-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathimport-merged.schedule.xml
15533 lines (15533 loc) · 977 KB
/
import-merged.schedule.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<schedule>
<version>Voltron 3.1 2.1 1.5 MemoryRefreshV1.3 1.2.4</version>
<conference>
<acronym>35c3</acronym>
<title>35th Chaos Communication Congress</title>
<start>2018-12-27</start>
<end>2018-12-30</end>
<days>4</days>
<timeslot_duration>00:10</timeslot_duration>
<base_url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/</base_url>
</conference>
<day index="1" date="2018-12-27" start="2018-12-27T11:00:00+01:00" end="2018-12-28T03:00:00+01:00">
<room name="Adams">
<event id="9985" guid="15f4e5c5-40e1-4c73-8da0-4cc2a773ab13">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9985.html</url>
<logo/>
<date>2018-12-27T11:00:00+01:00</date>
<start>11:00</start>
<duration>00:30</duration>
<room>Adams</room>
<slug>35c3-9985-opening_event</slug>
<title>Opening Event</title>
<subtitle>35C3: Refreshing Memories</subtitle>
<track>CCC</track>
<type>lecture</type>
<language>de</language>
<abstract>Hier geht es los.</abstract>
<description/>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8759">rufus</person>
<person id="5638">rixx</person>
</persons>
<links/>
<attachments/>
</event>
<event id="10021" guid="9dde571b-4d49-4b44-8329-42e354bcc24b">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/10021.html</url>
<logo/>
<date>2018-12-27T11:30:00+01:00</date>
<start>11:30</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-10021-the_precariat_a_disruptive_class_for_disruptive_times</slug>
<title>The Precariat: A Disruptive Class for Disruptive Times.</title>
<subtitle>Why and How the Precariat will define the Global Transformation to save our planet.</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>en</language>
<abstract>The combination of the ongoing technological revolution, globalisation and what are usually called 'neo-liberal' economic policies has generated a global system of rentier capitalism in which property rights have supplanted free market principles and in which a new global class structure has taken shape. The 20th century income distribution system has broken down irretrievably, and a new mass class, the precariat has been growing dramatically fast in every part of the world. What are the deeper reasons for these developments? How does an ecologically sustainable strategy look like? Is it possible to restore a balanced market economy in which inequalities and insecurities will lessen and in which the drift to populist and even neo-fascist politics will be reversed? This talk will try to provide answers.</abstract>
<description/>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8785">Guy Standing</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9917" guid="87083bf8-f1e8-433d-8b51-ffece756bbd7">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9917.html</url>
<logo/>
<date>2018-12-27T12:50:00+01:00</date>
<start>12:50</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-9917-election_cybersecurity_progress_report</slug>
<title>Election Cybersecurity Progress Report</title>
<subtitle>Will the U.S. be ready for 2020?</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>en</language>
<abstract>Recent attacks against elections in the U.S. and Europe demonstrate that nation-state attackers are becoming more aggressive, even as campaigning and voting are becoming increasingly reliant on computers. How much has changed since 2016, when the U.S. experienced unprecedented attacks on its election infrastructure? What has to happen to ensure that the 2020 presidential election is secure? In this talk, I'll give a progress report on election security in the U.S. and around the world, informed by results from my own research and my work with legislators and election officials over the past two years. I'll also hold a mock election with a current U.S. voting machine to demonstrate how cyberattacks on election infrastructure could potentially change the results of national elections. Finally, I'll explain what everyone can do to get involved and help safeguard the foundations of democracy.
</abstract>
<description>Strengthening election cybersecurity is essential for safeguarding democracy. For over 15 years, I and other computer scientists have been warning about the vulnerable state of election security, but attacks against recent elections in the U.S. and Europe demonstrate that sophisticated attackers are becoming more aggressive, even as campaigning and voting become increasingly reliant on computers.
Since 2016, I’ve been working with election officials and members of congress to strengthen election cybersecurity. In this talk, I’ll give a progress report about what’s happened since then and what still needs to happen to secure future elections. While many U.S. states have made progress at securing some aspects of their election infrastructure, and Congress provided $380M in new funding to the strengthen elections, significant vulnerabilities remain that put the integrity of future elections at risk. To demonstrate the ongoing threat, I’ll hold a mock election on stage with a real U.S. voting machine still used in 18 states, and show how remote attacks could potentially affect the outcome of a close national contest.
Finally, I’ll explain how defenses developed by researchers over the past decade could provide practical and cost-effective safeguards. Unfortunately, they have yet to be widely deployed due to a lack of resources and political leadership. I’ll describe legislative efforts in the U.S. and other countries that could, if successful, go a long way to making elections secure. I’ll also explain what technologists and other concerned humans can do to help secure elections at all levels.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="4228">J. Alex Halderman</person>
</persons>
<links/>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/653/original/Election_Cybersecurity_Progress_Report_%2835c5__December_2018%29.pdf?1545925095">Slides</attachment>
</attachments>
</event>
<event id="9647" guid="9629fcf4-6810-48d7-bd17-d81f924e6b47">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9647.html</url>
<logo>/system/events/logos/000/009/647/large/rems_logo.png?1542841646</logo>
<date>2018-12-27T14:10:00+01:00</date>
<start>14:10</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-9647-taming_the_chaos_can_we_build_systems_that_actually_work</slug>
<title>Taming the Chaos: Can we build systems that actually work?</title>
<subtitle>Possible paths from today's ghastly hackery to what computing should be</subtitle>
<track>Resilience</track>
<type>lecture</type>
<language>en</language>
<abstract>We rely on mainstream computer engineering every day, but it's insanely complex, poorly understood, unreliable, and, as CCC reminds us every year, chronically insecure. This talk will explain some ways that we can do better: taming parts of this this chaos with precise understanding - illustrated with disturbing facts and clean models for current architectures and the C language, from the <a href="https://www.cl.cam.ac.uk/~pes20/rems/">REMS</a> project, and principled but pragmatic new alternatives, that build in more hardware and software security protection,as developed in the <a href="https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/">CHERI</a> project.</abstract>
<description>Computing has been massively successful, and we routinely trust computer systems with our personal, financial, medical, commercial, and governmental information. But at the same time, these systems are pervasively prone to security flaws and subject to malicious attacks. We have to trust them, but they are not *trustworthy*.
There are two root causes. First, the pan-industry computing infrastructure, of processors, programming languages, and operating systems, is based on designs from a more forgiving time, with simpler systems and little incentive to design-in strong security protection. Second, the conventional engineering techniques we use (prose specifications, manually written tests, and test-and-debug development) are good enough to make systems work in common cases, but cannot exclude all errors - and a single coding error can lead to a devastating exploit.
Are we doomed? Perhaps not. This talk will highlight the sorry state of the art and then draw on cutting-edge research, from the University of Cambridge, SRI International, ARM, and other partners, to show some ways we can do better. First, we'll show how it's become possible to build and use rigorous models for key existing interfaces to improve engineering: for the ARMv8-A and RISC-V architectures, and the C language, in the <a href="https://www.cl.cam.ac.uk/~pes20/rems/">REMS</a> project. Then we'll describe a principled but pragmatic path to build in more hardware and software security protection to future systems, as developed in the <a href="https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/">CHERI</a> project. These are joint work by many people over the last 10 years.
