Chaos Computer Club - archive feed

Wir zeigen euch die Fnords in den Nachrichten des Jahres. Endlich wieder ein normaler Ausklang fürs Jahr! Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/fnord-nachrichtenrckblick-2024/

Reticulum is a cryptography-based networking stack for building local and wide-area networks with readily available hardware. Reticulum can continue to operate even in adverse conditions with very high latency and extremely low bandwidth. The vision of Reticulum is to allow anyone to operate their own sovereign communication networks, and to make it cheap and easy to cover vast areas with a myriad of independent, interconnectable and autonomous networks. On this talk we shall present Reticulum, a highly resilient cryptography-based networking stack, that you can use to get out of the shackles of surveillance corporate networks. Reticulum is a tool for building networks. Networks without kill-switches, surveillance, censorship and control. Networks that can freely interoperate, associate and disassociate with each other. Reticulum is Networks for Human Beings. It solves the same problem that any network stack does, namely to get data reliably from one point to another over a number of intermediaries. But it does so in a way that is very different from other networking technologies: - Reticulum does not use source addresses. No packets transmitted include information about the address, place, machine or person they originated from. - There is no central control over the address space in Reticulum. Anyone can allocate as many addresses as they need, when they need them. - Reticulum ensures end-to-end connectivity. Newly generated addresses become globally reachable in a matter of seconds to a few minutes. - Addresses are self-sovereign and portable. Once an address has been created, it can be moved physically to another place in the network, and continue to be reachable. - All communication is secured with strong, modern encryption by default. - All encryption keys are ephemeral, and communication offers forward secrecy by default. - It is not possible to establish unencrypted links in Reticulum networks. - It is not possible to send unencrypted packets to any destinations in the network. - Destinations receiving unencrypted packets will drop them as invalid. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/reticulum-unstoppable-networks-for-the-people/

A Deep Dive into WAP, SMS, monophonic ringtones and 1-bit graphics. A key part of early 2000s advertisements were hyperactive frogs and annoying crocodiles trying to lure people into subscribing to overpriced ringtones and silly graphics for their mobile phones. Apart from shady business practices -- how exactly do you send pictures and ringtones to vintage GSM mobile phones (most of which don't even support TCP/IP)? In our quest to learn more, we stumbled across WAP-Push, User Data Headers, Concatenated SMS, SMPP, User Agent Profiles and many more forgotten technologies. To put all this knowledge to good use, we built Blåmba -- a Chaos ringtone provider, clearly inspired by the (now long defunct) historic ones. Then at Chaos Communication Camp 2023 with the C3GSM network, we had the first public instalment of Blåmba. The Chaos community uploaded lovely artwork and new ringtones, sent patches for the software, and had a fun time reviving their old Nokia phones. This talk will tell the story behind Blåmba, explain how ringtones (and more) made their way onto your phone, what a WAP gateway did, and what other cool tricks mobile phones could do (if you had the money to pay for GPRS traffic 20 years ago). Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/blmba-behind-the-scenes-of-a-2000s-style-ringtone-provider/

All challenges and achievements in creating a competitive time-trial AI in NFS:MW. 15 years ago, at the height of my eSports career, I uploaded an (unofficial) ESL record at Need for Speed: Most Wanted (2005) (NFS:MW) to Youtube. In the meantime Deep Reinforcement Learning became popular and ever since I have dreamt of creating a competitive AI for my favorite racing game of all time: NFS:MW. Now finally the time was right: The hardware is fast enough, good software is available, and Sony's AI research has proven the task is actually doable. Hence I thought: "How hard can it possibly be?". This talk will present in detail all challenges and achievements in creating a competitive time-trial AI in NFS:MW from scratch - including but not limited to - hacking of the game to create a custom API, building a custom (real-time) OpenAI gym environment, steering the game using a virtual controller, and finally successfully training an AI using the Soft-Actor-Critic algorithm. All code including the API is written in Python and is open source. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/a-competitive-time-trial-ai-for-need-for-speed-most-wanted-using-deep-reinforcement-learning/

