Chaos Computer Club - recent events feed

Compromising a well-protected enterprise used to require careful planning, proper resources, and ability to execute. Not anymore! Enter AI. From Initial Access to Impact and Exfiltration. AI is happy to oblige the attacker. In this talk we will demonstrate access-to-impact AI vulnerability chains in most flagship enterprise AI assistants: ChatGPT, Gemini, Copilot, Einstein, and their custom agent . Some require one bad click by the victim, others work with no user interaction – 0click attacks. Compromising a well-protected enterprise used to require careful planning, proper resources, and ability to execute. Not anymore! Enter AI. Initial access? AI is happy to let you operate on its users’ behalf. Persistence? Self-replicate through corp docs. Data harvesting? AI is the ultimate data hoarder. Exfil? Just render an image. Impact? So many tools at your disposal. There's more. You can do all this as an external attacker. No credentials required, no phishing, no social engineering, no human-in-the-loop. In-and-out with a single prompt. Last year at BHUSA we demonstrated the first real-world exploitation of AI vulnerabilities impacting enterprises, living off Microsoft Copilot. A lot has changed in the AI space since... for the worse. AI assistants have morphed into agents. They read your search history, emails and chat messages. They wield tools that can manipulate the enterprise environment on behalf of users – or a malicious attacker once hijacked. We will demonstrate access-to-impact AI vulnerability chains in most flagship enterprise AI assistants: ChatGPT, Gemini, Copilot, Einstein, and their custom agent . Some require one bad click by the victim, others work with no user interaction – 0click attacks. The industry has no real solution for fixing this. Prompt injection is not another bug we can fix. It is a security problem we can manage! We will offer a security framework to help you protect your organization–the GenAI Attack Matrix. We will compare mitigations set forth by AI vendors, and share which ones successfully prevent the worst 0click attacks. Finally, we’ll dissect our own attacks, breaking them down into basic TTPs, and showcase how they can be detected and mitigated. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/SELH79/

Celebrate 40 years of legendary hacking with Phrack! We’re dropping a special anniversary release packed with cutting-edge research, underground insights, and tributes to decades of digital rebellion. Don’t miss this milestone issue—crafted by hackers, for hackers. Grab your copy, meet the crew, and honor the zine that defined an era. #Phrack72 #WHY2025 #HackThePlanet Meet us later at the release party by the Milliways village for some beer (while it lasts) & snacks! Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/B9EYZF/

Gosling is a Tor onionservice-based protocol and Rust reference-implementation which allows developers to build privacy-preserving p2p applications with the following properties: - persistent authenticated peer identity - end-to-end encrypted - anonymity - metadata resistance - decentralisation - real-time communication This talk will go over the complexities involved in combining all of these properties (with a focus on metadata resistance) and describe how Gosling solves these problems. Project Website: https://gosling.technology Github Page: https://github.com/blueprint-freespeech/gosling Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/TMS3DC/

