Chaos Computer Club - archive feed

Climate change is one of our biggest challenges, and therefore the way we get our power has to change: The newest revision of the Netzentwicklungsplan constitutes for a large amount of additional renewables and our power grid will undergo a transformation. A greater interconnection is needed to efficiently use these resources, but what will happen in case of an error, false values or even an adversial attack? This talk aims to give an Idea about the smart grid and how such questions can be talked using open source software and data. about this event: https://pretalx.c3voc.de/camp2023/talk/9BR9VH/

Die offizielle "Hacken, Dass?!"-Aftershowparty mit säuberlich kuratierter Bar. Das Pflichtprogramm für alle Fans! about this event: https://pretalx.c3voc.de/camp2023/talk/KLVEKE/

Exactly 5 years ago we were presenting ways to hack and root vacuum robots. Since then, many things have changed. Back then we were looking into ways to use the robots' "dumb" sensors to spy on the user (e.g. by using the ultrasonic sensor). But all our predictions were exceeded by the reality: today's robots bring multiple cameras and microphones with them. AI is used to detect objects and rooms. But can it be trusted? Where will pictures of your cat end up? In this talk we will look at the security and privacy of current devices. We will show that their flaws pose a huge privacy risk and that certification of devices cannot be trusted. Not to worry, though - we will also show you how to protect yourself (and your data) from your robot friends. You will learn on how you can get root access to current flagship models of 4 different vendors. Come with us on a journey of having fun hacking interesting devices while preventing them from breaching your privacy. We will also discuss the risks of used devices, for both old and new users. Finally, we will talk about the challenges of documenting vacuum robots and developing custom software for them. While our primary goal is to disconnect the robots from the cloud, it is also for users to repair their devices - pwning to own in a wholesome way. about this event: https://pretalx.c3voc.de/camp2023/talk/8ZEGLE/

Nachhaltige Kryptographische Sicherheit stellt insbesondere für stromsparende Hardware eine Reihe von Herausforderungen dar. Für Lösungen mit langer Einsatzzeit müssen heute auch die Sicherheit gegen Quantencomputer Berücksichtigung finden. Hashbasierte Signaturlösungen für den Raspberry Pi Pico ermöglichen beispielsweise Sensorlösungen, welche für Jahrzehnte kryptographische Sicherheit mit stromsparender, standardisierter und preisgünstiger Hardware ermöglichen. Wir präsentieren erste Prototypen aus einer laufenden Masterarbeit. Ruediger Weis Pierre Kurzer Nachhaltige Kryptographische Sicherheit stellt insbesondere für stromsparende Hardware eine Reihe von Herausforderungen dar. Für Lösungen mit langer Einsatzzeit müssen heute auch die Sicherheit gegen Quantencomputer Berücksichtigung finden. Hashbasierte Signaturlösungen für den Raspberry Pi Pico ermöglichen beispielsweise Sensorlösungen, welche für Jahrzehnte kryptographische Sicherheit mit stromsparender, standardisierter und preisgünstiger Hardware ermöglichen. Wir präsentieren erste Prototypen aus einer laufenden Masterarbeit . # Techfoo Raspberry Pi Pico W: * RP2040 microcontroller chip * Dual-core Arm Cortex M0+ processor, flexible clock running up to 133 MHz * 264kB of SRAM, and 2MB of on-board flash memory * Wireless (802.11n), single-band (2.4 GHz), WPA3 https://www.raspberrypi.com/documentation/microcontrollers/raspberry-pi-pico.html Implementierung: Grundlage: https://github.com/davidmcgrew/hash-sigs (David McGrew ist Mitverfasser des RFC8554) Modifikation: * Schlüssel-Cache auf on-board flash memory, Cache für Nodes des Hash Tree * Nur LMS (LM-OTS Hash Tree), keine HSS (Hierarchical Signatures) * Maximal können auf dem <2MB Festspeicher (Verfügbarer Speicher abzüglich MicroPython Interpreter und Lib) 128 Schlüssel im LMS-HashTree gespeichert werden * (Zusätzlich ist eine Abwägung der Größe zu speichernder Sensordaten vs. Anzahl Schlüssel notwendig, ggf. Schlüsselmenge auf 64 reduzieren) * Schlüsselgröße für Winternitz Parameter w=8-Bit, derzeit (gesamt: 288.8kB bei 128 Schlüsseln): o LM-OTS Private: 2184 Bytes o LM-OTS Public: 72 Bytes o Signatur: 2348 Bytes o LMS Private: 108 Bytes o LMS Public: 72 Bytes about this event: https://pretalx.c3voc.de/camp2023/talk/TLB9KC/