Eine wachsende Zahl von Menschen eignet sich ihre empfundene Abhängigkeit von digitaler Pornografie als mystischen Fetisch an – sie konsumieren ihren Konsum. Was ist Gooning, wie hat es sich entwickelt und was kann es uns über unser Verhältnis zu Medientechnologie im weiteren Sinn erzählen? Pornografie gilt als wichtiger Treiber von Digitalisierung. Ihre Nutzung ist damit auch ein kulturelles Labor digitaler Konsumgesellschaft - aber eines, über das relativ wenig gesprochen wird. Was genau machen Leute eigentlich mit Pornos? Wie Pornos konsumiert werden, gibt mehr als nur Aufschluss über den Stand dessen, was wir “Sexualität” nennen. Menschliches Begehren ist die wichtigste Ressource für technische Entwicklung schlechthin, und in den Lustfarmen der Pornokonsumindustrie findet dieser Zusammenhang nur einen besonders deutlichen Ausdruck. Dieser Vortrag erzählt die Geschichte einer relativ jungen Form digitalisierter Sexualität rund um Pornografiekonsum: Gooning. Er beschreibt, wie über die letzten zehn Jahre diese Form der Lust an sich selbst eine innige Verbindung mit digitalen Medien eingegangen ist. Und er nutzt dieses Beispiel, um eine weitere Geschichte zu erzählen: eine Geschichte über menschliche und vor allem männliche Körper, die nicht anders können, als das Neue zu begehren – selbst angesichts der unerwünschten Zukünfte, mit denen die technologisierte Welt, von der sie abhängig geworden sind, sie konfrontiert. Inhaltshinweis Themen: Sexualität, Sucht. Nacktheit im Bildmaterial ist verpixelt. Dennoch nicht empfohlen für Personen unter 18 Jahren. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/desiring-technology-ber-porno-abhngigkeit-und-fortschritt/

Ein Talk über die Kommunikation ohne gesprochene oder geschriebene Sprache Kommunikation ist ja schon mit Worten manchmal schwierig - Wie ist das eigentlich, wenn man NICHT mit Worten kommunizieren kann? (Sei dies durch Sprachbarrieren, Psychische oder körperliche Beeinträchtigungen oder einfach nur aus Platzmangel) In diesem Talk werde ich mich auf eine ehrliche und hoffentlich auch etwas humoristische Art mit der Kommunikation mithilfe von Symbolen auseinandersetzen. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/instructions-unclear-ber-die-in-accessibility-von-symbolen/

For the seventh time, we'll present a colorful potpourri of nerdsniping topics: some of our favorite facts about computers, art, and the world! We draw a lot of inspiration from new and absurd ideas, and we'd like to share that enthusiasm with you! - [Vol. 1](https://blinry.org/operation-mindfuck/) (German) - [Vol. 2](https://blinry.org/operation-mindfuck-2/) (German) - [Vol. 3](https://blinry.org/operation-mindfuck-3/) (German) - [Vol. 4](https://blinry.org/operation-mindfuck-4/) (English) - [Vol. 5](https://blinry.org/operation-mindfuck-5/) (English) - [Vol. 6](https://blinry.org/operation-mindfuck-6/) (English) Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/operation-mindfuck-vol-7/

Raspberry Pi's RP2350 microcontroller introduced a multitude of new hardware security features over the RP2040, and included a Hacking Challenge which began at DEF CON to encourage researchers to find bugs. The challenge has been defeated and the chip is indeed vulnerable (in at least one way). This talk will cover the process of discovering this vulnerability, the method of exploiting it, and avenues for deducing more about the relevant low-level hardware behavior. The RP2350 security architecture involves several interconnected mechanisms which together provide authentication of code running on the chip, protected one-time-programmable storage, fine-grained control of debug features, and so on. An antifuse-based OTP memory serves as the root of trust of the system, and informs the configuration of ARM TrustZone as well as additional attack mitigations such as glitch detectors. Raspberry Pi even constructs an impressive, bespoke Redundancy Coprocessor (RCP), which hardens execution of boot ROM code on the Cortex-M33 cores with stack protection, data validation, and instruction latency randomization. Since there are many potential incorrect guesses to be made about where problems might lie, here I begin with the most fundamental features of the chip logic, including the reset process. Even small oversights at this level can entirely defeat sophisticated security efforts if higher-level mechanisms place complete trust in seemingly simple hardware operations. I show how cursory research into the design details of IP blocks used in the SoC can help inform an attack, and demonstrate the importance of fully testing new features which are built atop older IP. Ultimately, the significant amount of luck (or lack thereof) involved is a reminder of the need to meticulously understand and validate complex systems. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/hacking-the-rp2350/