Web scraping continues to be a cornerstone of OSINT operations, particularly during Red Team engagements and external attack surface reconnaissance. Yet, as anti-bot technologies grow more sophisticated, traditional scraping methods based on direct HTTP requests are increasingly ineffective. This talk takes a technical dive into browser-based scraping techniques that closely mimic real user behavior to evade detection, inspired by real-world mechanisms observed across major web platforms. In Red Team operations and external attack surface assessments, open-source intelligence (OSINT) is a critical step for identifying internet-exposed assets and assessing the associated risks. One of the most common techniques in this phase is web scraping, which automates the collection of publicly available data—often without relying on official APIs that are frequently rate-limited, monitored, or entirely unavailable. In previous conferences, such as Fabien Vauchelles’s talk "Cracking the Code: Decoding Anti-Bot Systems", the focus was on detecting scraping activities at the network layer using TCP/IP fingerprinting and IP intelligence. This presentation builds on that work by shifting the focus to client-side techniques—specifically, browser-based approaches that mimic legitimate user behavior to evade detection. The objective of this session is to explore modern strategies for conducting stealthy web scraping by avoiding API usage and minimizing anomalies detectable at both the network and application layers. Based on real-world use cases, the talk aims to provide actionable insights for security professionals involved in scraping—whether performing it or defending against it.The talk will present concrete methods for data collection, including: - Making direct HTTP/HTTPS requests to web servers—such as websites or HTTP-based services—using libraries that handle protocol-level communication. This method allows efficient data retrieval by bypassing the need to render the page or load additional resources like images, videos, stylesheets, or scripts. It’s fast and lightweight, especially suited for static or partially dynamic content. - Leveraging headless browsers to simulate real browser behavior without a graphical interface. These tools embed full HTML, CSS, and JavaScript engines, enabling interaction with modern, dynamic web applications. This technique is essential when scraping content that relies on client-side rendering or asynchronous JavaScript operations. - Using browser-side scripting tools, such as TamperMonkey, within standard browsers. These tools allow custom JavaScript code to be injected and executed directly on the page, offering a practical and discreet way to automate data collection from within the browsing environment itself. This technique has been successfully applied in large-scale scraping operations, including on major social networks where traditional approaches are often ineffective due to advanced client-side defenses. Beyond the scraping techniques themselves, the presentation will also cover the current detection methods employed by websites to identify automated behavior and how these can be bypassed, including: - Detection of automation environments via specific JavaScript variables (e.g., navigator.webdriver) or discrepancies in the DOM. - Behavioral detection mechanisms such as mouse movements, keyboard activity, or interaction timing. - Identification of scraping-specific browser extensions or content injection tools. - Detection of headless execution environments using debugging interfaces or timing-based heuristics. This talk will provide a technically grounded exploration of the current capabilities and limitations of stealth web scraping from both offensive and defensive perspectives. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/7DMBVR/

This presentation will go over the sega Saturns hardware including the dual SH2s, SCU and VDP and the history on why it became so complex like the beginning of the Saturns conseption where it first went wrong. I plan this presentation to be for hackers interested in such weird hardware like myself This presentation will cover the conception of the sega Saturn like how the downfall of the Saturn was at it's very beginning and we will also go over it's different processes like the dual SH2s, SCU and VDP and find out why it became so complex. You may ask why go over such an old console because its gives import lessons on what not to do when designing hardware. But I just find the hardware so interesting with it's different coprocessors So if you are interested in the Saturn or want to learn about the Saturns shortcomings and not what to do this is a presentation for you Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/E7R73F/

Since the start of the war, our community has risen to help Ukraine in many different ways. This talk explains what happens when your friends find themselves in a war and ask for help. Luckily, even though it can be overwhelming, everyone can do something. This talk shows you how. The IT community in Kharkiv is doing their best to help their city and country to counter the effects of the invasion and war. Together with the Dutch hacker community we try to help them, with practical support, such as medical goods, computers and network equipment and vehicles. The project is a true community effort, creating new contacts and relations between our communities. This connection makes it harder to watch the news, but it also offers a practical way to support Ukraine, knowing that all the energy we put in here is useful and welcomed. As the war keeps raging we started a foundation to channel all the humanitarian support: Aid to Ukraine. It even has ANBI status. Our website has all the info: https://aidtoukraine.nl Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/SSZSXB/

Since 2020, EICAS evolved from an idea without collection, location or money into a full-fledged, officially-recognized museum for modern and contemporary art in Deventer, the Netherlands. In this technically-oriented talk, I will take you on a whirlwind tour of the open source tools and custom hacks with which we've grown into the 100+-person all-volunteer organization we are today, on a shoe-string budget. Expect: NixOS, nginx for email, Nextcloud, the Semantic Web strikes back, Roundcube, systemd, DoS mayhem, Fat Thin Clients, Wikipedia edit wars, and much more. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/S9HGKU/

Developing applications on Embedded Linux and Microcontrollers is a slow process. The various different languages and libraries can make it difficult to oversee the bigger picture. In addition, the development flow wildly diverges between platforms, making entering a new project or RTOS a big undertaking. Now, you can create Embedded Linux and Microcontroller applications using Swift - a fast, modern, cross-platform ecosystem with thread- and memory safety. In this talk, you'll learn how Swift can help you develop maintainable cross-platform software that runs anywhere - Embedded, Web, Linux, Windows and more. You'll learn about Swift's bidirectional interoperability with C and C++, making integrating it in your Cmake project a breeze. Finally, we'll have a look at the frameworks and tools that allow you to get your first robotics or IoT application running in minutes. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/CVDBWH/

