framework, a modern approach to building Web-Applications in Elixir, on the Erlang VM, without having to resort to a multitude of languages and frameworks. In this talk we will - **NOT** pick a JavaScript framework like React or Angular - **NOT** write a single line of JavaScript - **NOT** care about Erlang or it's Syntax - **NOT** spend hours to making the application WebSocket-capable and feel "live" But we will - write a state-of-the-art application that looks and feels professional in record time - have tests for every feature, buttons, links or forms we implement (test-coverage upwards of 90%) - have formatted our code, linted, error checked - run the test-suite, before every commit about this event: https://program.mch2022.org/mch2022/talk/L3HRXH/

I present background, rationale and future plans of Scientist Rebellion, a growing international group of currently over a thousand scientists venturing into civil disobedience since writing more papers about the climate emergency does not yield the needed political sense of urgency and actions. I'll present Scientist Rebellion, an international group of scientists taking the scientific view of the climate emergency seriously, stepping away from writing yet another paper giving the same warnings and venturing into civil disobedience. We've had worldwide (27 countries) actions and growing rapidly, as more scientists feel the necessity for society to do more (not just throwing more money at companies when they promise to be less polluting, but strict laws preventing such pollution levels). Dutch site: https://www.scientistrebellion.nl/ International site: https://scientistrebellion.com/ about this event: https://program.mch2022.org/mch2022/talk/9LZJYH/

Last year we won Pwn2Own by demonstrating remote code execution, using a chain of three vulnerabilities, on the then latest version of the Zoom client. In this talk we would like to share all details of the vulnerabilities we found and how we combined them into a fully working exploit. When the pandemic required everyone to work from home, we saw a huge growth on the video conferencing market. It was this movement that made the organisation behind the world famous Pwn2Own competition decide to add an 'Enterprise Communications' category to last year’s competition. Everyone who was able to successfully demonstrate a zero-day attack against Zoom or Microsoft Teams would be rewarded $200,000. We decided to take them up on this challenge and started researching Zoom. This resulted in a working remote exploit against the at the time latest version of Zoom that would give the attacker full control over the victim’s system (CVE-2021-34407). During this talk, we will walk you through how we started our research, explain the vulnerabilities that were found and finally how those vulnerabilities were incorporated into the exploit that successfully performed the attack during the contest. about this event: https://program.mch2022.org/mch2022/talk/QVXXUP/