You've probably already heard the story: we got contracted to analyze a bunch of trains breaking down after being serviced by independent workshops. We reverse engineered them and found code which simulated failures when they detected servicing attempts. We presented our findings at 37C3… and then shit hit the fan. This talk will be an update about what happened since our 37C3 presentation. We’ll talk about: - Three parliamentary workgroup sessions with dirty bathroom photos on Newag’s offtopic slides, train operators revealing that they paid Newag more than 20k EUR for unlocking a single train, which Newag was able to unlock in 10 minutes, and at the same time saying that they don’t know anything about the locks. - 140-page lawsuits, accusing us of _copyright violation and unfair competition_ (sic!) with a lot of logical gymnastics. - How it’s like to repeatedly explain reverse engineering concepts to journalists. - 6 official investigations, two of them criminal. - New cases revealed since then (from different train operators). - and much more! Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/we-ve-not-been-trained-for-this-life-after-the-newag-drm-disclosure/

IRIS (Infra-Red, *in situ*) is a technique for non-destructively inspecting the construction of a select but common type of chip. It can improve visibility into our hardware and provide supporting evidence of its correct construction, without desoldering chips or expensive analytical gear. This talk covers the theory behind IRIS, as well as some embodiments of the technique. I will also frame the relevance of IRIS in the face of various threat scenarios. Time permitting, I’ll also show how you can do it at home by peeking around a few chips as a demo. Do we really know what chips are inside our devices? To a first order, the answer is “no”. We can read the label printed on the chip's package, but most of us have no way to determine if the silicon actually matches what’s on the label. This lack of transparency has lead to much hand-wringing about the safety of our global supply chains, as chips zig-zag the globe on their way to our doorstep: each stop is an opportunity for bad actors to inject malicious hardware, and those of us without access to million-dollar analytical gear have no way of detecting this. IRIS (Infra-Red, *in situ*) is a technique I have been developing that aims to democratize the inspection of silicon. It turns out that for a select but fairly common type of chip - those in chip-scale packages - a simple modification to an off the shelf microscope camera can enable the visualization of micron-scale features within – without requiring any nasty chemicals or desoldering chips. I will also show how the basic everyday technique can be combined with a Jubilee 3D motion platform to create detailed, full-chip images. This talk will cover the basic theory behind the technique, and frame it in the context of several hypothetical threat scenarios that highlight its strengths and limitations. It is important to understand that IRIS is not a panacea for chip verification, but it is a significant step forward in improving transparency. I will also discuss its potential as a new tool for system designers who are serious about enabling user-level hardware verification. Finally, time permitting and equipment cooperating, I would like to share the simple pleasure of being able to take a peek inside the chips of some common mobile phone motherboards with a live demo. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/iris-non-destructive-inspection-of-silicon/

Was sind die fundamentalen Bestandteile der Materie, und wie interagieren sie miteinander? Die Teilchenphysik beschäftigt sich mit diesen grundlegenden Fragen und bildet die Basis unseres Verständnisses der Naturgesetze. In diesem Talk möchte ich euch einen Einstieg in die spannende Welt der Quarks, Leptonen und Bosonen geben. Ich werde die Grundlagen des Standardmodells der Teilchenphysik erklären, einen Einblick in Experimente wie den Large Hadron Collider (LHC) geben und zeigen, welche Rolle Teilchen wie das Higgs-Boson oder Neutrinos spielen. Der Fokus liegt darauf, die Teilchenphysik verständlich und anschaulich zu machen - ganz ohne Vorkenntnisse, aber mit viel Raum für Fragen. Dieser Talk richtet sich an alle, die mehr über die Grundbausteine der Materie und die Arbeit moderner Physiker:innen erfahren möchten. Egal ob Schüler:in, Student: in oder einfach nur Wissenschaftsinteressierte - hier seid ihr richtig! Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/einstieg-in-die-teilchenphysik/

Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/ultraschall-workshop/

Datenschutz darf auch Spaß machen, und alle können dabei etwas lernen, egal ob Einsteiger oder Profi-Hacker: Bei dem Datenschutz- und Datenpannen-Quiz kämpfen vier Kandidat:innen aus dem Publikum zusammen mit dem Publikum um den Sieg. Nicht nur Wissen rund um IT-Sicherheit und Datenschutz, sondern auch eine schnelle Reaktion und das nötige Quäntchen Glück entscheiden über Sieg und Niederlage. Die Unterhaltsame Datenschutz-Quiz-Show mit Bildungsauftrag! Datenschutz wird oftmals als lästige Pflicht wahrgenommen – aber was will und macht Datenschutz, für was ist er sinnvoll und was ist zu beachten? Die Datenschutz- und DSGVO-Show vermittelt spielerisch Datenschutzgrundlagen, bietet einen Einblick in die Praxis der Datenschutz-Aufsichtsbehörden und zeigt typische technische wie rechtliche Fehler im Umgang mit personenbezogenen Daten. Aber auch für Datenschutz-Profis und Superhirne sind einige harte Nüsse dabei. Der Moderator arbeitet beim Landesbeauftragten für den Datenschutz und die Informationsfreiheit Baden-Württemberg und berichtet aus der praktischen Arbeit einer Aufsichtsbehörde, nennt rechtliche Grundlagen, gibt Hinweise zu notwendigen technischen Maßnahmen nach Artikel 32 DS-GVO und die oftmals schwierige Risikoabschätzung nach „wir wurden gecybert“-Sicherheitsvorfällen. Im Quiz selbst müssen die Kandidat:innen in ihren Antworten praktische Lösungsvorschläge für häufige technische und rechtliche Probleme vorschlagen, zum Beispiel welche technischen Maßnahmen bei bestimmten Datenpannen nach dem „Stand der Technik“ angebracht sind, ob man als Website-Betreiber denn nun Google Analytics nutzen darf oder wie man sich gegen (rechtswidrige) Datensammler wehrt. Dadurch können Teilnehmer wie Zuschauer die praktische Anwendung der DS-GVO spielerisch lernen. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/die-groe-datenschutz-datenpannen-und-ds-gvo-show/

Bewegungsdaten von 800.000 E-Autos sowie Kontaktinformationen zu den Besitzern standen ungeschützt im Netz. Sichtbar war, wer wann zu Hause parkt, beim BND oder vor dem Bordell. Welche Folgen hat es, wenn VW massenhaft Fahrzeug-, Bewegungs- und Diagnosedaten sammelt und den Schlüssel unter die Fußmatte legt? Was verraten Fahrzeugdaten über die Mobilität von Behörden, Ämtern, Ministerien, Lieferdiensten, Mietwagenfirmen, etc.? Wofür werden diese Daten überhaupt gesammelt? Wir zeigen Kurioses bis Bedenkliches - natürlich mit mehr Respekt für den Datenschutz, als diejenigen, die die Daten gesammelt haben. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen/

Custom silicon chips are black boxes that hold many secrets, like internal ROMs, security features and audio DSP algorithms. How does one start reverse engineer them? Let's look at the basics of silicon reverse engineering, what gate array chips are, and how some tooling can generate Verilog code automatically from a die shot. A digital synthesizer from 1986 was completely shrouded in mystery and dubious marketing claims. Being that old, eventually every working unit will break, leaving us with the no info about its inner workings. I could not accept this, so I decided to get into silicon reverse engineering. By dissolving its undocumented custom chips into acid and looking at them through a microscope, I was able to get an understanding of what was going on internally, to be able to preserve it and emulate it in the future. This is possible because lot of custom silicon chips from that era (80s and 90s) are of the "gate array" type: a grid-like structure that contains thousands of digital logic gates. By looking at them closely we can understand what those gates do, and by following the wiring between them we can reconstruct the entire system. This method allowed people to understand and recreate perfect emulations of arcade games, sound chips, security ICs and more. In this talk I want to tell my journey into silicon reverse engineering from my perspective of a complete beginner and software guy, and what I learned in the process. I will go through the different kinds of custom chips, how they look under a microscope, their different parts, what can be easily reverse engineered and what can not. Those chips do not only contain logic, but also RAM and ROM parts, and knowing how to identify them can give clues when looking at the logic is too complicated. Sometimes a chip can be completely understood even without knowing that a MOSFET is. I will also cover the process I used for reverse engineer them, some techniques that worked and some that didn't, and some tools I built to automatically extract mask ROMs and generate Verilog code from die shots. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/proprietary-silicon-ics-and-dubious-marketing-claims-let-s-fight-those-with-a-microscope/