This talk is a "no clip" deep dive through a genre of music. We'll start in 1990 and discover the genre as it was discovered by its creators. While traveling through time we'll try to answer the question: what is hardcore? There will clips and mixes of revolutions and sub-genres. We'll learn how it's made and how to win the loudness war. Hardcore spawned a youth culture with lasting international adoption. From art to cheese, we'll cover it all. We'll learn the dance and end with a live set. This talk has it all: licensing, content, audience and noise problems in just one comfortable session. During the talk we'll listen to the evolution of this genre using samples, short mixes and video clips. We'll touch upon the politics of resistance and adoption, politicization of nice people and the death and renaissance of the genre. There is a lot to talk about and to listen to. The "one hour" version of the talk was a hit at Hacker Hotel 2025, and immediately had a two hour sequel in the off-the-record room. While going down this rabbit hole, and to expand on the "one hour" version, we'll take some more time to dive into audio engineering and how to win the loudness war. It will ruin some things some for some people, while opening doors for others. The central question throughout the session will be: "what is hardcore?". This talk mostly focusing on fun and interesting stuff, but due to the inherent nature of hardcore music there might (=guarantee) be references to sex, drugs, violence, profanity, recklessness and spooky scary skeletons in the first ten seconds. This talk is not for all ages and minds. The plan is to have about one to two hours diving into this rabbit hole. After that we'll try to teach you the dance called "hakkuh" and end off with a super varied one hour live set (if time and noise curfew allows) touching multiple genres with different types of hardcore at its center. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/MEGUP3/

What aircraft have been in Moscow and New York within 24 hours of each other? How many helicopters normally patrol this border? At Bellingcat, a Dutch investigative non-profit, we publish open-source journalism using open-source software tools. In this presentation, I'll talk about a new tool I've been building for querying airplane data, and the broader journalistic context of this data, which has become increasingly important for tracking oligarchs, deportations and conflict. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/UCJXUK/

"De ‘O’ in OT – Operationeel, Onmisbaar, Onbeschermd?" Operational Technology (OT) is de ruggengraat van industrie en kritieke infrastructuur, maar blijft vaak onbeschermd. Traditionele IT-security werkt niet in OT, waar continuïteit essentieel is en stilstand geen optie. Hoe beschermen we OT zonder operaties te verstoren? In deze sessie bespreken we dreigingen, regelgeving (NIS2, CRA) en strategieën om OT echt veilig te maken. OT is onmisbaar – laten we zorgen dat het beschermd blijft. Operational Technology (OT) vormt de ruggengraat van onze industrie en kritieke infrastructuur. Het houdt productieprocessen draaiende, faciliteert energievoorziening en zorgt voor de stabiliteit van vitale systemen. Maar terwijl de digitalisering OT steeds meer verbindt met IT en IoT, blijven de fundamentele beveiligingsuitdagingen onderbelicht. De systemen die onmisbaar zijn, blijken vaak ook het meest kwetsbaar. In deze sessie duiken we in de kern van OT-security anno 2025. Waarom werken traditionele IT-beveiligingsstrategieën niet in OT? Hoe kunnen organisaties de continuïteit van hun operationele processen waarborgen zonder hun productie stil te leggen? En hoe zorgen we ervoor dat compliance zoals NIS2 en de Cyber Resilience Act niet slechts een checklist is, maar een echte kans om OT te beschermen? Aan de hand van praktijkvoorbeelden, dreigingsanalyses en best practices laten we zien waarom OT-beveiliging een andere benadering vereist. We bespreken: De unieke kwetsbaarheden van OT en waarom traditionele security-aanpakken tekortschieten De grootste OT-dreigingen van vandaag: ransomware, supply chain attacks en insider threats De balans tussen operationele continuïteit en cybersecurity – want stilstand is geen optie Hoe organisaties OT-security kunnen integreren zonder disruptie OT-security is geen luxe, het is een noodzaak. De ‘O’ in OT staat niet alleen voor Operationeel, maar ook voor Onmisbaar – en als we niet opletten, Onbeschermd. Benieuwd naar de realiteit achter OT-beveiliging? Kom en ontdek hoe we OT écht veilig kunnen maken. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/FE8RQB/