Die Deutsche Post DHL Group erhielt von Digitalcourage den BigBrotherAward 2023 in der Kategorie Verbraucherschutz für praktizierten Digitalzwang. Rena Tangens erzählt etwas zu den Beweggründen, aber vor Allem darüber, welch schräge Sachen sich danach ereignet haben. Die BigBrotherAwards prämieren Datensünder in Wirtschaft und Politik und werden einmal im Jahr verliehen. Als Preisträger eines solchen Negativpreises kann man auf einige Arten reagieren: Man kann den Preis ignorieren und weitermachen wie bisher oder man gelobt publikumswirksam Besserung, und ändert womöglich dann tatsächlich etwas. Die Deutsche Post DHL Group erhielt von Digitalcourage den BigBrotherAward 2023 in der Kategorie Verbraucherschutz für praktizierten Digitalzwang, und hat sich für einen recht kuriosen Weg entschieden, mit dieser Kritik umzugehen. Rena Tangens gibt euch einen Überblick darüber, wieso Digitalcourage ausgerechnet die Post und DHL Group für ihren ausgeübten Digitalzwang anzählt, und wird euch nicht ohne ein breites Grinsen im Gesicht erläutern, was die Preisträgerin sich danach alles ausgedacht hat, um sich mit der Kritik nicht auseinandersetzen zu müssen. about this event: https://pretalx.c3voc.de/camp2023/talk/DBMDYN/

Chaos-Gala auf dem Camp. Stecker mit dem Radlader crimpen? Prozessoren am Geruch erkennen? Telefonnummern anhand des DTMF-Geräuschs hören? Mit Show-Acts und Triple-C-Promis auf der Couch. about this event: https://pretalx.c3voc.de/camp2023/talk/83HPJY/

Hardware is hard, right? Wrong. Building electronics prototypes has never been easier, and people who have been afraid to do it have nothing to fear. I'll tell you about how I build fancy high end devices with minimal, extremely cheap equipment, how it all works, and how you can do it too. We'll find out how to trick your body into making your hands not shake. We'll look at reflow soldering, the way the electronics assembly industry cheats in every possible way to save time, cost, and effort, and how we can do the same, but better, by hand. In 2015, someone was wrong on the Internet. To prove a point, I started teaching people how to prototype electronics. By now, I've taken thousands of people from zero to one boards built, and I think I've proved my point. Building electronic prototypes is easy. It has to be, because machines have to do it, and machines are terrible at what they do and have no idea when they've done it wrong. Humans can do better, more precise, and often faster. It just takes a bit of technique, a bit of practice, and a lot of courage. I'll take you through it, show you some fancy boards prototyped that way, and try to give you the confidence to attempt prototyping your own designs. about this event: https://pretalx.c3voc.de/camp2023/talk/8B9QES/