How to remote-control (and build) the weirdest devices with Bluetooth Low Energy and no programming. Want to build a connected [soap bubble maker | water boiler | door lock | ...]? This talk briefly covers the basics of Bluetooth Low Energy, outlining the effort needed to implement such a technology with raw code. It then focuses on how to leverage said technology without getting your hands dirty by replacing programming with a bit of configuration, demonstrating the usage of the [BLEnky](https://structure.nullco.de/?node_id=66216cdb1a95fb4425f23212&token=3c55f7bb1de0e79c9020dbb09deac741df56fc5474825407abb94f96714ce134&focused_node=6622041d1a95fb4425f2323a) project for quick results. [Click here for many more examples](https://structure.nullco.de/?node_id=66216cdb1a95fb4425f23212&token=3c55f7bb1de0e79c9020dbb09deac741df56fc5474825407abb94f96714ce134&focused_node=6622041d1a95fb4425f2323a) Some notable projects will be described, as well as a live hack of some stupid gadget to make it "smart". Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/hardware-hacking-mit-bluetooth-low-energy/

Welchen Einfluss hat die Form der Dinge? Wie wirken wir durch die Gestaltung unseren kulturellen Praxen, Architekturen, Sprachen und Strukturen auf uns und die uns umgebende Zukunft ein? Und warum findet sich in zeitgenössischer Design Theorie ein Verb wie *Futuring*? Basierend auf der Annahme, dass alles mit allem zusammen hängt und ein gemeinsames Interesse besteht, die gesamte Scheiße zum Guten zu wenden, lade ich dazu ein, anhand von Praxisbeispielen aus meiner künstlerischer Forschung und einfachen Live-Experimenten, zu erfahren, wie wir alle Welt gestalten. Und wie wir aus diesem Beteiligt sein Mut ziehen können, einer lebenswerten Zukunft für alle näher zu kommen. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/wie-wird-gleich/

A debut of new research and analysis, focused on emotions and the affective register—love! shame! intimacy! What happens when we put love and intimacy at the center of our understanding of privacy, and what are the consequences of their disavowal, in favor of a more familiar technocratic definition of privacy-as-absense? What role does our deep desire for love and belonging, and our concomitant fear of shame and rejection, have to do with the (mis)direction of tech capital and the current, warped shape of the tech industry and its products? We take these questions seriously, and work through their implications together in Hamburg during that brief, liminal window between the winter holidays and the new year. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/feelings-are-facts-love-privacy-and-the-politics-of-intellectual-shame/

This year Large Language Models (LLMs) in search engines told us to put glue on our pizza and eat a small rock every day. This is not ideal, and the consequences of "AI Overviews" and similar features could even be deadly for some people, like mushroom foragers. Maybe it's time for a new sort of search? In this talk I'll sketch out some possible futures and look at how we can put search back in the hands of the searcher. Also, there will be memes! Overall, the state of search right now is: not good. Search engine results are full of AI generated sludge, SEO spam and self-dealing by providers. This talk will look at the options that are open to us to improve search somewhat, including a few tips and tricks that anyone can take advantage of today to make hyperscale search providers like Google more functional again. But in many ways the most interesting question is whether we can find ways to discover stuff online that don't rely on a handful of hyperscale providers to do all the web crawling and indexing, and servicing of people's queries. In particular, what would happen if search was federated - how could we make that scaleable and performant, and what can we learn from the fediverse? Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/waiter-there-s-an-llm-in-my-search/

The public image of dinosaurs is largely shaped by art. While paleontology is a dynamic and productive science, it is primarily through paleoart that our perception of prehistoric life takes form. By combining informed speculation with a deep understanding of anatomy, ecology, and geology, paleoartists continuously reimagine extinct organisms in innovative ways. The public image of dinosaurs is largely shaped by art. While paleontology is a dynamic and productive science, it is primarily through paleoart that our perception of prehistoric life takes form. This tradition of science informed art form, rooted in a 200-year history, finds its inspiration in the fossil record and the interpretations it offers. The gaps in our knowledge are as influential as the fossils themselves. Through informed speculation and a fundamental understanding of anatomy, ecology and geology a paleoartist is able to bring back extinct organisms in ever new ways. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/how-to-spec-fun-with-dinosaurs/