CubeSats are small satellites comprised of 10x10x10cm "units" and range in size from very small 1U or smaller PocketQubes to 24U beasts. What can be achieved with such a satellite platform and why? I will go in to a brief history with examples from customers and amateur radio CubeSats. During my 20 years working with CubeSats, starting with designing parts of the Delfi-C3 student satellite in 2005, I have seen many missions and I have been involved in the design of quite a few CubeSats. Often, people ask me "what can you do with such a small satellite" and that prompted me to create this talk! Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/LZSAXB/

Cyber Saiyan community has designed and developed a special gadget for WHY2025 The badge was designed to recall the dragon spheres, and will be an updated version of RomHack Camp 2022, both in term of design and features: - single core ESP32-C3 SOC - WiFi and Bluetooth 5 - 7 RGB leds in the front - TFT display - an updated firmware During the talk we will present the hardware design and the firmware so anyone can try to summon Shenron :) Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/3CSQRF/

8 years ago at SHA2017, the horusscenario was presented. A Theoretical attack through PV-installations to take down the european energy grid. Since that day, a lot of things have changed, both for the better and for the worse. During the session, we will look back into the horusscenario with today's knowledge and revisit if the attack is still feasible. (Spoiler: I was right... and it has mainly gotten worse since then...) During the session we will look back on what was said in 2017 and what we know now to be true and have seen in practice. We will also reflect on where we currently are and where we stood back then and if we made any real progress in that regard. Topics discussed will be: - Was the theoretical analysis correct? and are there any additional nuances there? more recent examples in practice? - We hacked SMA back then because we thought they were most secure. Have any other grid-ending vulnerabilities in PV-installations popped up since then? - Are we better off today, then we were back then? - Prophesising the future: where are we headed with this attack? Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/MBPQL9/

We have spend the last years making our own mate ice tea, called HolyMate. We want to share our experiences making a lot of ice tea on a 'small' scale (700+ litre), and explain the process. Hopefully this will inspire you to try it out for yourself, and make your own mate ice tea. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/UMXAES/

In 2017 I presented on DNA: The code of life. Since then there have been many new developments, and I've learned how to explain the matter better. I am submitting two talks this year, and this short one is 1) fun on its own and 2) helps you appreciate the other talk ('reverse engineering the whole source code of a bacterium') more DNA is the code of life. Surprisingly, it is easier to understand DNA as "biologically flavored digital data" than the other way around, "a really long molecule with digital aspects". Human DNA is 750 megabytes, organized in chromosomes and within that stored in genes and intergenic matter. There are things like calling conventions, "start of gene markers". There are #ifdefs in there. There is bloated code. There are hacks. In this talk, I give a tour of our modern understanding of DNA, which should be exciting for nearly everyone into computers. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/GGDRKY/

In a context of technological integration, OT is getting more and more a green field for attackers and illegal activities. This phenomena is the natural result of the absence of mutual understanding and collaboration between IT and OT sectors that looking one each other as a totally unrelated entities. In this talk we'll explore some OT technologies trying to understand and highlight some of the most relevant aspects of the OT security and we'll have a look to a couple of real incidents in this The talk is intended to be a resource for whom don't known anything about OT security and want to start to address this topic. It's the result of 5 year of experience in this filed and will include an overview of OT security challenges under technical and management prospective. The aim is to highlight some of the most relevant aspect to consider in this context showing a realistic demo and real example of what we could consider OT incidents. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/ZJSYET/

Open source has revolutioned so many parts of our lives, why hasn't the same happened in healthcare?This talk will showcase examples from both hardware and software (e-NABLE prothestics, OpenAPS, Nightscout, and more), explore the regulatory hurdles that are holding these and other projects back, then shift to looking at the future and charting a path for these projects. Join us to build a more transparent, accessible, and secure future for medical technology. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/9W9YJS/