</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="5247">Peter Sewell</person>
</persons>
<links>
<link href="https://www.cl.cam.ac.uk/~pes20/rems/">REMS</link>
<link href="https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/">CHERI</link>
<link href="http://www.cl.cam.ac.uk/~pes20/sail/">Sail ISA Description Language and Models</link>
<link href="https://www.cl.cam.ac.uk/~pes20/cerberus/">Cerberus C Semantics</link>
</links>
<attachments/>
</event>
<event id="9491" guid="51ede2da-0f9b-4984-bd58-659c556d20c9">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9491.html</url>
<logo>/system/events/logos/000/009/491/large/logo.svg.png?1538557991</logo>
<date>2018-12-27T16:10:00+01:00</date>
<start>16:10</start>
<duration>00:40</duration>
<room>Adams</room>
<slug>35c3-9491-hunting_the_sigfox_wireless_iot_network_security</slug>
<title>Hunting the Sigfox: Wireless IoT Network Security</title>
<subtitle>Dissecting the radio protocol of Sigfox, the global cellular network for the IoT you have probably never heard of</subtitle>
<track>Hardware & Making</track>
<type>lecture</type>
<language>en</language>
<abstract><a href="https://www.sigfox.com/">Sigfox</a> is an emerging low-power wide-area network (LP-WAN) technology for IoT devices, comparable to <a href="https://lora-alliance.org/">LoRa</a>.
This talk recounts my analysis of Sigfox's radio protocol and presents an open reference implementation of an alternative Sigfox protocol stack.
It confirms that while Sigfox ensures authenticity and integrity, transmitted payloads are not confidential.
This presentation is targeted at a technical audience with some basic knowledge of cryptography (security goals, AES), but <b>no</b> knowledge in RF technology (modulation, scrambling, error correction) is required.</abstract>
<description><p>Sigfox can be compared to a cellular network, but for mostly battery-powered IoT devices that don't need to transmit much data. While <a href="https://www.etsi.org/deliver/etsi_gs/LTN/001_099/003/01.01.01_60/gs_LTN003v010101p.pdf">some</a> <a href="https://www.sigfox.com/en/sigfox-iot-technology-overview">sparse</a> <a href="https://tools.ietf.org/html/draft-zuniga-lpwan-sigfox-system-description-04">details</a> on Sigfox's architecture and <a href="https://www.sigfox.com/sites/default/files/1701-SIGFOX-White_Paper_Security.pdf">its security</a> have been published and <a href="https://www.disk91.com/2017/technology/sigfox/the-sigfox-radio-protocol/">some basic reverse engineering has been carried out</a>, most of the protocol specifications remain proprietary and closed, so by now, no independent security audit was performed. Advertised use cases of Sigfox include air quality monitoring, weather stations, utilities metering and tracking farm animals. In this talk, I illustrate why these applications are fine, but why one might not want to track a money transporter with Sigfox or base a home alarm system on it.</p>
<p>The Sigfox network is very atypical, with uplink and downlink based on different physical layers.
After a short introduction, I begin the presentation by taking a deep dive into Sigfox's radio protocol with a focus on its Security. Basics of radio technology (SDRs, ultra-narrow band (UNB) modulation, SRD bands) and techniques for analyzing protocols are briefly summarized and the uplink's and downlink's frame structures are presented.</p>
<p>Subsequently, I show how a radio sniffer that has captured Sigfox messages can extract the uplink's and downlink's contents. While the uplink's payload is already contained in plaintext, the downlink is scrambled, but I indicate how the downlink's pseudorandom whitening sequence used for scrambling can be generated or brute-forced by an eavesdropper. Moreover, I outline attacks that could even compromise Sigfox's authenticity checking.</p>
<p>Finally, I provide some suggestions on how to improve Sigfox's security.</p>
<p>The reference implementation of an alternative Sigfox protocol stack &quot;librenard&quot; that was created as part of this work as well as reconstructed protocol specifications detailing the uplink and significant portions of the downlink protocol will be published immediately after this talk.</p></description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8179">Florian Euchner (Jeija)</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9386" guid="527b56af-8d56-4edb-9027-9ca60767c742">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9386.html</url>
<logo>/system/events/logos/000/009/386/large/i2DL.jpg?1544387802</logo>
<date>2018-12-27T17:10:00+01:00</date>
<start>17:10</start>
<duration>00:40</duration>
<room>Adams</room>
<slug>35c3-9386-introduction_to_deep_learning</slug>
<title>Introduction to Deep Learning</title>
<subtitle/>
<track>Science</track>
<type>lecture</type>
<language>en</language>
<abstract>This talk will teach you the fundamentals of machine learning and give you a sneak peek into the internals of the mystical black box. You'll see how crazy powerful neural networks can be and understand why they sometimes fail horribly.</abstract>
<description>Computers that are able to learn on their own. It might have sounded like science-fiction just a decade ago, but we're getting closer and closer with recent advancements in Deep Learning. Or are we?
In this talk, I'll explain the fundamentals of machine-learning in an understandable and entertaining way. I'll also introduce the basic concepts of deep learning. With the current hype of deep learning and giant tech companies spending billions on research, understanding how those methods works, knowing the challenges and limitations is key to seeing the facts behind the often exaggerated headlines.
One of the most common applications of deep learning is the interpretation of images, a field that has been transformed significantly in recent years. Applying neural networks to image data helps visualising and understanding many of the faults as well as advantages of machine learning in general. As a research scientist in the field of automated analysis of bio-medical image data, I can give you some insights into these as well as some real-world applications.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8117">teubi</person>
</persons>
<links>
<link href="https://www.nussschale-podcast.de">Nussschale Podcast</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/647/original/i2DL_Slides.pdf?1545916065">Slides</attachment>
</attachments>
</event>
<event id="10011" guid="686c1387-e761-4df6-b395-f9ddf92d46e7">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/10011.html</url>
<logo/>
<date>2018-12-27T18:10:00+01:00</date>
<start>18:10</start>
<duration>00:40</duration>
<room>Adams</room>
<slug>35c3-10011-hackerethik_-_eine_einfuhrung</slug>
<title>Hackerethik - eine Einführung</title>
<subtitle>Verantwortung und Ethik beim schöpferisch-kritischen Umgang mit Technologie</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Die Hackerethik ist die Grundlage für den Umgang mit den diversen ethischen Problemen, die sich beim schöpferisch-kritischen Umgang mit Technologie (auch "hacking" genannt) stellen. </abstract>
<description>Die Hackerethik ist die Grundlage für den Umgang mit den diversen ethischen Problemen, die sich beim schöpferisch-kritischen Umgang mit Technologie (auch "hacking" genannt) stellen. Sie bietet Anhaltspunkte für die alltäglichen Fragestellungen und Probleme, die aufkommen, wenn man Technologie anders benutzt, als der Hersteller es sich gedacht hat, wenn man Lücken in Systemen findet und ausnutzt oder über Berge von persönlichen Daten stolpert. Dieser Talk gibt eine Einführung in die verschiedenen Aspekte der Hackerethik und regt zum Nachdenken über die ethischen Fragen an, die sich Menschen mit speziellen Fähigkeiten und Fertigkeiten stellen, wenn sie ihren Neigungen nachgehen. </description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="1633">frank</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9545" guid="ea7c532f-cc2d-4cb1-8f15-1933df7fd523">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9545.html</url>
<logo/>
<date>2018-12-27T19:10:00+01:00</date>
<start>19:10</start>
<duration>00:40</duration>
<room>Adams</room>
<slug>35c3-9545-venenerkennung_hacken</slug>
<title>Venenerkennung hacken</title>
<subtitle>Vom Fall der letzten Bastion biometrischer Systeme</subtitle>
<track>Security</track>
<type>lecture</type>
<language>de</language>