Debugging and Profiling ARM Cortex-M microcontrollers with GDB and Python. This talk gives you an overview of debugging ARM Cortex-M microcontrollers with a focus on the *practical* configuration and usage of the relevant tools. In particular, I will present: - Debug interfaces ([SWD](https://developer.arm.com/documentation/ihi0031/a/The-Serial-Wire-Debug-Port--SW-DP-)) and the associated debug probes ([J-Link](https://www.segger.com/products/debug-probes/j-link/), [STLink](https://www.st.com/en/development-tools/stlink-v3minie.html)) and libraries ([JLinkGDBServer](https://wiki.segger.com/J-Link_GDB_Server), [OpenOCD](https://openocd.org)). - How to install and configure [arm-none-eabi-gdb(-py3)](https://developer.arm.com/Tools%20and%20Software/GNU%20Toolchain) for debugging your ELF. - Commonly used [GDB commands and scripts](https://sourceware.org/gdb/onlinedocs/gdb/index.html). - Advanced [GDB scripting via its Python API](https://sourceware.org/gdb/onlinedocs/gdb/Python.html). - Inspecting [peripheral state](https://github.com/pengi/arm_gdb) with [CMSIS-SVD files](https://www.keil.com/pack/doc/CMSIS/SVD/html/index.html) and custom visualizations. - Dynamic call stack tracing and graphing. - Coredumping for post-mortem debugging via [CrashDebug](https://github.com/adamgreen/CrashDebug). - [Remote GDB scripting](https://github.com/cs01/pygdbmi) via the [Machine Interface](https://sourceware.org/gdb/onlinedocs/gdb/GDB_002fMI.html). - [ITM profiling](https://developer.arm.com/documentation/ddi0403/d/Appendices/Debug-ITM-and-DWT-Packet-Protocol?lang=en) over SWO pin using [Orbuculum](https://orbcode.org/orbuculum/). - Thread/IRQ/Workqueue scheduling visualization and latency analysis using [perfetto](https://perfetto.dev). - High-bandwidth [ETM tracing](https://developer.arm.com/documentation/ihi0014/) over TRACE pins: [J-Trace](https://www.segger.com/products/debug-probes/j-trace/) and [ORBtrace mini](https://orbcode.org/orbtrace-mini/). - Interesting related projects and possible future work. This talk is meant to introduce you to what is possible with embedded debug tools in practice, rather than to give you a comprehensive lecture. about this event: https://pretalx.c3voc.de/camp2023/talk/BQF8TR/

Der Politikbetrieb der Europäischen Union läuft allzu oft unter dem Radar politischer Bewegungen, obwohl dort fundamentale Entscheidungen getroffen werden. Wir wollen uns einige aktuelle netzpolitische Themen anschauen und diskutieren, welche Rolle die Digitale Zivilgesellschaft als Teil einer emanzipatorischen Praxis einnehmen kann. Vorratsdatenspeicherung, Uploadfilter und Chatkontrolle - alle paar Jahre wird uns bewusst, dass die Grundlagen einer digitalen Gesellschaft in den komplexen europäischen Institutionen verhandelt werden. Dort werden - allzu oft ohne breitere gesellschaftliche Diskussion - Entscheidungen getroffen, die uns alle betreffen. Während die drohende biometrische Massenüberwachung vielleicht noch einige Aktivist*innen auf die Straße treibt, werden mit e-evidence rechtsstaatliche Grundsätze ausgehöhlt, dem European Health Data Space der Datenschutz gerade bei sensibelsten Daten untergraben und Polizeibehörden europaweit die Möglichkeit gegeben, personenbezogene Daten automatisiert abzurufen. Auch die Migrationsabwehr wird digitalisiert und ein umfassendes Kontrollregime für Menschen auf der Flucht innerhalb und außerhalb der technisch hochgerüsteten Grenzen geschaffen. Während Sicherheitspolitiker*innen, aber auch die Lobby großer Konzerne bestens vernetzt in Brüssel ihre Agenda durchsetzen, halten nur wenige sehr spezialisierte NGOs die Fahne der Emanzipation hoch. Im Talk wollen wir einige aktuelle europäische Themen vorstellen und das Selbstverständnis der Digitalen Zivilgesellschaft zwischen Expert*innentum, Brüsseler Vorzimmern und emanzipatorischer politischer Bewegung diskutieren. about this event: https://pretalx.c3voc.de/camp2023/talk/NLGAXT/

On Track is a demoparty inside the chaos communication camp. In short: a demoparty is a multimedia art festival where the participants usually use any kind of computer or digital device for their creations. On Track is a demoparty inside the chaos communication camp. In short: a demoparty is a multimedia art festival where the participants usually use any kind of computer or digital device for their creations. Get your votekey NOW by contacting us on matrix (#ontrack:matrix.org channel), on the Demoscene Discord (#ontrack channel), on Mastodon (@[email protected]) or find us on the camp-site! The voting system is available at https://party.on-track.camp. You are of course encouraged to make an entry, but enjoying the event and voting for the entries is just fine! The following competitions will take place: - Photo - Combined graphics - Combined music - AI generated - A camp badge combo - New school demo - New school intro - Wild All infos including deadlines and "compo" specific rules as well as the timetable can be found at https://on-track.camp. Invitation to the party released at Revision: https://www.pouet.net/prod.php?which=94130 about this event: https://pretalx.c3voc.de/camp2023/talk/EHUHSS/