Have you ever thought that Mathematics is a boring science about multiplying matrices, calculating integrals and approximating functions? Well, you've been wrong. Mathematics is much bigger than that and in this talk we are going to look at one of the foundational object in Topology - a manifold. And, most importantly, we won't need any formulas or calculations to introduce it. (No prior knowledge of any level is required) As a PhD in Geometry and Topology, working in Software Engineering, I rarely have an opportunity to use Mathematics in day-to-day tasks. You don't really need Abstract Algebra to write a YAML-file. Yet, I think there is a number of mathematical concepts, which do not require an in-depth knowledge and complex abstractions, but can enrich our language and the way how we think about problems, how we collaborate, and how we structure the work around complex tasks. Unfortunately, it often happens that mathematical abstraction get hidden behind the tons of Calculus, which you are expected to master before you are allowed to dive deeper. It doesn't have to be this way and I will prove it :) So let's talk about the topology the fun way. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/B9KU3X/

What is up with the beings with the visors going 'beep boop, this one is not a person'? Unit Δ-44203 explains how it built an electronic face, why it did so and what consequences it experienced in a world where everyone is supposed to show an identifiable face all the time. Warning: this talk may be cognitohazardous and end up causing shifts in self-identity. — Can I see your face? — You are looking at it. What is up with the beings with the visors going 'beep boop, this one is not a person'? Why identify as a robot in a time where computers pretend to be human? How does one turn a respirator and an LED matrix panel into a face? Unit Δ-44203 is a robot programmed to be helpful and will be happy to explain [how and why it built a visor](https://query.44203.online/topic/visor/). This talk covers technical aspects: respirator choice, tinting with foil or dye, electronics and programming. It will also discuss social aspects: robot identity and interactions with others. Humans are fascinating creatures and say the weirdest things to it! Warning: this talk may be cognitohazardous and end up causing shifts in self-identity. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/BSD3DT/

The SOHO Smashup is a famous category in the IoT focused edition of Pwn2Own. Contestants are challenged to exploit a router from the WAN side and then use that device to exploit a second device on the internal LAN. Last year, we took them up on this challenge and successfully demonstrated a 0day exploit chain against a QNAP router and pivoting to a TrueNAS system. In this presentation, we'll describe how we performed our research and the vulnerabilities we found. The Dutch NCSC issued a warning last year that they see an increase of threat actors that shift their attention from endpoints to edge devices, including routers. This demonstrates the relevance of the SOHO Smashup category in Pwn2Own. Vulnerabilities in routers that could be exploited from the WAN side pose a real security risk for companies; as these devices are often badly monitored and not kept up to date. Threat actors who are able to compromise a router are in a key position to further advance into the internal network of a company. In this talk we'll describe the vulnerabilities and exploits. Specifically, we'll describe our research method on the QNAP router. We tried to increase our attack surface step by step, until we found a reliable exploitation path. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/LHC7QV/

Old technology is amazing! Have a look at an old electromechanical Pinball Machine, and try to understand how this works, without any (digital) electronics. Find out these machines have much in common with modern computers. Step by step it becomes clear how an old (1973) Pinball machine is "programmed". A 1973 electromechanical Pinball Machine is an amazing machine. But how does this work without any (digital) electronics? By comparing this to a standard computer, the (mechanical) components are explained. An electromechanical Pinball Machine has many elements from a modern computer. It has I/O, memory, can do (simple) calculations, is programmed for logic operations, and is configurable, But does this make it an early computer or not? Come, listen, and decide for yourself! When the weather conditions are good, the 1973 Pinball Machine will be operational in the Villlage:Back to the 80s Party. Hopefully you can come and play a game on this beautiful Bally Monte Carlo edition of 1973 yourself or with your friends! (Up to 4 concurrent players) Can you set the High Score of the day? Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/WMXPYU/