<abstract>Die Venenerkennung ist eine der letzten Bastionen biometrischer Systeme, die sich bisher der Eroberung durch Hacker widersetzt hat. Dabei ist sie ein lohnendes Ziel, schützt sie doch Bankautomaten und Hochsicherheitsbereiche. In diesem Talk machen wir die Verteidigungsanlagen dem Erdboden gleich.</abstract>
<description>Seit Jahrzehnten vor allem im asiatischen Raum eingesetzt sind bisher keine ernsthaften Versuche bekannt Venenerkennungssysteme zu üeberwinden. Neben dem Mythos der Hochsicherheit sind vor allem die, unsichtbar im Körper gelegenen Merkmale dafür verantwortlich. In diesem Talk werden wir zeigen, mit welch geringem Aufwand man an die "versteckten" Venenbilder gelangen kann und wie, auf Grundlage dieser, Attrappen gebaut werden können, welche die Systeme der beider grosser Hersteller überwinden.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="1623">starbug</person>
<person id="8381">Julian</person>
</persons>
<links/>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/734/original/1812-congress.pdf?1546876965">slides</attachment>
</attachments>
</event>
<event id="10016" guid="f010dc03-13bc-413d-95ec-e8786626a2f1">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/10016.html</url>
<logo/>
<date>2018-12-27T20:50:00+01:00</date>
<start>20:50</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-10016-g10_bnd-gesetz_und_der_effektive_schutz_vor_grundrechten</slug>
<title>G10, BND-Gesetz und der effektive Schutz vor Grundrechten</title>
<subtitle>Die strategische Fernmeldeüberwachung des BND vor dem Bundesverfassungsgericht</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Der Vortrag behandelt die Klage des Internetknotens DE-CIX gegen die strategische Fernmeldeüberwachung des BND vor dem Bundesverwaltungsgericht in Leipzig, was wir aus dem Urteil über den Rechtsschutz der Bürger lernen können und wieso der Fall nun das Bundesverfassungsgericht in Karlsruhe beschäftigt.</abstract>
<description/>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="174">Klaus Landefeld</person>
</persons>
<links/>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/713/original/Effektiver_Schutz_vor_Grundrechten_20181227.pdf?1546115285">Präsentation</attachment>
</attachments>
</event>
<event id="9992" guid="71bdcf60-c567-4cf6-94f4-5681b1d008b4">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9992.html</url>
<logo/>
<date>2018-12-27T22:10:00+01:00</date>
<start>22:10</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-9992-all_your_gesundheitsakten_are_belong_to_us</slug>
<title>All Your Gesundheitsakten Are Belong To Us</title>
<subtitle>"So sicher wie beim Online-Banking": Die elektronische Patientenakte kommt - für alle.</subtitle>
<track>Security</track>
<type>lecture</type>
<language>de</language>
<abstract>Plötzlich geht alles ganz schnell: Online-Behandlungen und elektronische Gesundheitsakten sind dieses Jahr für Millionen Krankenversicherte Wirklichkeit geworden. Zu einem hohen Preis: Bereits einfache Angriffe lassen das Sicherheitskonzept der Apps und Plattformen zusammenbrechen. Warum das so ist, welche kritischen Fehler Vivy & Co. gemacht haben und wie das möglicherweise verhindert werden kann, das soll dieser Vortrag zeigen - denn in spätestens drei Jahren sollen auch die Gesundheitsdaten aller übrigen Versicherten zentral gespeichert und online abrufbar sein.</abstract>
<description>Die elektronische Gesundheitskarte ist gescheitert. Stattdessen kommt jetzt die elektronische Patientenakte: In spätestens drei Jahren sollen die Befunde, Diagnosen, Röntgenbilder und Rezepte aller gesetzlich Krankenversicherten online und zentral gespeichert verfügbar sein. Schon heute können Millionen Versicherte eine solche Lösung nutzen und, wie Gesundheitsminister Jens Spahn fordert, "auch auf Tablets und Smartphones auf ihre elektronische Patientenakte zugreifen". Zeitgleich zur elektronischen Patientenakte steht die Onlinebehandlung vor der Tür: Das Fernbehandlungsverbot wurde vor wenigen Monaten gekippt, und schon heute können sich Millionen Versicherte ausschließlich online behandeln lassen.
Nach Jahren des Wartens geht dabei alles ganz schnell. "Diese Maßnahmen dulden keinen Aufschub", sagt Spahn. Und macht uns alle damit zu Beta-Testern in Sachen Gesundheit. Mit fatalen Folgen: Unsere streng vertraulichen Gesundheitsdaten liegen für alle sichtbar im Netz.
In diesem Vortrag zeige ich an fünf konkreten Beispielen, welche fahrlässigen Entscheidungen die Online-Plattformen und Apps der Anbieter aus dem Bereich Gesundheitsakte und Telemedizin so angreifbar machen und demonstriere, wie einfach der massenhafte Zugriff auf unsere vertraulichen Gesundheitsdaten gelang. Zur Debatte steht, was angesichts dieser neuen alten Erkenntnisse zu tun ist - und was wir besser bleiben lassen.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="7912">Martin Tschirsich</person>
</persons>
<links/>
<attachments/>
</event>
<event id="10015" guid="1a28630d-985e-409b-be4a-b6679ecc83c3">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/10015.html</url>
<logo>/system/events/logos/000/010/015/large/polizeiRun.jpg?1544462653</logo>
<date>2018-12-27T23:30:00+01:00</date>
<start>23:30</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-10015-polizeigesetze</slug>
<title>Polizeigesetze</title>
<subtitle>Endlich viele neue Gründe zu demonstrieren</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Heimatminister Horst Seehofer und seine Amtskollegen in den Ländern erweitern die Rechte der Polizeien und planen ein „Musterpolizeigesetz“. Damit handelten sie sich die größten Proteste gegen Überwachungsvorhaben seit Jahren ein.</abstract>
<description>Wir geben nicht nur einen Überblick über die zahlreichen Neuregelungen der Polizeigesetze in den Bundesländern, sondern berichten auch aus den Anhörungen in den Landtagen und von den Stellungnahmen. Wir erklären, was in den neuen Gesetzen steht und welche rechtlichen und technischen Grenzüberschreitungen wir zu kritisieren haben.
Und wir haben ein paar Forderungen.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8733">Marie Bröckling</person>
<person id="1630">Constanze Kurz</person>
</persons>
<links>
<link href="https://netzpolitik.org/tag/polizeigesetz/">Berichterstattung zu den Polizeigesetzen bei netzpolitik.org</link>
</links>
<attachments/>
</event>
<event id="9506" guid="462f9320-3a0e-4785-82de-15343803c2ba">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9506.html</url>
<logo/>
<date>2018-12-28T00:40:00+01:00</date>
<start>00:40</start>
<duration>01:00</duration>
<room>Adams</room>
<slug>35c3-9506-freude_ist_nur_ein_mangel_an_information</slug>
<title>Freude ist nur ein Mangel an Information</title>
<subtitle>Ein Demotivationsworkshop zur politischen Lage.</subtitle>
<track>Entertainment</track>
<type>lecture</type>
<language>de</language>
<abstract>Nico Semsrott hat in Zeiten des globalen Rechtsrucks den überflüssigsten Job der Welt: Er ist Demotivationstrainer. Mit Powerpointpräsentationen und viel Pessimismus schafft er es, komplexe Themen zu vereinfachen, ohne dabei auf alternative Fakten zurückgreifen zu müssen.</abstract>
<description>Politisch gesehen ist zwar alles aussichtslos. Aber wenn man schon aufgibt, kann man man genauso gut auch das Resignieren aufgeben. Deswegen kandidiert Nico auf Platz 2 der Europaliste der Partei Die PARTEI. Um dann in Brüssel als Kommissionspräsident die Demokratie in Europa einzuführen. Notfalls gegen den Willen der Bürgerinnen und Bürger.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8748">Nico Semsrott</person>
</persons>
<links/>
<attachments/>
</event>
</room>
<room name="Borg">
<event id="9607" guid="c0e4f528-92c7-4170-aff3-d4dd5cd74b2c">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9607.html</url>
<logo>/system/events/logos/000/009/607/large/500px-Move_protect.svg.png?1539423571</logo>
<date>2018-12-27T11:30:00+01:00</date>
<start>11:30</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-9607-the_rocky_road_to_tls_1_3_and_better_internet_encryption</slug>
<title>The Rocky Road to TLS 1.3 and better Internet Encryption</title>
<subtitle/>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>Since a few months we have a new version of TLS, the most important encryption protocol on the Internet. From the vulnerabilities that created the need of a new TLS version to the challenges of deploying it due to broken devices this talk will give an overview of the new TLS 1.3.</abstract>
<description>In August the new version 1.3 of the Transport Layer Security (TLS) protocol was released. It‘s the result of a process that started over four years ago when it became increasingly clear that previous TLS versions suffered from some major weaknesses.
