We present EntrySign, a cryptographic flaw in AMD’s microcode patch verification logic, including how we discovered the bug and how you can extend our results. EntrySign lets us execute arbitrary microcode on all AMD CPUs from Zen to Zen 5 and modify the behavior of x86 instructions. We will delve into the format of AMD microcode, how their patches are verified, how we were able to reverse engineer this process, and how we were able to access the key information required to defeat it.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/9WTQU3/

*WHY* did I donate a kidney?

*H*ow did I donate a kidney?

*Y*ou might want to donate a kidney!

Donating a kidney is quite a thing. But it also isn't. But mostly, it is. I will talk about all the aspects (personal, technical, logistical, ethical) of the process. Lots of related but entirely different things. How does it affect me? How long did it take? What does everything look like? What do the numbers mean? What does it feel like? Can you do the same? Should you do the same? Who shouldn't do it? WHY?

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/WJQNXZ/

This is a first introduction to quantum computers.

This is a first introduction to quantum computers: no prior background needed. We will discuss how quantum mechanics, a theory of microscopic particles, contains counter-intuitive effects like superposition and entanglement. Schrödinger’s cat is an iconic example, where the poor animal is both dead and alive at the same. Interestingly, the same laws of nature make it possible to build an extended set of algorithms, with speedups beyond what we can achieve ‘classically’.

I’ll show how we can program today’s quantum computers and show a short live demonstration of the Python package Qiskit. We will learn how to write code that creates something equivalent to Schrödinger’s cat.

Then, we will look at one of the most impactful applications. Quantum computers turn out to be incredible hacking machines, making it straightforward to crack widely-used encryption schemes such as RSA and Elliptic Curve Cryptography. We will discuss how long it will take until we have sufficiently large devices, and what alternative cryptography we can fall back to.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/CDGWTU/

The WHY2025 Capture the Flag competition (CTF) has multiple lockpicking challenges as part of the CTF. Successfully picking these locks gives you one of the flags. To be able to create a solid CTF challenge out of an ordinary lock we had to come up with some kind of solution. We used our past experiences in CTFs as inspiration to see how we could do it better. This talk shows the concepts we came up with and which are currently used in the WHY2025 CTF.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/8VGLJQ/

Zero Trust (ZT) is a security paradigm gaining traction and popularity.

In the talk I will show how ZT is the progression of many security ideas that you may already be familiar with, and how you can rebrand and review what you are already doing to show that you are making progress.

Zero Trust (ZT) is a security paradigm gaining traction, especially in the US defense community. The underlying idea is to reduce implicit trust as much as possible. This makes great sense from a security perspective.

Its implementation is daunting though, because it is not about dropping a new product in the security landscape. Instead, it is more an approach and a process. It is still hard to prioritize ZT and to retrofit it to existing system architectures.

In the talk I will show how ZT is the progression of many security ideas that you may already be familiar with, and how you can rebrand and review what you are already doing to show that you are making progress.

Outline:

As a contributor to the Cloud Security Alliances Zero Trust cert (CCZT), and experienced instructor, I intend to borrow from the (public) body of knowledge and my experiences in teaching that.

This will give the audience a good insight in Zero Trust content and trends.

This will include

- the core idea (never trust, always verify)

- the major use cases

- business value of ZT

- steps in implementing

- publicly available maturity models

- example implementations and status thereof (e.g. US Airforce)

- link to earlier principles

- retrofitting ZT on an existing application

- experiences

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/BVSMJZ/

Smart devices are deeply embedded in the physical world: they can see, hear, and control things around us, often with zero real limits. When they’re hacked, it’s not just your data on the line; it’s your safety, privacy, and environment. In this talk, I’ll share some new ideas for putting a layer of access control between these devices and the real world, so we stop giving them a blank check.

These days, “smart” devices aren’t just watching and listening: they can act on the physical world, often with zero meaningful limits. They unlock doors, adjust thermostats, steer vacuums, and record what’s going on around us 24/7. When these devices get compromised, and many do, it’s not just boring data on the line. It’s your safety, privacy, and physical space.