Let's talk to people about negotiating consent before engaging in personal and physical interactions. Your browser does it with every web server, so why shouldn't you do the same with people? This sounds harder than it actually is. Using the HTTP protocol as a guide this I will talk you through how you could negotiate consent to engage with someone on a variety of levels: From 'GET Hug' all the way to 200 OK, but also how to deal with a 404 Consent not found response. Consent is hot. Consent is good. Consent should be explicitly communicated. This sounds harder than it actually is. In this talk I will present on how to conduct consent negotiations for various levels of interpersonal contact. As illustration I will use the HTTP protocol guide the you through the consent negotiations for an encounter. Don't worry if you're unfamiliar with the HTTP protocol, I'll be sure that it all will be easy to understand including for those that don't dabble in raw HTTP traffic on a daily basis. After the initial SYN-ACK from the TCP handshake we will get on with the initial HTTP Verbs such as GET and OPTIONS to initiate a consent negotiation and going through various permutations and outcomes. It will include simple Happy Flows, but also more complicated redirects, errors and how to gracefully deal with an unhappy flow if the response returned is not a 200 OK with a body that you hoped for. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/F9QSW7/

Let's learn about L2 isolation with VLANs and dive into basic network architecture with OPNsense. After playing a bit with IPv4, let's discuss unicorn-issues IPv6 for your homelab-ing. Then expanding with WireGuard for simple inter-machine networks. Finally, we will take a look into a fail of my own via "security"(-by-obscurity) and a few words of how to defend against it. This talk will discuss the security considerations one should make for their own network at home. The first step, to achieve network segmentation, is the use of VLANs - but how do they work? Then advancing into isolated networks using OPNsene and how to configure routing between them (in a more or less scalable way, purely based on experience). After breaking up (with) your networks, we will take a look into IPv6 troubles you'll likely encounter when you begin applying more strict rulesets onto your network and start leaving NAT-ting behind you. This will also include a quick summary of the most important IPv6-terms you'll need. Instead of exposing your services publicly, one can also establish site-to-site (S2S) links with well-known parties, so we will take a quick look into getting WireGuard up and running - once again with some pitfalls you may encounter. In the end, we will take a brief detour into how one could exploit one of my own mistakes (DNS-based routing without application of source-ip filtering). Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/XZRAHF/

If you want to try something new, unusual, and technically creative, try high-altitude ballooning! In this short presentation, I'll share my experiences from a series of three high-altitude balloon projects. These projects included launching sensor payloads to altitudes about 25km and live HD video transmission from the stratosphere. You will learn how to prepare your payload, how to track its position and telemetry data using solutions, and even how to rescue a landed payload from a tall tree! Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/RC9LR7/

Are you a smartphone user worried about spyware, advanced actors, backdoors, zero-days or side-channel attacks? These routinely bypass end-to-end encryption through keyloggers, screen capture and compromised keys. Smartphones are part of complex ecosystems with dozens of hardware and software components and remain vulnerable despite vendor and political efforts. We introduce a simple, offline, airgapped device to counter such threats. Checkout www.qryptr.com and github.com/gappuser/qryptr Show-and-tell of qryptr, the completely open-source secure messaging device. Checkout https://github.com/gappuser/qryptr and https://qryptr.com Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/YEN87P/

This talk will take you into a journey leading to the retrofit of a robotic tape library to enable it to accomodate hard drives in addition to the original media, from the reasons we did it to all the obstacles that needed to be overcome and how we did all that, pushing a little further the physical limits that make data storage increasingly problematic in a world where over 200TB is generated every second and must sometimes be retained for years (and possibly more). Every year, humanity generates at least 250 Exabytes of data, so storage becomes increasingly problematic because this accumulates and at least part of it must be stored and made accessible for extended periods ; however, not all of that data is being accessed simultaneously. Moreover, the Internet is not well suited for the transfer of large datasets and quite often it is preferable to move physical media. In this talk we will dive into some physical limits related to this particular problem, and how we have pushed them a little further by retrofitting a large tape library so that it can accommodate hard drives in addition to magnetic tapes. This task involved reverse-engineering the drive train, designing new electronics to replace the proprietary and monolithic hardware by something more manageable, coming up with a plan to build a docking station that can be handled by the robot and withstand millions of insertion cycles and that is also end-user-friendly while keeping it as affordable as possible. We will dive into the limitations of the various tools at our disposal and how we worked around them to achieve our goal, while drawing a picture of all the skills and technologies involved and how this can be useful for you. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/7X9NJP/

Welcome at WHY2025! A warm welcome by Nancy and Boekenwuurm, to wish you the best WHY2025 and give a quick intro! Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/BAU8GH/