In many ways TLS 1.3 is the biggest step ever done in the history of TLS and its predecessor SSL. While previous TLS versions always tried to retain compatibility and not change too many things, the new version radically removes problematic and insecure constructions like static RSA key exchanges, fragile CBC/HMAC constructions and broken hash functions like MD5 and SHA1.
As a bonus TLS 1.3 comes with a reworked handshake that reduces the number of round-trips and thus provides not just more security, but also better performance. If that sounds too good to be true: An optional, even faster mode of TLS 1.3 – the zero round trip or 0RTT mode – makes some security researchers worried, because they fear it introduces new security risks due to replay attacks.
Though the road to TLS 1.3 was complicated. The Internet is a buggy place and particularly Enterprise devices of all kinds – middleboxes, TLS-terminating servers and TLS-interception devices – slowed down the deployment and finalization of the new encryption protocol. Also some banks thought that TLS 1.3 is too secure for them.
The talk will give an overview of the developments that led to TLS 1.3, the major changes it brings, the challenges it had to face and some practical advice for deployment.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="2462">hanno</person>
</persons>
<links>
<link href="https://www.feistyduck.com/bulletproof-tls-newsletter/issue_44_tls_1_3_is_here">TLS 1.3 is here</link>
<link href="https://www.feistyduck.com/bulletproof-tls-newsletter/issue_33_why_tls_13_isnt_there_yet">Why TLS 1.3 isn’t there yet</link>
<link href="https://www.golem.de/news/tls-1-3-die-zukunft-der-netzverschluesselung-1612-124724.html">TLS 1.3: Die Zukunft der Netzverschlüsselung</link>
<link href="https://int21.de/slides/35c3-tls13/">The Rocky Road to TLS 1.3 - Slides</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/732/original/tls13.pdf?1546421079">Slides</attachment>
</attachments>
</event>
<event id="9904" guid="d995955c-319f-4228-b3f4-080868bbfdf8">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9904.html</url>
<logo/>
<date>2018-12-27T12:50:00+01:00</date>
<start>12:50</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-9904-the_social_credit_system</slug>
<title>"The" Social Credit System</title>
<subtitle>Why It's Both Better and Worse Than We can Imagine</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>en</language>
<abstract>The Chinese Social Credit System (SCS) has been discussed a lot in Western media. However, we do not know currently how the system that is supposed to take nationwide effect by 2020 will look like, as there are more than 70 pilot projects currently undertaken. These pilots rank from commercial royalty and rewards programs (Sesame Credit) to an Orwellian system, where each action has a predetermined associated score (Rongcheng). In-between, there’s nebulous algorithmic systems that basically act as a Black Box (Honesty Shanghai). This talk, therefore, looks at some of these pilots and their implementation details, and through an agent-based modeling framework, discusses the likely effects of different implementations. In doing so, it shows that most of the systems currently being tested are prone to manipulation by leaders from all levels of government, and that the ostensible goal of allocating scarce resources more efficiently is unlikely to be served by the new system(s).</abstract>
<description>The author, Antonia Hmaidi, is a PhD candidate in East Asian Economics with a focus on China. She presented a talk on the impact of internet censorship at the 33C3. This talk’s goal is to provide those interested with a technically-grounded understanding of “the” Chinese social credit system and its possible impact on Chinese society and economy. In doing so, it seeks to provide a more nuanced picture than is usually presented in either Chinese or Western media. Working on data science and machine learning in her free time allows the author to better understand the algorithms comprising “the” social credit system.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="6990">Toni</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9877" guid="94b77e5a-c826-45a9-a8bd-bbb8e5e7c9ff">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9877.html</url>
<logo>/system/events/logos/000/009/877/large/cp.png?1539636113</logo>
<date>2018-12-27T14:10:00+01:00</date>
<start>14:10</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-9877-censored_planet_a_global_censorship_observatory</slug>
<title>Censored Planet: a Global Censorship Observatory </title>
<subtitle/>
<track>Resilience</track>
<type>lecture</type>
<language>en</language>
<abstract>Six years ago the idea behind CensoredPlanet started, that is now launched at censoredplanet.org. We had a simple (yet essential) guiding principle: measurements that may be politically sensitive should be done without volunteer participation. In this talk, besides a detailed scientific overview of the techniques and the current state of CensoredPlanet, I plan to talk about my experience in developing the project from the ground up.
Despite the pervasive nature of Internet censorship and the continuous evolution of how and where censorship is applied, measurements of censorship remain comparatively sparse. Current censorship projects, including OONI, depend on participants within countries to help them collect measurements. While these projects are valuable, we have empirically seen that there are issues relating to continuity in terms of measurement, coverage of the geographical area, and ethical dilemmas when user participation is a requirement. Censored Planet use tens of thousands of *remote infrastructural and organizational vantage points* from over 170 countries to conduct it’s measurements, thereby removing the need for user participation. This allows us to regularly measure Internet disruptions over a longer period of time in significantly more countries in a safer way.
The research we conduct at Censored Planet provides unique insights and data points on Internet disruptions. This information is extremely valuable to researchers in diverse fields from political science to computer science as well as to activists and journalists living and operating in countries where Internet disruptions are prevalent. By making our data easily accessible to the public, we aim to encourage future research in the field. Link to our data: https://censoredplanet.org/data/raw.</abstract>
<description/>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8385">Roya Ensafi</person>
</persons>
<links>
<link href="https://censoredplanet.org">Censored Planet: a Global Censorship Observatory </link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/654/original/35C3-CensoredPlanet-Ensafi.pdf?1545925229">Presentation Slides</attachment>
<attachment href="/attachments/original/missing.png">file</attachment>
</attachments>
</event>
<event id="10005" guid="f0d70663-0769-4462-ad27-bc516d9cb141">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/10005.html</url>
<logo/>
<date>2018-12-27T16:10:00+01:00</date>
<start>16:10</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-10005-how_does_the_internet_work</slug>
<title>How does the Internet work?</title>
<subtitle>An explanation of Inter-Net and everyday protocols</subtitle>
<track>Resilience</track>
<type>lecture</type>
<language>en</language>
<abstract>This Foundations talk explains the systems and protocols that make up the Internet, starting from a laptop with a Wi-Fi connection. No particular technical knowledge required.</abstract>
<description>Many consider "the Internet" a utility similar to electricity - and that's a great attitude! - but for most, "the Internet" only means access to a few centralized services offered by mega-corporations "for free", around which people build their entire social and professional lives.
Come along for a look behind the scenes of all those fancy websites, let's go through what the Internet actually is!
Knowing the difference between the network and services reachable through the network is perhaps more important than ever, because if we implicitly give service providers all the power by never asking for a public, utility-like network then that's the end of the Internet as we know it. Key word: Net neutrality.
