Chaos Computer Club - archive feed

Der Talk gibt einen Überblick über die Arbeit der Gesellschaft für Freiheitsrechte (GFF): Wir klagen, um Grund- und Menschenrechte vor Gesetzgebern und Behörden zu schützen. Die letzten Jahre waren harte Zeiten für die Bürgerrechte: Im Bund regierten große Koalitionen, die reihenweise Überwachungsgesetze verabschiedeten - etwa die Staatstrojaner im Strafverfahren, das neue BKA-Gesetz oder den Zugr...

All Creatures Welcome sketches a utopian image of society in the digital era. Accompanied by the appeal to “use hacking as a mindset,” the viewers immerse themselves, together with the filmmaker, in a documentary adventure game and explore the world of digital communities at the events held by the Chaos Computer Club; a real-world reflection of the virtual spectrum. Together with the f...

Learn about the most common attacks against your network privacy - and how to avoid them. By looking at things from an attackers perspective, we can get some insight into technical details that provide us with essential knowledge about network protocols. You will learn about three of the most common attacks against computer network security. In each of these scenarios, a victim's communication can...

We have analyzed the hardware full-disk encryption implementation of several Self-Encrypting Drives (SEDs) from Samsung and Crucial (Micron) by reverse engineering their firmwares. The vendors combined cover a majority of the market share of SEDs sold today. In theory, the security guarantees offered by hardware encryption are similar to those of software implementations. In reality, we found that...

A cryptojacking website abuses the computing resources of its visitors to covertly mine for cryptocurrencies in the browser. In this talk, we explore this phenomenon and answer, amongst others, the following questions: How does the mining script work under the hood? How common is this attack? How much money do the attackers earn? And how can I defend myself against such attacks? With the introduct...

It's time to highlight facts and epic fails that were observed on the wire during attempts to block Telegram in Russia. Russian Federal Service for Supervision of Communications, IT and Mass Media started the process to ban Telegram on April the 16th. Roskomnadzor press-office claimed that the process will take a few hours. Telegram mostly worked in Russia during the incident beginning and still w...

p≡p is an end-to-end privacy-focused security architecture, which, in its first incarnation, aims to provide a seamless private, encrypted email solution for everyone. This talk focuses on some of the development challenges in supporting an ambitious product from the inside and lessons-learned that don't appear in software engineering classes. p≡p is an end-to-end privacy-focused security architec...

We are presenting an innovative technology, which allows verifying the authenticity, integrity and/or the physical state of an item by employing the propagation behaviour of electromagnetic waves. In particular, it enables to check for any tamper attempts for larger structures, such as off-the-shelf computers and their periphery. The technology extends existing tamper proof approaches from the chi...

A general overview and report on how Wikipedia uses artificial intelligence to improve its efficiency None about this event: https://cfp.verschwoerhaus.de/35c3/talk/DBVJK7

Wir wenden uns gegen Gentrifizierung, Luxussanierung und Spekulation mit Häusern. Das Mietshäuser Syndikat ist ein bundesweiter Verbund linker, selbstverwalteter Hausprojekte mit dem Ziel der Initiierung und dauerhaften Erhaltung von gemeinschaftlich genutztem und bezahlbarem Wohn- und Gewerberaum. Der Grundgedanke: Gemeineigentum wird geschaffen und dauerhaft dem Markt entzogen. Die Mieter*innen...

This is a foundations talk about modeling and simulation as tools for development, testing and debugging systems. It requires very little previous knowledge to address all makers and hobbyists interested in creating or modifying hardware that physically interacts with its environment (e.g. robots, drones, etc.). It explains the purpose of modeling and simulation, basic principles, and tips and tri...

Net neutrality, a big buzzword in the last years. It is not only a buzzword? There are economic reasons why it is a stake. This talk tries to give an overview and explain how money is made in the "internet" and how it is related to net neutrality. Topics discussed: - Early Days and the Finance behind the Internet / Darpanet - "Day 0" of the Internet as we know it today - Step By Step Explanation h...

Modern cryptography is based on security-proofs. We will demonstrate how these work, why they are desirable and what their limitations are. Even the use of secure primitives like AES or RSA does not guarantee that the end-result is secure as well. In recent years breaks of modern primitives have in fact become exceedingly rare, yet stories like the KRACK-attack or ROBOT keep appearing. The obvious...

