Chaos Computer Club - archive feed

Club of Nerds ist ein Podcast, der sich mit Wissenschaft, Technik und persönlicher Entwicklung auseinandersetzt und dabei eine Vielzahl von Themen anschneidet. Das Team beschäftigt sich viel und gerne mit Themen wie Erneuerbare Energien, Minecraft und anderen. Wir reden einfach über was uns durch den Kopf geht.

Club of Nerds erscheint aktuell noch unregelmäßig, soll mit der Zeit aber regelmäßig alle 4 Wochen neu erscheinen, es sei denn, er tut es nicht. Alle Sendungen werden ins Netz gestellt und sind später herunterladbar und als Podcast abonnierbar. Wer sich die Sendung regelmäßig anhören möchte, sollte sich einen unserer Feeds schnappen und seinem Podcast-Client der Wahl anvertrauen.

In dieser Episode wollen wir das Jahr 2021 Revue passieren lassen und unsere Erlebnisse und über unsere Erfahrungen auf dem virtuellen Kongress sprechen.

about this event: https://pretalx.c3voc.de/rc3-2021-sendezentrum/talk/D9UV3B/

Tor users rely on the Tor network to forward their traffic to it's destination and to achieve the

desired privacy and anti-censorship properties. The Tor network is open and everyone can add Tor relays, which will be distributed for use by Tor clients. This does not attract altruistic volunteers only.

While the Tor network has significantly grown over the past few years, the fraction of somewhat know operators has not increased to the same degree and today's Tor network is significantly different when compared with the Tor network 5 years ago.

The bandwidth over time graph shows how much capacity has been added in recent years: https://metrics.torproject.org/bandwidth.html?start=2015-06-01&end=2021-08-01

In this talk we will describe why some level of trust in the Tor network is needed

to achieve its privacy properties. After going through some examples of large scale malicious Tor relay groups, and current issues with tackling them, we describe a new additional approach to reduce the risks of malicious Tor relays on Tor users. We aim to empower Tor users for self-defense without completely depending on the detection and removal of malicious Tor relays from the network.

about this event: https://pretalx.c3voc.de/rc3-2021-chaosstudiohamburg/talk/EMGC7P/

Post-quantum crypto is being rolled out to secure **you** from quantum computers! Unfortunately, few people know how post-quantum works. Let's change that!

In this zero-to-hero talk we'll dive into the inner workings of Kyber, a prominent member of the post-quantum family.

Post-Quantum Crypto is the art of inventing asymmetric cryptography that can withstand large quantum computers. This relatively young subject becomes more and more relevant as [Shor’s algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm) would break all of today’s asymmetric cryptography once a large enough quantum computer can be build.

Therefore RSA, Elliptic Curve Crypto, Diffie-Hellman, DSA and friends could soon be obsolete.

Kyber (formerly known as New Hope) is among the first post-quantum schemes to be standardized and already found its way into products. As a lattice-based system, Kyber is fast and its security guarantees are linked to an NP-hard problem. Also, it has all the nice mathematical ingredients to confuse the hell out of you: vectors of odd-looking polynomials, algebraic rings, error terms and a security reduction to “module lattices”.

This talk will introduce you to the world of post-quantum cryptography by giving a hands-on tutorial on how its most prominent member - Kyber - works. We'll start with high school level mathematics and work our way up to constructing Kyber. By constructing such a toy-sized Kyber, we can learn how the system works, comprehend its design decisions and see how it is related to an NP-hard problem.

After that we’ll take a brief look into how PQC will change real world cryptography in the near future.

about this event: https://pretalx.c3voc.de/rc3-2021-cwtv/talk/UGZY8B/

Sony, SanDisk, and Lexar provide encryption software for their USB keys, hard drives, and other storage products. The software is already present when buying a new product and used to keep data on the storage safe. This solution is developed by a 3rd party called ENCSecurity. The security claims of this solution were very strong *i.e.* "Ultimate encryption using 1024 bit AES keys Military grade". Our analysis of the DataVault software revealed three serious flaws impacting the security of the DataVault solution. This presentation is a look the flaws we identified along with our process for discovery and how the vulnerabilities were addressed.

The DataVault solution is a stand-alone application used by default as an encryption solution for many Sony, SanDisk, and Lexar products and as well used by some libraries to offer data security. This solution was not analyzed before, and the strong security claims were not assessed to match the reality. This presentation gives background details of the analysis and the context which brought us to perform the analysis. The method for reverse engineering and inspecting the DataVault solution will be presented. It turned out that the key derivation function was PBKDF2 using 1000 iteration of MD5 to derive the encryption key. The salt used to derive the keys is constant and hardcoded in all the solutions and all the vendors. This makes it easier for an attacker to guess the user password of a vault using time/memory tradeoff attack techniques such as rainbow tables and to re-use the tables to retrieve passwords for all users using the software. The implementation itself was incorrect and even with a randomly generated unique salt, it would be effortless to recover the password of a user. Other flaws of the key derivation function will be discussed and compared with nowadays good practices.

The data encryption method was also found to be malleable, allowing malicious modifications of files in a vault without any detection. No data integrity mechanism was set up. The settings of the full version of the software allows choosing between 4 different levels of security, namely AES-128, 256, 512 and 1024 bits. The encryption method has been reversed and is a CTR like construction based on AES-128 using a single key. Multiple iterations of encryptions are chained with the keys obtained by the key derivation function used as IVs. However, it turned out after the analysis that all these modes offer only a security level of 128-bit.