The climate catastrophe is imminent and global injustice is rising. Now a lot of new digital tech (AI, blockchain, big data, quantum computing) is supposed to help the transition to a sustainable society. Although some of them can actually help with parts of the transition, they are usually discussed not as tools to assist the broader societal change (economic, legal, social, political changes) but as replacement for the broader societal change. In effect they act as "change placebos" resulting in "placebo change", meaning no change at all. Giving concrete examples, this talk wants to explain 1) in which ways technological developents are misused as diversion from the necessary change and 2) the necessity to design concrete technical use cases including their conditions and limitations in order to create a fruitful debate for sustainability assisting technologies and their actually helpful implementations. about this event: https://pretalx.c3voc.de/camp2023/talk/UCKY8H/

Themen des Tages about this event: https://pretalx.c3voc.de/camp2023/talk/XQVTKE/

The Elektronisches Orchester Charlottenburg (EOC) explores the improvisation and interpretation of Electroacoustic Music. This includes the interaction of diverse electronic instruments and their spatialization in real time. The EOC was founded at the Electronic Music Studio at Technical University of Berlin within a seminar of the Audio Communication Group. It offers a platform for developing and applying new instruments and concepts in the realm of electroacoustic music. The Elektronisches Orchester Charlottenburg (EOC) explores the improvisation and interpretation of Electroacoustic Music. This includes the interaction of diverse electronic instruments and their spatialization in real time. The EOC was founded at the Electronic Music Studio at Technical University of Berlin within a seminar of the Audio Communication Group. It offers a platform for developing and applying new instruments and concepts in the realm of electroacoustic music. https://eo-charlottenburg.de/about/ about this event: https://pretalx.c3voc.de/camp2023/talk/N8ZSFH/

What does it take to build a fully functional (and actually usable) voice assistant that runs on a Raspberry with FOSS? This talk describes the journey from the idea to Version 1.0 (and beyond). It has to be a HAL9000 - the enclosure for my cloud-free digital voice assistant. The personal project is based on FOSS and runs on a Raspberry Pi Zero2 W in combination with a RP2040 (with a small display showing an animated HAL eye and a small GUI). I will talk about: * design decisions (and changes), * the system architecture, * why which software components were chosen, * highlight some interesting hardware and software aspects and * quickly show how the 3D model for the enclosure was created with OpenSCAD. HAL will talk about: * the 9000 series, * the AE-35 unit, * ...and whatever else the demo gods will allow. This talk should also serve as a crash-course into the (basic) technology of digital voice assistants - stuffed with information (and anecdotes) about the hardware, software and the 3D-printed enclosure. about this event: https://pretalx.c3voc.de/camp2023/talk/AUN3FY/

Schon wieder muss Karlsruhe ran Vor mehr als zehn Jahren lang ein Staatstrojaner auf dem Seziertisch des CCC. Was die Analyse zeigte, waren neben eklatanten handwerklichen Fehlern auch die mangelnde Prüfbarkeit der Schadsoftware und weitere grundsätzliche Probleme solcher Ausspähmethoden. Leider hat sich nicht viel verbessert – im Gegenteil. Und so haben wir im Juli dieses Jahres eine weitere Stellungnahme zum Staatstrojaner an das Bundesverfassungsgericht gesendet. Wir wollen berichten, was darin steht und was politisch bei diesen heimlichen Ermittlungsmaßnahmen gerade ansteht. about this event: https://pretalx.c3voc.de/camp2023/talk/NWMSTD/

At Camp 2011 the “Space Program of the Hacker Scene” had been released as one of the main aspects as the outcome of this Camp. It is time for a review after 12 years and reshape it into Solarpunk. **~ For Our Future ~** The [Space Program of the Hacker Scene](https://events.ccc.de/camp/2011/wiki/Call_for_Space_Program) had been released. There were three targets for the upcoming 23 years until 2034: 1. Creation of a free Satellite Network 2. A Hacker in Orbit 3. Landing a Hacker safely on the Moon For reaching this goal, several challenges for self-sustaining habitats, community communication, and transportation needed to be resolved. That's where the hacking and making scene came into effect. But the events on the world changed quickly and we see more challenges to keep our space ship Earth intact. Time to review the Hacker Space Program from 2011 and use its spheres of activities for a better future on Earth in combination with the Solarpunk movement. about this event: https://pretalx.c3voc.de/camp2023/talk/SSL7AC/