So in this talk we will discover the network. In simple terms and without too much technical detail we'll start out with the "atom" of networks <i>the packet</i>, then cover the fundamental <i>Internet Protocol</i> (IPv4-only for simplicity), we'll try to answer <i>what is a network?</i> - not obvious it turns out, we'll look at <i>where do IP addresses come from?</i> and then we'll move on to the Internet cornerstone that is <i>routing</i>. We'll approach routing from the perhaps most well-known router - the <i>wireless home router</i> - and then look at how similar or dissimilar <i>routers on the Internet</i> are to that home router, leading us to a look at the <i>routing protocol</i> which constantly determines how our packets flow throughout the world.
Those are the basic building blocks of the Internet. Now for some delicious alphabet soup!
We'll take a step toward applications and compare <i>UDP</i>, <i>TCP</i> and <i>SCTP</i>, which are all used together with IP for most if not all end-user Internet communication.
Finally, we'll arrive at the most common applications, looking into how <i>DNS</i> (domain names), <i>SMTP</i> (sending email) and <i>HTTP</i> (web) work.
All of this is actually surprisingly simple and surprisingly old. None of it was built to be secure.
The goal is that you will gain an understanding of the structure of the Internet, that you will be able "see through" the browser, email client and web service facades, because now you know what's going on behind the scenes, and everything that's <i>actually</i> possible with a public utility network - far more than centralized consumption/you-are-our-product services.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="2142">Peter Stuge</person>
</persons>
<links/>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/677/original/35c3-internet.zip?1546003081">Presentation slides</attachment>
</attachments>
</event>
<event id="9563" guid="a42e5a4f-fd9b-4571-bf17-483978afecb3">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9563.html</url>
<logo>/system/events/logos/000/009/563/large/wallet.fail.png?1539543982</logo>
<date>2018-12-27T17:30:00+01:00</date>
<start>17:30</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-9563-wallet_fail</slug>
<title>wallet.fail</title>
<subtitle>Hacking the most popular cryptocurrency hardware wallets</subtitle>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>In this presentation we will take a look at how to break the most popular cryptocurrency hardware wallets. We will uncover architectural, physical, hardware, software and firmware vulnerabilities we found including issues that could allow a malicious attacker to gain access to the funds of the wallet. The attacks that we perform against the hardware wallets range from breaking the proprietary bootloader protection, to breaking the web interfaces used to interact with wallets, up to physical attacks including glitching to bypass the security implemented in the IC of the wallet. Our broad look into several wallets demonstrates systemic and recurring issues. We provide some insight into what needs to change to build more resilient hardware wallets.
</abstract>
<description>Hardware wallets are becoming increasingly popular and are used to store a significant percentage of the world’s cryptocurrency. Many traders, hedge funds, ICOs and blockchain projects store the entirety of their cryptocurrency on one or very few wallets. This means that users of hardware wallets store tens of millions of euros of cryptocurrency on small USB peripherals that costs only a few euros to manufacture. Moreover, many users that trade and speculate in cryptocurrency interact, update, and generate transactions using their hardware wallets on a daily basis.
In this talk we look at the good, the bad and the ugly of hardware wallet security: We will walk through the different architectures of the wallets, look at the different attack vectors and talk about the challenges of building secure hardware before diving in deep finding vulnerabilities in the different wallets.
The vulnerabilities we will present range from vulnerabilities that can be fixed in a firmware upgrade, to bugs that will require a new hardware revision, up to attacks on the microcontrollers themselves, requiring new silicon to be fixed.
Some of the (most entertaining) vulnerabilities will be demonstrated live on stage.
<h2>Classes of Vulnerabilities we will look at</h2>
<b>Firmware Vulnerabilities</b>
Firmware vulnerabilities are vulnerabilities affecting the software that runs on the hardware wallet. Since most wallets provide update mechanisms this class of bug can be patched in a future firmware release.
<b>Software Vulnerabilities</b>
Software vulnerabilities are vulnerabilities affecting the host software that runs on the PC or smartphone and communicates with the hardware wallet. Since most wallets provide update mechanisms this class of bug can be patched in a future release of the host software
<b>Hardware Vulnerabilities</b>
Hardware vulnerabilities are vulnerabilities affecting the device hardware of the hardware wallet. Hardware vulnerabilities are generally incorrectly set configurations of the hardware either during manufacturing or by the firmware. If the configuration is set by firmware these vulnerabilities can be patched in a future firmware release. Otherwise, they are unlikely to be fixed by the vendor.
<b>Physical Vulnerabilities</b>
Physical vulnerabilities are vulnerabilities affecting the hardware design of the hardware wallet. Once the device has been manufactured, hardware vulnerabilities cannot be mitigated and can only be fixed in a future hardware revision of the device. This class of vulnerabilities is unlikely to be fixed by the vendor.
<b>Architectural Vulnerabilities</b>
Architectural vulnerabilities are vulnerabilities affecting the overall architecture of the hardware wallet. These are inherent design flaws in the device and can only be fixed in a major hardware revision, i.e. a new version of the device. This class of vulnerabilities is unlikely to be fixed by the vendor.
</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="7775">Thomas Roth</person>
<person id="3985">Dmitry Nedospasov</person>
<person id="4958">Josh Datko</person>
</persons>
<links>
<link href="https://wallet.fail">wallet.fail website</link>
</links>
<attachments/>
</event>
<event id="9766" guid="a12d17e9-3758-4fa0-b612-0c6ba22ea773">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9766.html</url>
<logo>/system/events/logos/000/009/766/large/logo-quadrat-vector.jpg?1539611939</logo>
<date>2018-12-27T18:50:00+01:00</date>
<start>18:50</start>
<duration>01:00</duration>
<room>Borg</room>
<slug>35c3-9766-das_ist_mir_nicht_erinnerlich_der_nsu-komplex_heute</slug>
<title>"Das ist mir nicht erinnerlich." − Der NSU-Komplex heute</title>
<subtitle>Fünf Monate nach dem Urteil im ersten NSU-Prozess</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Sieben Jahre lang musste den Behörden jedes Stück der versprochenen Aufklärung des NSU-Komplexes abgerungen werden. Das Urteil im ersten NSU-Prozess zeigt: Deutschland ist nur sehr eingeschränkt bereit, rechtem Terror entgegenzutreten und ihn aufzuarbeiten, den Betroffenen, Geschädigten und Überlebenden zuzuhören und ihnen Schutz zu garantieren. Das zu leisten ist unsere Aufgabe: die Aufgabe der Gesellschaft, die Aufgabe einer antifaschistischen und antirassistischen Linken. </abstract>
<description>Am 4. November 2011 enttarnte sich der „Nationalsozialistische Untergrund“ (NSU) selbst. Fast sieben Jahre später, am 10. Juli 2018, wurde das Urteil im ersten NSU-Prozess gesprochen. Heute, fünf Monate nach der von Neonazis bejubelten mündlichen Urteilsverkündung, müssen wir mit einem Urteil umgehen, in dem sich viele gebrochene Aufklärungsversprechen zuspitzen. Das Gericht geht von der These aus, der NSU sei ein weitgehend isoliertes „Trio“ ohne Netzwerk und ohne Verstrickung der Behörden gewesen. Nach allem, was in den letzten Jahren – teilweise mühsam – über den NSU-Komplex ans Licht gezerrt werden konnte, ist die „Trio“-These aber nicht haltbar. Zum NSU-Komplex gehören ein Neonazinetzwerk, der gesamtgesellschaftliche Rassismus und das Handeln der Polizei sowie des Verfassungsschutzes.