Everyone kind of forgot about DNS. How does it work, how to claim it back and why? This talk will show some data about DNS to see differences between TLD's, will show how the entire thing works and the current problems in some setups. Then show how to make our own authoritative DNS servers in a secure and redundant way to claim ownership of it and decentralise it from the big providers. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/a-dive-into-dns/

Der Rodecaster Pro II ist derzeit das beste Aufnahmegerät für Podcasts. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/der-ultimative-rodecaster-pro-ii-workshop/

c3voc.tv - Meet the Teams c3lingo stb stellt c3lingo vor und berichtet was das Team auf dem Congress leistet. about this event: https://c3voc.de

c3voc.tv - Meet the Teams c3sign l3d erzählt ein bisschen von der Arbeit des Team c3sign auf dem 38c3. about this event: https://c3voc.de

Modern 3D capture through Gaussian Splatting and human memory reveal parallel landscapes – where precise centers fade into probabilistic smears at the edges, and gaps hold as much meaning as detail. This is about the preservation of an ephemeral present in digital amber, an interrogation of how we reconstruct both digital and remembered spaces. In July 2023, a new method of reconstructing reality was published in a paper called "3D Gaussian Splatting for Real-Time Radiance Field Rendering." Three months later, the first apps provided this technology in their pseudo social-networks. Gaussian Splatting produces a navigable, though static, 3D reconstruction of events from video footage – but also an intriguing aesthetic. Areas of sharp details are surrounded by calculated uncertainty, creating digital spaces that inadvertently mirror how human memory operates. The talk presents a video essay of the same name, exploring this resonance between technology and memory through a crafted blend of found footage, open-source media, and AI-generated elements. By developing custom tools for VR exploration and capture, the work documents these digital spaces from within, creating a choreographed journey through both technical and remembered landscapes. It is both a technical documentation and a poetic interpretation; it’s an interrogation of an emerging technology and a meditation on how we process and reconstruct our experiences, digital and remembered alike. The lecture will focus on the technical background, as well as the artistic practices used to create the video essay. From working with virtual reality and experimenting with AI-generated content, to making decisions and non-decisions – it traces the development of a work in the parallel landscapes of emergent technology and lingering memory, of imminent nostalgia and nascent futures. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/spatial-interrogations-or-the-color-of-the-sky/

Daten, Daten, Daten. Sicherheitsbehörden wollen immer mehr davon. Doch zu welchem Zweck und wo kommt machine learning ins Spiel? Wir liefern einen Überblick und besprechen Auskunftsansprüche, Beschwerdemöglichkeiten und Gegenmaßnahmen. Nicht erst seit dem diesjährigen Sicherheitspaket befinden sich deutsche Geheimdienste und Polizeibehörden in einer Datensammelwut. Spätestens seit dem 11. September 2001 und dem Terrorismusbekämpfungsgesetz dienen terroristische Anschläge als Legitimation für die Politik, den Sicherheitsbehörden die Befugnisse zu geben, die diese ohnehin schon lange fordern. Dabei wachsen die Datenbanken der Behörden stetig. Ihre Namen sind INPOL-neu, PMS links/rechts/sport oder rosa Liste (IGVP), ATD, PIAV (Polizeilicher Informations- und Analyseverbund). Oft kommt es vor, dass auch eigentlich Unbeteiligte in diesen Listen landen, so bleiben z. B. Personen gegen die ermittelt wurde, weiterhin in INPOL gespeichert, nachdem das Verfahren längst eingestellt wurde. Ebenso sollen, wie im Sicherheitspaket geplant, biometrischer Daten mit öffentlich im Internet verfügbaren Daten abgeglichen werden. Den Betroffenen ist dabei meist nicht klar, ob und in welchen Datenbanken sie landen; der Dschungel an Datenbanken und Zuständigkeiten ist auch kaum zu überblicken. Betroffene werden weder automatisch informiert noch gilt die DSGVO für Ermittlungsbehörden. Teilweise werden sogar gesetzliche Informationspflichten, wie beispielsweise über Unbeteiligte in Funkzellenabfrage schlicht nicht eingehalten. Die immer größer werdenden Datenmengen sind kaum durch Menschen zu verarbeiten. Deshalb soll auf sogenannte künstliche Intelligenz wie autmatisierte Gesichtserkennung, Ganganalysen oder Analysen von "auffälligem Verhalten" gesetzt werden. Dabei werden Entscheidungen, die bisher durch Menschen getroffenen wurden, an Computer ausgelagert. Der Computer entscheidet also, wer am Bahnhof kontrolliert wird und damit über den Eingriff in dessen Grundrechte. Was können wir tun? Janik steht selbst in diversen Datenbanken der Polizei. Er erzählt im Vortrag über seinen langen Weg, um Auskunft bei den verschiedenen Landes- und Bundesbehörden zu erhalten. Entlang dieses Weges musste er Klage einreichen, weil die Behörden keine Auskunft erteilte, er musste Beschwerden beim BfDI einreichen, da das BKA Fotos von seinem Gesicht aus einer erkennungsdienstlichen Behandlung zweckentfremdete, um damit eine Marktanalyse von Gesichtserkennungssoftwaren durchzuführen. Seine Rechtsanwältin Bea erklärt die rechtlichen Hintergründe und setzt sich mit der Frage auseinander, mit welcher Vorstellung von Verantwortung im polizeilichen Dienst wir es zukünftig zu tun haben werden. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/mit-dem-krcher-durch-die-datentrge-der-polizeien/

