Chaos Computer Club - archive feed

Pseudo-random number generators (PRNGs) are critical pieces of security infrastructure. Yet, PRNGs are surprisingly difficult to design, implement, and debug. The PRNG vulnerability that we recently found in GnuPG/Libgcrypt (CVE-2016-6313) survived 18 years of service and several expert audits. In this presentation, we not only describe the details of the flaw but, based on our research, explain w...

In August 2016, Apple issued updates to iOS and macOS that patched three zero-day vulnerabilities that were being exploited in the wild to remotely install persistent malcode on a target’s device if they tapped on a specially crafted link. We linked the vulnerabilities and malcode to US-owned, Israel-based NSO Group, a government-exclusive surveillance vendor described by one of its founders as “a...

Today virtually everything we do is monitored in some way. The collection, analysis and utilization of digital information about our clicks, swipes, likes, purchases, movements, behaviors and interests have become part of everyday life. While individuals become increasingly transparent, companies take control of the recorded data. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahr...

Wenn mal wieder der Zensor pinkeln war, wenn DAMIT ja wohl NIEMAND rechnen konnte, wenn es um demokratisch legitimiertes Baumanagement oder um Stahlbälle geht, dann ist es wieder an der Zeit für eine lockere Abendshow mit den High- und Lowlights des Jahres. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/7960.html

Der Vortrag gibt einen Abriss über die Geschichte der Parlamentsschlägerei, ordnet diese politisch und geografisch ein - um dann die verschiedenen Typen und Formen anhand von Videomaterial zu zeigen und gemeinsam zu analysieren. Die beiden Vortragenden betreiben seit 2010 gemeinsam das weltweit einzige Fachblog für Parlamentsschlägereien. about this event: https://fahrplan.events.ccc.de/congress/2...

Der Genusscast LIVE auf dem @33c3 - maha und heckpiet. Probieren $dinge auf der Bühne und lassen das Publikum teilhaben about this event: https://c3voc.de

The show where Holger Klein and Toby Baier talk about their realities (and sometimes sell stuff they bought but don't need). about this event: https://c3voc.de

Die erste Folge "Horst - die Podcast" live vom 33C3. Meine Gäste sind: Michaela Lehr, Philip Jocks und Reinhold Remscheid. about this event: https://c3voc.de

Eine Kandidat:in aus dem Publikum kämpft live um ihr überleben. Dazu muss Sie knifflige Rätsel lösen. Motto: Sterben oder eine coole Sau sein! about this event: https://c3voc.de

Binärgewitter ist ein Live Podcast der sich Schwerpunktmäßig mit Linux, Open Source, IT Sicherheit und dem Web beschäftigt. about this event: https://c3voc.de

Joan Heemskerk and Dirk Paesmans, collectively known as JODI, are rightfully venerated for their countless contributions to art and technology, working as an artistic duo since the mid-90’s. about this event: https://c3voc.de

Wir werden einen Überblick über die Themen geben, die den Chaos Computer Club 2016 beschäftigt haben. Neben der Zusammenfassung und der Rückschau auf das vergangene Jahr wollen wir einen Blick in die Zukunft wagen. about this event: https://c3voc.de

Wir blicken auf die Ereignisse rund um den Geheimdienst-Untersuchungsausschuss im Jahr 2016 zurück und veranstalten ein Quiz für die HörerInnen. about this event: https://c3voc.de

The talk is about the paging system, an old technology in the 90's, used in healthcare, ICS and government, a systematic review of security impacts that it brought to us in the age of SDR, covering the United States, Canada, England and Japan. By sniffing known pager frequencies in the general vicinity of hospitals, factories and public facilities with a $20 DVB-T, we discovered that not only is p...

This talk will explore the hard- and software of the Amazon Dash button. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8398.html

How to stop the ATMs fraud? How to protect ATMs from attacks such as black box jackpotting? How to prevent network hijacking such as rogue processing center or MiTM? Some of these issues can be fixed by configuration means, some fixed by compensation measures, but many only by vendor. We will tell you about what bank can do now and what we as a community of security specialists should force to ven...

Seit einigen Jahren formieren sich am rechten Rand der Gesellschaft explosionsartig neue rassistische, völkisch-nationalistische und offen nazistische Strömungen, Gruppen und Parteien. Einen erschreckenden Verstärker findet das neue braune Getöse in den sozialen Medien und sein Resonanzraum reicht inzwischen bis weit in die Mitte der Gesellschaft. Teil des Problems sind institutioneller Rassismus...

Seit Mitte 2014 hat David fast 100.000 Artikel von Spiegel-Online systematisch gespeichert. Diese Datenmasse wird er in einem bunten Vortrag vorstellen und erforschen. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/7912.html

To break into a building, several methods have already been discussed, such as trying to find the code paths of a digicode, clone RFID cards, use some social engineering attacks, or the use of archaic methods like lockpicking a door lock or breaking a window. New methods are now possible with recent intercoms. Indeed, these intercoms are used to call the tenants to access the building. But little...

Since too long we use VHDL and Verilog to describe hardware. SpinalHDL is an alternative language which does its best to prove that it is time to do a paradigm shift in hardware description. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/7873.html

This talk is about the iOS secure boot chain and how it changed throughout different iOS versions, while focusing on downgrading despite countermesures. It will explain basics like what SHSH blobs and APTickets are and how IMG3 and IMG4 file format works. Also a new technique called "prometheus" will be introduced which allows for the first time downgrading 64bit devices. about this event: https:/...

When thinking about surveillance, everyone worries about government agencies like the NSA and big corporations like Google and Facebook. But actually there are hundreds of companies that have also discovered data collection as a revenue source. We decided to do an experiment: Using simple social engineering techniques, we tried to get the most personal you may have in your procession. about this e...

Many web sites allow users to log in with their Facebook or Google account. This so-called Web single sign-on (SSO) often uses the standard protocols OAuth and OpenID Connect. How secure are these protocols? What can go wrong? OAuth and OpenID Connect do not protect your privacy at all, i.e., your identity provider (e.g., Facebook or Google) can always track, where you log in. Mozilla tried to cre...

We didn’t win the second crypto wars. Governments merely made a strategic retreat and they’ll be back. Although they will likely give up on trying to regulate or prohibit encryption, we should expect that malware and law enforcement hacking will play a starring role in the next battle in the crypto wars. about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8136.html

Instant money transfer, globally without borders and 24/7. That’s one of the promises of Bitcoin. But how does national and international money transfer work in the world of banks? about this event: https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/8315.html