Gleichzeitig stellen sich die Angehörigen der vom NSU Ermordeten und die Überlebenden der Anschläge immer noch die gleichen Fragen wie 2011: Wer hat die Tatorte ausgewählt? Warum wurde gerade ihr Vater, Ehemann, Sohn, ihre Tochter ermordet? Wer ist Teil des Unterstützungsnetzwerks des NSU? Was wusste der Verfassungsschutz und was machte er warum mit seinem Wissen (nicht)?
Klar ist: Die gesellschaftlichen Verhältnisse, die den NSU hervorgebracht haben, müssen abgeschafft werden. Das Urteil im ersten NSU-Prozess hat noch einmal unterstrichen: Deutschland ist nur in sehr eingeschränktem Maße bereit, rechtem Terror entgegenzutreten und ihn aufzuarbeiten, den Betroffenen, Geschädigten und Überlebenden zuzuhören und ihnen Schutz zu garantieren. Das zu leisten ist unsere Aufgabe: die Aufgabe der Gesellschaft, die Aufgabe einer antifaschistischen und antirassistischen Linken.
Im Vortrag soll der Stand der Aufklärung im NSU-Komplex umrissen werden und diskutiert werden, wie wir als Gesellschaft damit umgehen und was wir tun können.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8543">Caro Keller (NSU-Watch)</person>
</persons>
<links>
<link href="nsu-watch.info">NSU-Watch</link>
</links>
<attachments/>
</event>
<event id="9462" guid="42650545-4394-4455-a5f5-9efad111fedc">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9462.html</url>
<logo/>
<date>2018-12-27T20:50:00+01:00</date>
<start>20:50</start>
<duration>00:40</duration>
<room>Borg</room>
<slug>35c3-9462-what_the_fax</slug>
<title>What The Fax?!</title>
<subtitle>Hacking your network likes it's 1980 again</subtitle>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>We all know what FAX is, and for some strange reason most of us need to use it from time to time. Hard to believe its 2018, right?
But can FAX be something more than a bureaucratic burden? Can it actually be a catastrophic security hole that may be used to compromise your entire network? Come watch our talk and find out …</abstract>
<description>Unless you've been living under a rock for the past 30 years or so, you probably know what a fax machine is. For decades, fax machines were used worldwide as the main way of electronic document delivery. But this happened in the 1980s. Humanity has since developed far more advanced ways to send digital content, and fax machines are all in the past, right? After all, they should now be nothing more than a glorified museum item. Who on earth is still using fax machines?
The answer, to our great horror, is EVERYONE. State authorities, banks, service providers and many others are still using fax machines, despite their debatable quality and almost non-existent security. In fact, using fax machines is often mandatory and considered a solid and trustworthy method of delivering information.
What the Fax?!
We embarked on a journey with the singular goal of disrupting this insane state of affairs. We went to work, determined to show that the common fax machine could be compromised via mere access to its fully exposed and unprotected telephone line – thus completely bypassing all perimeter security protections and shattering to pieces all modern-day security concepts.
Join us as we take you through the strange world of embedded operating systems, 30-year-old protocols, museum grade compression algorithms, weird extensions and undebuggable environments. See for yourself first-hand as we give a live demonstration of the first ever full fax exploitation, leading to complete control over the entire device as well as the network, using nothing but a standard telephone line.
This talk is intended to be the canary in the coal mine. The technology community cannot sit idly by while this ongoing madness is allowed to continue!
The world must stop using FAX!</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="6000">Yaniv Balmas</person>
<person id="8269">Eyal Itkin</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9838" guid="5f5d8fd7-45a7-44e4-8d82-dfb8ee692f8b">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9838.html</url>
<logo>/system/events/logos/000/009/838/large/logo.png?1539632549</logo>
<date>2018-12-27T21:50:00+01:00</date>
<start>21:50</start>
<duration>00:40</duration>
<room>Borg</room>
<slug>35c3-9838-genom-editierung_mit_crispr_cas</slug>
<title>Genom-Editierung mit CRISPR/Cas</title>
<subtitle>“Eine neue Hoffnung” oder “Angriff der Klonkrieger”? </subtitle>
<track>Science</track>
<type>lecture</type>
<language>de</language>
<abstract>CRISPR/Cas hat die Genforschung revolutioniert und könnte bald in großem Stil gentechnisch eingesetzt werden. Aber was ist CRISPR und wie funktioniert es? Kurz gesagt: Teile des adaptiven Immunsystems von Bakterien werden genutzt, um Gene zu verändern. Und das funktioniert präziser als mit jedem anderen Werkzeug zuvor und offenbar in allen Tier- und Pflanzenarten. Damit ist CRISPR anders als die herkömmlichen Methoden der Gentechnik. Es ist einfach anzuwenden, preiswert, schnell, extrem vielseitig und damit in jedem Biologielabor erhältlich. Bio-Hacker haben sogar begonnen, CRISPR zu Hause zu nutzen. CRISPR wird bereits eingesetzt, um mehr über Genfunktionen und -dysfunktionen zu erfahren. So könnte es realistischerweise zur Behandlung einiger Krankheiten eingesetzt werden. Aber welche Hürden gibt es noch und welche ethischen Fragen würden sie mit sich bringen? Wie kann (oder sollte?) CRISPR in der Landwirtschaft eingesetzt werden, wenn der Klimawandel die Erträge verringert und die Biodiversität gefährdet?
Unser Vortrag gibt einen Überblick darüber, was mit dem CRISPR/Cas-System möglich ist. Wir möchten genügend Informationen liefern, um zwischen Pseudowissenschaften und dem, was tatsächlich möglich ist, unterscheiden zu können.
</abstract>
<description>André ist Physiker, Biochemiker und Wissenschaftskommunikator.
Katrin studierte Biochemie, verpodcastete Wissenschaftsnachrichten und berät wissenschaftliche Softwareprojekte.
Anna ist Biologin und hat während ihrer Doktorarbeit teilweise mit CRISPR gearbeitet.
Obwohl wir aus verschiedenen Bereichen der Wissenschaft kommen, haben wir eine gemeinsame Leidenschaft: Themen aus der Wissenschaft verständlich darzustellen. Eine der vielversprechendsten neuen Technologien ist CRISPR/Cas. Dabei handelt es sich um eine Gentechnikmethode, die ein großes Potenzial für Mensch und Umwelt hat. Aber wie jedes Werkzeug kann CRISPR sowohl für Gutes als auch für Böses eingesetzt werden - und es ist nicht immer einfach zu sagen, was was ist, besonders in biologischen und ökologischen Systemen. CRISPR hilft uns, Genfunktionen und Krankheiten besser erforschen zu können. Es könnte uns auch helfen, die Folgen des Klimawandels in vielerlei Hinsicht zu bekämpfen - doch haben wir uns nicht genug in die Umwelt eingemischt? CRISPR könnte uns helfen, Krankheiten zu behandeln, vielleicht sogar bei Embryonen mit genetischen Krankheiten. Aber ist es ethisch vertretbar, die menschliche Keimbahn zu verändern? Oder sollten wir sie bei Tieren verändern, um höhere Fleisch-, Milch- oder Eiererträge zu erzielen? Was könnten wir ändern und was sollten wir besser in Ruhe lassen?
Was mit CRISPR getan wird - darüber sollte es einen breiten Dialog in der Gesellschaft geben. Wir wollen versuchen die wissenschaftliche Faktenlage darzustellen, und die Möglichkeiten und Grenzen von CRISPR zu beleuchten.