MicroPython is a lean and efficient implementation of the Python 3 programming language that includes a small subset of the Python standard library and is optimised to run on microcontrollers and in constrained environments. This talk will give an overview about the MicroPython hard- and software and introduces the community. MicroPython is an Open Source project and developed in the open on GitHu...

Matrix is an open standard for communication over the Internet. I will talk about the matrix standard, both the technical implementation and the reasons for its creation. We will focus on the changes and progress that has been made in the previous year, particularly getting the specification out of beta, and the growth of the ecosystem. Finally, the Matrix environment continues to develop, and we’...

Reverse Engineering zum Aufspüren von Schwachstellen ist gängige Praxis. Umso überraschender kam für 2 Forschungsteams die Abmahnung durch Rechtsanwälte eines Herstellers. Sie hatten Schwachstellen aufgedeckt und damit, so der Hersteller, seine Rechte verletzt. Vorwurf? Vom Verstoß gegen das Urheberrecht bis zum Verrat von Geschäftsgeheimnissen war alles dabei. Nach hunderten Seiten an Schriftsätz...

In this talk, I discuss how to reliably find bugs in the Chrome IPC system with the goal of escaping the sandbox. I show how to enumerate the attack surface, how to identify the weak areas, and how to fuzz those areas efficiently to consistently produce bugs. Since the win32k lockdown on the Chrome renderer process, full chain Chrome exploits on Windows have become very rare, with the most recent...

Die Repaircafé-Bewegung rollt über unser Land herein. Wie können wir uns daran beteiligen und Synergien nutzen? In vielen Städte sind in den letzten Jahren Reparaturtreffs zur festen Institution geworden. Was gibt es für Schnittmengen mit der Hacker- und Makerszene? Warum solltet ihr euch beteiligen, was gibt es dabei zu beachten und zu gewinnen? about this event: https://fahrplan.events.ccc.de/co...

When you're fighting for a cause, you need tools that reflect your values. While venture capital-backed tools are seductive, especially at the beginning of your movement, they can be harmful in the long-term. This session shows how co-operatively owned, non-hierarchically built Free and Open Source Software (FOSS) provides a more sustainable, and equitable, solution. Capitalist and consumerist str...

Das Forschungsprojekt "Transformationsstadt - BürgerInnen forschen für ein Gutes Leben" (http://www.transformationsstadt.de/geoportal/) hat zum Ziel, ein GeoPortal für georeferenzierte offene Daten zu Themen des Gutes Lebens zu entwickeln. Warum noch ein GeoPortal? Und warum ein GeoPortal des Guten Lebens? Das haben wir uns auch gefragt. Die Antwort darauf erfahrt ihr in unserem Vortrag! Das GeoPo...

Ich möchte euch zeigen, wie ich mir aus einem Raspberry PI ein Smartphone baue. Auf welche Probleme und Schwierigkeiten ich dabei gestoßen bin und welche Lösungen ich gefunden habe. Das Projekt ist noch nicht abgeschlossen, es fehlen noch ein paar Kleinigkeiten. Trotzdem will ich euch schon mal mein Smartphone in der praktischen Butterbrotdose zeigen und euch erzählen wie es entstanden ist. Ich ha...

OTRv4 is the newest version of the Off-The-Record protocol. It is a protocol where the newest academic research intertwines with real-world implementations. It is also one of the first protocols that comes from the global south which makes the political discussion around protocols an urgency. This newest versions also asks us to revisit our definitions around deniability (online and offline) and h...

Video identification is the process of establishing the identity of a person via video chat. The person to be identified has to show his face as well as her official ID card to the camera. This lecture gives a step-by-step tutorial on how such video streams can be augmented with computer-generated official ID cards, including all visible watermarks. To be specific, we will use a credit-card printe...

With great pleasure comes great responsibility. A responsibility, which is not taken enough into consideration by the smart sex toy manufacturers as they should, while handling extremely sensitive data. As long as there is no serious breach, there is no problem, right? This was the basis for a research project (Master Thesis) called “Internet of Dildos, a long way to a vibrant future”, dealing wit...

I built a small demonstrator for Cross-Site-Scripting (XSS) attacks in impress.js. It would be a waste to let it stay on my computer, because I think it could help you giving a brief lecture on XSS. Much more interesting, probably, is my implementation of the whole thing: the cockpit (a header and footer that provide a visual frame, while the viewpoint navigates the 3-dimensional space of your pre...