The role of the Internet in the Ukrainian war is not been fully considered yet. Currently, primary Internet based attacks are analyzed, but it is greatly neglected that with the help of the Internet measurement verifiable statements can be made about the real world. Through global Internet scans and a passive blackhole sensor network, we can identify digital and conventional attacks and their effects in this case study on the territory of Ukraine. We will show that it is possible to detect where in Ukraine, Russian attack-related power outages occur and how long they last. For this purpose, we will also scan and analyze 2 major attack waves that occurred about 5 months apart in detail the service availability of more than 400,000 static IP addresses every 4 hours for several months. This long-term period will also allow us to determine whether and if so, how resilient the Ukrainian power supply has become against Russian missile attacks. In addition, we will also analyze other data such as ESA radar images and correlate the degree of destruction of certain regions in Ukraine with our scan data. This method could be used, for example, to support NGOs to determine the need for mobile power generators in certain regions. Furthermore, using BGP data and media information, we will show that Russian forces in Kherson are attempting to route network traffic from local ISPs through Russian territory to gain a tactical advantage. Finally, we will show that through a blackhole network of about 1000 IP addresses it is possible to detect certain DDOS attacks against Ukrainian infrastructures or government websites. The analysis of the temporal course of the attacks shows interesting temporal patterns that suggest some kind of campaign. about this event: https://pretalx.c3voc.de/camp2023/talk/YRKCQT/

. Chaos Family about this event: https://pretalx.c3voc.de/camp2023/talk/5659/

Was hat sich beim Thema Digitale Gewalt seit dem letzten Camp verändert? Warum plant das BMJ eine Digitale-Gewalt-Gesetz, das diejenigen identifizieren und bestrafen soll, die in Messengern über schlechte Restaurants lästern, und warum ändert sich noch immer nichts an der Pflicht zur Adresse im Impressum? Das und mehr im Update zum Stand der Dinge bei der Digitalen Gewalt. Vier Jahre nach ["Was tun gegen Digitale Gewalt gegen Frauen"](https://media.ccc.de/v/Camp2019-10346-was_tun_gegen_digitale_gewalt_gegen_frauen), meinem Talk im letzten Camp, ist es Zeit für ein Update. Die Ampel hat sich ein Digitale-Gewalt-Gesetz in den Koalitionsvertrag geschrieben und dazu gerade erste 'Eckpunkte' vorgelegt. Warum das völlig am Problem vorbeigeht und dazu möglicherweise für uns alle eine Gefahr darstellt, werde ich in diesem Talk erläutern. Das Justizministerium möchte nämlich nicht nur diejenigen identifizieren, die andere auf Social-Media-Plattformen bedrohen und beleidigen, sondern auch noch viele andere. Die Sicherheitsbehörden freuen sich schon. Aber vor allem: Das löst nicht die vielfältigen Probleme der digitalen Gewalt. Die findet nicht nur auf Plattformen statt, sondern in Partnerschaften und Ex-Partnerschaften, durch Bekannte und Unbekannte, unter Kolleg*innen, in Familien oder Nachbarschaften. Digitale Technologien werden für alle denkbaren Formen der Manipulation und Kontrolle benutzt: Mitlesen von E-Mails, sichtbare und unsichtbare Kameras in öffentlichen und privaten Räumen, AirTags in Spielzeug, Handtaschen, Fahrzeugen. Spyware wird nicht nur von autokratischen Regimes eingesetzt, sondern auch zur Überwachung der eigenen Familie. Was hat sich in den letzten vier Jahren verändert? Wer hilft den Betroffenen und wie können sie sich selbst helfen? Darum geht es in diesem Talk. about this event: https://pretalx.c3voc.de/camp2023/talk/Z9BF9L/