</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="6979">_Adora_Belle_</person>
<person id="7027">André Lampe</person>
<person id="6574">KaLeiMai</person>
</persons>
<links>
<link href="http://scienceblogs.de/diekleinendinge/">Blog André Lampe / anderelampe</link>
<link href="https://zellmedien.de/">Anna Müllner / Adora Belle </link>
<link href="https://wirkstoffradio.de">Wirkstoffradio</link>
<link href="https://fyyd.de/user/KonScience/curation/crispr-genomeditierung?page=0">kuratierte Podcastepisoden über CRISPR & Co.</link>
<link href="https://docs.google.com/presentation/d/1WMHsmgAln0tWvW5kd9MexENBBfdue4NXrXZiiJGkPxI/edit">Google-Slides (zum Kommentieren)</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/662/original/CRISPR-Cas-Angriff-der-Klonkrieger-oder-Eine-Neue-Hoffnung-35c3.pdf?1545950437">PDF</attachment>
<attachment href="/attachments/original/missing.png">file</attachment>
</attachments>
</event>
<event id="9597" guid="96d10915-cc4b-42ca-ad75-15205db70d0b">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9597.html</url>
<logo>/system/events/logos/000/009/597/large/bios.png?1539366432</logo>
<date>2018-12-27T22:50:00+01:00</date>
<start>22:50</start>
<duration>00:40</duration>
<room>Borg</room>
<slug>35c3-9597-modchips_of_the_state</slug>
<title>Modchips of the State</title>
<subtitle>Hardware implants in the supply-chain</subtitle>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>Hardware implants and supply chain attacks have been in the news recently, but how feasible are they and what can we do about them? In this talk we'll examine the design of a proof of concept SPI bus hardware implant that has similar capabilities to those described in the Bloomberg/Supermicro article as well as some countermeasures that we can use to try to detect these "modchips" and increase our trust in our systems.</abstract>
<description>We don't know how much of the Bloomberg story about hardware implants installed in Supermicro servers shipped to Apple and Amazon is true, nor do we know the story behind the story and the reasons for the vehement denials by all the parties involved.
However, a technical assessment of details of the describe implants reveals that a supply chain attack on the hardware is definitely possible, that the capabilities of the BMC can be used to bypass OS protections, and that there are means to access the BMC that would not necessarily generate readily identified network traffic.
In this talk we'll examine the design of a proof of concept SPI bus hardware implant that has similar capabilities to those described in the Bloomberg/Supermicro article as well as some countermeasures that we can use to try to detect these "modchips" and increase our trust in our systems.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="4825">Trammell Hudson</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9614" guid="e8385c89-d33a-42d8-afb6-8ae28fe5c89d">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9614.html</url>
<logo/>
<date>2018-12-27T23:50:00+01:00</date>
<start>23:50</start>
<duration>00:40</duration>
<room>Borg</room>
<slug>35c3-9614-inside_the_amd_microcode_rom</slug>
<title>Inside the AMD Microcode ROM</title>
<subtitle>(Ab)Using AMD Microcode for fun and security</subtitle>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>Microcode runs in most modern CPUs and translates the outer instruction set (e.g. x86) into a simpler form (usually a RISC architecture). It is updatable to fix bugs in the silicon (see Meltdown/Spectre), but these updates are encrypted and signed, so no one knows how microcode works on conventional CPUs. We successfully reverse engineered part of the microde semantics of AMD CPUs and are able to write our own programs. We also recovered the mapping between the physical readout (electron microscope) and the "virtual" addresses used by microcode itself. In this talk we present background on microcode, our findings, our open source framework to write custom microcode and our custom defensive measures implemented in microcode.
</abstract>
<description>We build on our results presented on 34C3 to provide more insight into how microcode works and more details of the microcode ROM itself.
tl;dr diff to last talk:
- Mapped physical readout to virtual addresses, we can now read the microcode implementation of specfic instructions
- More microcode semantics known, more stable programs
- Opensource framework for creating, diassembling and testing microcode on AMD CPUs
- Simple hardware setup to develop microcode programs
- More practical examples of what you can do with microcode, focused on defense instead of offense this time
Since 34C3 we worked on recovering the microcode ROM completely and used that knowledge to implement constructive microcode programs that add to or enhance functionality of the CPU. We also worked on our now open source framework to create and diassemble microcode for AMD CPUs up to 2013. We will give a short intro into how to use it to create custom microcode programs and test them on real hardware. We also provide guidelines on how to construct the test setup we used, which is essentially any old AMD mainboard (native serial port required), a RaspberryPi with a serial adapter and some wiring including a few basic electronic components. Using this you can remotely and automatically test any number of microcode updates and it is integrated in our framework.
On the microcode program side we will show how to hijack microcoded instructions to replace them with new semantics, for example reviving the good-old BOUND x86 instruction. We also show how to roll your own microcode update verification scheme, so only trusted and signed updates can be loaded on vulnerable CPUs.
Additionally we will provide some implementation details found in the microcode ROM and show how it is used to implement complex functions like the instruction WRMSR, which among other functions is used to update the microcode.
We will start with a crash-course covering fundamentals related to instruction decoding, CPU architecture and microcode principles. We will then present our new insights and finish with a demo of how our framework works.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="7652">Benjamin Kollenda</person>
<person id="7984">Philipp Koppe</person>
</persons>
<links>
<link href="https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask">Our 34C3 talk on microcode</link>
<link href="https://www.syssec.rub.de/research/publications/constructive-microcode/">Paper with our new insights, to-be-presented on CCS 2018</link>
<link href="https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/koppe">Original microcode paper and corresponding talk</link>
<link href="https://github.com/RUB-SysSec/Microcode">Github project - to be updated</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/674/original/Microcode35C3.pdf?1545996674">Presentation Slides</attachment>
</attachments>
</event>
</room>
<room name="Clarke">
<event id="9599" guid="e9095f5f-a38a-48da-b3d7-20da141b8b14">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9599.html</url>
<logo>/system/events/logos/000/009/599/large/icon-new.png?1542635567</logo>
<date>2018-12-27T11:30:00+01:00</date>
<start>11:30</start>
<duration>00:40</duration>
<room>Clarke</room>
<slug>35c3-9599-locked_up_science</slug>
<title>Locked up science</title>
<subtitle>Tearing down paywalls in scholarly communication</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>en</language>
<abstract>Restricting access to knowledge and science is not beneficial for society. So why are scientific results still locked up behind paywalls? Even though the answer to this question is enlightening, the story is quickly told. Much more important is the knowledge on how to change this.</abstract>
<description>Politics, research funders, libraries and scientists have to join forces and to push forward to flip scholarly communication from closed to open access. What has happened so far? What are the current developments? What can each of these parties contribute to the transformation of scholarly communication? Open access guidelines, repositories and the hashtag #ICanHazPDF are just a few examples of approaches that jointly undermine the paywalls. One that has been recognized even beyond the scientific community is Project DEAL which aims to achieve open access for scientific publications from German scientists with major academic publishers.