Digital identity solutions, such as proposed through the EU's eIDAS regulation, are reshaping the way users authenticate online. In this talk, we will review the currently proposed technical designs, the impact such systems will have, and provide an outlook on how techniques from modern cryptography can help to improve security and privacy. Digital Identity solutions are on the rise all around the world. In particular the European Union is establishing a range of ambitious proposals like eIDAS to establish a general purpose platform for identification, authentication and transfer of personal data that will be used by eGovernment, logging into Facebook, public transport, eCommerce and doctor visits. With the Digital Euro, the EU Digital Travel App, Age Verification Apps and many other proposals we can see the scary trajectory the EU is headed towards. This talk provides a critical reality check about the underlying technology, the impact these systems will have on our privacy on a daily basis and what security (hell) we can expect. The talk will also give an overview of the proposed technical eIDAS architecture, and the [Cryptographers' Feedback on the EU Digital Identity’s ARF](https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/issues/200). We will also provide a brief introduction into zero-knowledge proofs, the security and privacy properties they can provide for Digital Identities, and what is missing to bring these technologies into reality. Thomas Lohninger has worked for the digital rights NGO epicenter.works to advocate for [strong privacy in the eIDAS law](https://epicenter.works/en/thema/eid-digital-public-infrastructures) on EU level. He is a member of the [Ad-Hoc Technical Advisory Group of the EU-Commission on eIDAS Wallet](https://epicenter.works/en/content/nda-of-the-ad-hoc-technical-advisory-group-of-the-eu-commission-on-eidas-wallet) and the only civil society Jury member of the SPRIND Funke on [EUDI WALLET Prototypes](https://epicenter.works/en/content/germany-eidas-wallet-jury-agreement-nda) of the German government. Anja Lehmann is a professor for cryptography at the Hasso-Plattner-Institute, University of Potsdam, with a focus on developing privacy-enhancing technologies, in particular enabling privacy-preserving authentication. She is a Jury member of the SPRIND Funke on [EUDI WALLET Prototypes](https://www.sprind.org/impulse/challenges/eudi-wallet-prototypes#anchor-jury) and also supports the SPRIND EUDI project on the integration of zero-knowledge proofs since October 2024. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/eu-s-digital-identity-systems-reality-check-and-techniques-for-better-privacy/

Wähle Dein Risiko! Vor der Bundestagswahl 2017 veröffentlichten wir unsere Analyse über haarsträubende Sicherheitslücken in einer weit verbreiteten Wahlsoftware. Seitdem ist einiges passiert: Der Hersteller hat die Probleme nicht behoben, das BSI hat einen Stapel Papier produziert, die deutschen Anbieter von Wahlsoftware haben ihr Kartell vergrößert und unterschiedliche Wahl-Pannen untergraben weiterhin das Vertrauen in die Demokratie. Wurden unsere Empfehlungen von 2017 umgesetzt? Wir nehmen den Decompiler und schauen mal nach. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2024/hub/event/der-thring-test-fr-wahlsoftware/