A plugin in John the ripper software to allow everyone to "practically brute force military grade AES-1024" will be released at the time of the presentation.

We have a continuous, welcomed, and constructive collaboration with the ENCSecurity company. During this presentation, we will explain the coordinated disclosure process, which was difficult since it impacted several vendors and some deployed libraries. The solution which was provided for the correction will be presented and compared to the best practice standards along with a discussion of the process of selecting the specific improvements.

about this event: https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/

Der öffentliche Personennahverkehr muss zuverlässiger und einfacher werden. Und keine Frage, "Die Tarifsysteme sind ein Folterwerkzeug des frühen 20. Jahrhunderts" ([kritisiert Mobilitätsforscher Andreas Knie](https://www.spiegel.de/auto/aktuell/deutschland-in-diesen-staedten-ist-der-nahverkehr-am-guenstigsten-a-1298823.html)). In mehreren Verkehrsverbünden werden daher sog. Check-in / Be-out (CiBo)-Systeme getestet: Apps, die automatisches Bezahlen per Handy ermöglichen und rückwirkend nach einer oder mehreren Fahrten die optimale Fahrkarte auswählen können.

Doch wie funktionieren solche Systeme eigentlich? Aufgrund einer Schwachstelle konnte ich mich im Backend eines CiBo-Systems umsehen. Die Einblicke werde ich in diesem Vortrag in Form eines Bildschirmvideos teilen.

about this event: https://pretalx.c3voc.de/rc3-2021-chaosstudiohamburg/talk/NKKVAU/

Update aus der Tonwerkstatt: siehe [Closer Encounters – Finale](https://pretalx.c3voc.de/rc3-2021-chaosstudiohamburg/talk/ZHYBUP/)

Auch wenn eins als Chorsänger*in im Moment Staatsfeind*in Nr. 1 ist, trauen wir uns wieder an die Noten. Diesmal haben wir eine geheimnisvolle musikalische Botschaft auf dem Boden der Fairy Dust entdeckt.

Die Entschlüsselung läuft noch – an Tag 3 16:00 machen wir eine Chorprobe und nehmen das Ergebnis auf; daraus produziert Thies Mynther einen Community Track, den wir hier vorstellen werden.

Die Live Sessions werden über Jamulus stattfinden, wir werden auch auch einen Uploadlink zur Verfügung stellen für alle, die zu den Sessions nicht können, zu scheu sind oder die Plattform irgendwie zu heikel finden.

Stay tuned, #CCChoir!

Der CCCHOIR und das ORCCCHESTRA sind frei flottierende kollektive Entitäten, die sich vor und während der Congresse treffen und sammeln, um gemeinsam neue Musik und Tracks zu entwickeln und zu singen.

about this event: https://pretalx.c3voc.de/rc3-2021-chaosstudiohamburg/talk/QKJLY8/

about this event: https://c3news.show

Technology has become ubiquitous, and the negative societal effects are showing. One way to address this and to create sustainable futures is by learning from interdisciplinary techniques of responsible innovation by critical makers and other grassroots innovation communities. This is what Critical Making is about.

Through supporting grassroots innovators and accompanying research, with the EU Horizon 2020 supported "Critical Making" project, we add scientific insights into the potential of the maker movement. We focus on critical and socially responsible making, and show how a new understanding of global maker communities can offer opportunities to contribute to an open and sustainable society.

At 35C3, Regina Sipos and Saad Chinoy introduced and explored the critical making movement as a broad, global yet hyper-locally relevant phenomenon. Now, we want to follow up with showing some first results of the new research project and to invite you to join the activities.

about this event: https://pretalx.c3voc.de/rc3-2021-xhain/talk/KUPRLK/

Ein Überblick über deutschsprachige Fiction-Podcasts mit einem starken Fokus auf der Indie-Szene: Was für Formate gibt es? Was ist auf der Low-Budget Ebene machbar? Welche Formate fehlen meiner Meinung nach?

Tipps zum Starten eines eigenen Fiction-Podcasts am Beispiel meines Podcasts "Afaldra": Wie plant man einen solchen Podcast? Wie kann man Zeit sparen? Welche Probleme können auftreten? Wie geht man kreativ mit Formaten um?

about this event: https://pretalx.c3voc.de/rc3-2021-sendezentrum/talk/CNV3YM/

Seit 2003 gibt es die Berliner Online-Community "Restrealitaet". So vielfältig die User*innen des Forums sind, so speziell ist auch die zugrundeliegende Software. Nichts von der Stange, sondern liebevoll von Hand entworfen und entwickelt, über die Jahre immer wieder verbessert, verändert und neu erfunden ist sie das technische Rückgrat dieses Gesamtkunstwerkes. Der Vortrag möchte, gespickt mit Anekdoten, die Entwicklung der Restrealitaet aus technischer Sicht darstellen.

(senpf und rufus hatten diesen Vortrag schon letztes Jahr beim rC3 gehalten. Aber im Stream gab es zeitweise Tonprobleme und die Aufzeichnung funktionierte nicht. Deswegen halten sie ihn noch mal.)

about this event: https://pretalx.c3voc.de/rc3-2021-cbase/talk/PYMTCH/