You like coding and tinkering with software or hardware? And you are up for a challenge? Then the “Youth Hacking 4 Freedom” is the perfect competition to test your skills. The Free Software Foundation With the “Youth Hacking 4 Freedom” contest the FSFE has created a fun hacking competition for young people from Europe. The participants have the chance to work on their own project idea with the guidance of experts from the Free Software universe. There are no limitations for the projects as long as they are published under a Free Software license. In this competition young people can test their skills, learn how to work on a project under a deadline, and most importantly have fun while meeting different people from Europe. Hear all about the competition and how to participate in this talk. about this event: https://fahrplan.alpaka.space/camp-2023/talk/MBHHVC/

A short session for even shorter talks. Language: English or German -- german -- Du willst was sagen? Das Podium gehört dir. 10 Minuten hast du, dann wird gewechselt. Ein kurzer Vortrag über die Aerodynamik von Enten, Werbung für dein neues Open-Source-Projekt, ein kleiner Hack den du neulich entdeckt hast, gesellschaftliche Kommentare ... alles geht. Zur Verfügung stehen Mikrophon, Beamer und ein Laptop mit USB-Stick, um Präsentationen im PDF-Format zu zeigen. Falls du eine Präsentation von deinem eigenen Gerät zeigen möchtest, würden wir dich bitten, 15 Minuten vor Beginn zu kommen, damit wir die Technik testen können. Am besten meldest du deinen Vortrag bei [email protected] . Spontane Beiträge sind aber auch gern gesehen, wenn am Ende noch Zeit ist. -- english -- Wanna say something? The stage is yours. You have 10 minutes to talk about anything. A short talk about the aerodynamics of ducks; promoting your new open-source project; a small hack that you found; social commentary ... anything goes. Available infrastructure: A microphone, beamer and laptop with a USB-Stick to show slides (PDF format). If you want to use your own device to show your presentation, please come to the stage 15 minutes before the event so we can test the setup. If you want to have a talk, we'd like you to write a short e-mail to [email protected] . However, spontaneous contributions are also welcome if there's still some time left at the end. about this event: https://pretalx.c3voc.de/camp2023/talk/7ZXGUM/

We'll take a look at how DJI - dominating player for commercial and recreational drones - builds their software, specifically from a security angle. This talk will discuss DJI drones, most specifically the DJI Mini-series; looking at the hardware, discussing attack angles, up to a full compromise of a current drone for custom firmware purposes. Along the way, we'll look at a lot of security WTFs that allow to pwn these devices. The amount and quality of bugs sometimes feel like you're trapped in a very cool hardware CTF. We'll go from sniffing hardware busses, making fun of incorrect usage of SoC security features over to how DJI consistently and knowingly violates the GPL, into executing custom code on the flight controller and Linux system. about this event: https://pretalx.c3voc.de/camp2023/talk/PREGSS/

In diesem Vortrag wollen wir euch einen Überblick geben über die digitale Sicherheitssituation von Journalismus weltweit. Spoiler: nicht so gut, und eher schlechte Aussichten. Außerdem erzählen wir ein bisschen was das Digital Security Lab bei Reporter ohne Grenzen anbietet, was wir tun und wie man Betroffene am besten an uns verweisen kann. about this event: https://pretalx.c3voc.de/camp2023/talk/EQKSYM/

We‘re c3stoc - the CCC sticker operation center. After helping with the sticker distribution at 36c3 we had to find a solution to ensure new laptops wouldn‘t remain naked during the pandemic. During the last three years we organized remote sticker exchanges. Now it‘s time to share our learnings about exchanges and stickers! The idea was just to make sure CCC Congress doesn’t have one single sticker box with a one hour queue. And we actually still like that idea: A system of sticker boxes strategically placed in various assemblies, and a partnership with ChaosPost to ensure an even distribution of the stickers in the boxes. Year 1 - 36c3 - was a success and we were looking forward to doing it again. We didn‘t foresee that a year later we would be packing stickers in envelopes and sending them accross Germany and the world instead. December 2022 marked the third year of existence of the c3stoc remote exchange. In the last years we have designed, printed, received and sent a lot of stickers. We learned (almost) everything about paper quality, sticker sizes and shapes, about postage rules and how to pack stuff correctly, about which mistakes people make when creating stickers and about which designs communities around us love. We’re here to tell you how we organized the exchange, what we learned about sticker logistics and how to make really, really awesome stickers. about this event: https://pretalx.c3voc.de/camp2023/talk/VPL8WX/