The problem? We’ve handed out root access to the physical world like candy. Any device can sense or actuate whenever it wants. There's no layered control, no boundaries between software and the real world. If malware gets in, it gets full access to your home, office, or anything else the device is wired into.

In this talk, I’ll show how we can fix that by treating _sensing and actuation as privileges_,not defaults. Instead of giving every device free rein over what it can hear or control, we can build mechanisms that require software to explicitly request, and be granted, access to the physical world. That access can be temporary, conditional, or denied altogether.

We'll look at how to physically separate sensors and actuators from the software stack so that even if a device is compromised, it can’t automatically reach into your environment. We'll also explore approaches that enforce forgetfulness: ensuring that standby devices like smart speakers can’t quietly hoard data or leak it when compromised. If nothing relevant to the device's task happened, nothing should be remembered.

The goal is simple: to take back control from black-box devices and start designing systems where physical-world access isn’t assumed, it’s earned.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/AUF93C/

Prins S. en De Geit is one of the most exciting acts in the Dutch music scene today. This trio from The Hague — fronted by Scott Beekhuizen, with Marne Miesen on bass and Daniel Ortgiess producing — creates infectious electro-punk-pop with sharp lyrics and unrestrained energy.

Their bold sound and theatrical performances have electrified festivals like Lowlands, Rock Werchter, Pinkpop, and Appelpop. Their WHY2025 show promises to be equally wild and unpredictable.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/S8WQTC/

So, it is 2025 and mailservers are getting more and more replaced by cloud-based solutions, which promise to be easy and secure... But what if you can just do it yourself? Hosting your private message server and applying common modern mailserver security practices on your own? This talk wants to introduce a few common software solutions and introduce multiplie techniques from an operators toolbox.

This talk will cover typical pitfalls you encounter if you try to host your own mailserver solution: Often, those issues are only noticed by users not being able to sent emails successfully - let's go ahead and learn about those beforehand.

Starting off with the basics of secure mail transmission using (START)SSL on top of SMTP and advancing into DKIM, SPF for secured mailserver origins. Then mentioning a few nice-to-have tools for delivery monitoring like DMARC and Postmark. Then being careful with DNS configuration and RFC-restrictions quickly overlooked.

Furthermore, let's take a look into TLSA for SMTP, BIMI or complex setups with satellite delivery systems.

Finally, let's discuss user-based security with locked-down IMAP, PGP signatures and encryption or enforcing secure connections.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/HXDAMY/

Why limit yourself to Ethernet and Wi-Fi when every wire in your house can carry packets? This talk explores alternative physical networking technologies that exist but are often overlooked. From Powerline Networking (HomePlug AV/AV2) to MoCA over coaxial cables, we’ll dive into how these systems work, their encryption and security models, known exploits, and the inherent risks of non-switched cable mediums.

Beyond the theoretical, we’ll examine real-world applications, including whole-home audio and video distribution, network segmentation strategies, and the unexpected advantages of leveraging existing infrastructure. You’ll see how HDMI matrices, IP-based video distribution, and networked audio solutions like SONOS Net can integrate seamlessly over alternative backbones. We’ll cover segmentation techniques to isolate security cameras, IoT devices, and AV distribution, ensuring efficiency and security.

Expect deep technical insights, practical lessons from years of experimentation, and a fresh perspective on what’s possible when you stop thinking of cables as just power or TV lines—and start treating them as network highways. Whether you're looking to expand connectivity in a complex environment or just want to push the limits of home networking, this talk will leave you with new tools, techniques, and ideas to explore.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/DJ7NXK/

Digital money everywhere, all the time, all at once... isn't it getting a little boring? In this talk you will learn how [GNU Taler](https://taler.net/), a privacy-focused payment system, leverages the properties of digital tokens and blind signatures to enable a wide array of use cases such as discount coupons, subscriptions, and tax-deductible donation receipts; all while preserving untraceability in customer-to-merchant transactions.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

about this event: https://program.why2025.org/why2025/talk/PHGSJC/