Things are currently progressing very fast and a lot can happen in the weeks between now and the congress. The talk will start with a brief introduction to the most common way of scholarly communication, where science is still mainly locked up behind paywalls. In line with the most recent developments, the talk will then focus on different approaches to open up science and their political and practical consequences. Whatever happens, the transformation of scholarly communication is well underway and it will affect not only the scientific community but society as a whole. So let’s join forces!</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8418">Claudia Frick - @FuzzyLeapfrog</person>
</persons>
<links>
<link href="https://doi.org/10.5281/zenodo.1495601">Slides (DOI)</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/639/original/35c3-FuzzyLeapfrog.pdf?1545913798">Slides</attachment>
</attachments>
</event>
<event id="9513" guid="7177142b-6f15-4fac-af62-c45df7a377a9">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9513.html</url>
<logo/>
<date>2018-12-27T12:30:00+01:00</date>
<start>12:30</start>
<duration>00:40</duration>
<room>Clarke</room>
<slug>35c3-9513-mind_the_trap_die_netzpolitik_der_afd_im_bundestag</slug>
<title>Mind the Trap: Die Netzpolitik der AfD im Bundestag</title>
<subtitle/>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Die AfD-Bundestagsfraktion wird in der Öffentlichkeit vor allem mit ihren rassistischen Positionen wahrgenommen – mit ihren netzpolitischen Aktivitäten bleibt sie zumeist unter dem Radar. Dieser Talk zeigt, wie die AfD-Fraktion die Netzpolitik dennoch als vermeintlich neutrales Thema nutzt, um für ihre rechtsextreme Partei eine parlamentarische und gesellschaftliche Normalisierung herzustellen. </abstract>
<description>Als Mitarbeiterin einer Bundestagsabgeordneten von den Grünen verfolge ich täglich das Verhalten der AfD in netzpolitischen Debatten im Bundestag: Im Plenarsaal, im Ausschuss Digitale Agenda, in der Enquête-Kommission Künstliche Intelligenz und bei Veranstaltungen und Diskussionen mit außerparlamentarischen Organisationen.
Dabei ist mir aufgefallen, dass die netzpolitischen AfD-Abgeordneten in ihrem Verhalten eher einem kooperationsorientierten statt einem krawallorientierten Parlamentariertyp innerhalb ihrer Fraktion zuzuordnen sind. Die inhaltliche Positionierung der AfD wiederum folgt bei verschiedenen netzpolitischen Debatten zumeist einer von drei verschiedenen Strategien: Konsensorientiert, anti-europäisch oder Opfermythos-betonend. Diese Beobachtungen werden mit einer Reihe von Beispielen illustriert.
Bei den netzpolitischen Diskussionen im Bundestag finden die zentralen Auseinandersetzungen zwischen der Großen Koalition und den demokratischen Oppositionsparteien statt. Was die AfD-Fraktion dazu sagt, wird häufig kaum wahrgenommen.
Dieser Talk zeigt, wie die AfD-Fraktion die Netzpolitik dennoch als vermeintlich neutrales Thema nutzt, um für ihre rechtsextreme Partei eine parlamentarische und gesellschaftliche Normalisierung herzustellen. Er belegt dies anhand zahlreicher Beispiele aus dem parlamentarischen Alltag und zeigt auf, wo diese Strategie bereits aufgeht und wo nicht. Deswegen soll es auch darum gehen, wie zivilgesellschaftliche Organisationen und Akteure damit umgehen können, wenn AfD-Abgeordnete in der netzpolitischen Szene auftauchen und vermeintlich sinnvolle netzpolitische Positionen vertreten.</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="4918">Noujoum</person>
</persons>
<links>
<link href="https://seyborg.de/">Blog</link>
</links>
<attachments/>
</event>
<event id="9561" guid="4cc5cf9a-214f-4e7d-991f-199e9f0db8cc">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9561.html</url>
<logo/>
<date>2018-12-27T13:30:00+01:00</date>
<start>13:30</start>
<duration>00:40</duration>
<room>Clarke</room>
<slug>35c3-9561-first_sednit_uefi_rootkit_unveiled</slug>
<title>First Sednit UEFI Rootkit Unveiled</title>
<subtitle/>
<track>Security</track>
<type>lecture</type>
<language>en</language>
<abstract>UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level. Our talk will reveal such a campaign successfully executed by the Sednit group. We will detail the full infection chain showing how Sednit was able to install their custom UEFI module on key targets' computers. Additionally, we will provide an in-depth analysis of their UEFI module and the associated trojanized LoJack agent.</abstract>
<description>UEFI rootkits have been researched and discussed heavily in the past few years, but sparse evidence has been presented of real campaigns actively trying to compromise systems at this level. Our talk will reveal such a campaign successfully executed by the Sednit group. This APT group, also known as Fancy Bear, Sofacy and APT28, has been linked to numerous high profile cyberattacks such as the 2016 Democratic National Committee email leak scandal.
Earlier this year, there was a public report stating that the infamous Sednit/Sofacy/APT28 APT group successfully trojanized a userland LoJack agent and used it against their targets. LoJack, an embedded anti-theft application, was scrutinized by security researchers in the past because of its unusual persistence method: a module preinstalled in many computers' UEFI/BIOS software. Over the years, several security risks have been found in this product, but no significant in-the-wild activity was ever reported until the discovery of the Sednit group leveraging some of the vulnerabilities affecting the userland agent. However, through our research, we now know that Sednit did not stop there: they also tried to, and succeeded, in installing a custom UEFI module directly into a system's SPI flash memory.
In this talk, we will detail the full infection chain showing how Sednit was able to install their custom UEFI module on key targets' computers. Additionally, we will provide an in-depth analysis of their UEFI module and the associated trojanized LoJack agent.
</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8388">Frédéric Vachon</person>
</persons>
<links>
<link href="https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf">LOJAX: First UEFI rootkit found in the wild, courtesy of the Sednit group (white paper)</link>
</links>
<attachments>
<attachment href="/system/event_attachments/attachments/000/003/638/original/35C3-First-Sednit-UEFI-Rootkit-Unveiled.pdf?1545904527">Slides</attachment>
</attachments>
</event>
<event id="9809" guid="1601bf3b-ce4a-44c9-993f-7d28fa65168d">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9809.html</url>
<logo/>
<date>2018-12-27T14:30:00+01:00</date>
<start>14:30</start>
<duration>00:40</duration>
<room>Clarke</room>
<slug>35c3-9809-datenschutz_fur_neulandburger</slug>
<title>Datenschutz für Neulandbürger</title>
<subtitle/>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Der Datenschutz ist als erst relativ frisch erkämpftes Abwehrrecht von Bürgern gegen Firmen und Staat ein wichtiges, aber häufig missverstandenes Rechtsgebiet. Zuletzt ist es durch die Grundverordnung auf europäischer Ebene in den Blick der Netzöffentlichkeit geraten.
Dieser Vortrag soll einen niedrigschwelligen Einstieg in den Datenschutz geben und aus Perspektive einer Datenschützerin mit zehnjähriger Erfahrung im Gebiet die aufregenden Aspekte und Herausforderungen aufzeigen, dem Bürgerrecht Leben einzuhauchen.</abstract>
<description>Ziele des Vortrags (wird noch zum Volltext ausgearbeitet)
* Eingrenzen des Rechtsgebiets
* Beleuchten der Geschichte, Kontrast zu anderen "Geheimnis-Schutz"-Rechten
* positive Auswirkungen auf den Bürger seit Kodifizierung durch BVerfG und Hessischem Datenschutzgesetz
(angebliche) negative Auswirkungen auf Sicherheit, Strafverfolgung und Wirtschaftlichkeit
* jüngste Neuerungen seit DSGVO
* tatsächliche Auswirkungen der DSGVO auf bestehende Infrastruktur ("Blogsterben", "war vorher schon illegal")
* Mythos Datenschutzerklärung
* Wie sieht unsere Lieblings-Datenschutzerklärung aus?
* Ausblicke auf weitere Initiativen</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="6784">Beata Hubrig</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9923" guid="5b947f86-8ba1-4b99-adbe-7c5030deea0c">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9923.html</url>
<logo/>
<date>2018-12-27T16:10:00+01:00</date>
<start>16:10</start>
<duration>01:00</duration>
<room>Clarke</room>
<slug>35c3-9923-space_ops_101</slug>
<title>Space Ops 101</title>
<subtitle>An introduction to Spacecraft Operations</subtitle>
<track>Science</track>
<type>lecture</type>
<language>en</language>
<abstract>After launching a spacecraft into orbit the actual work for mission control starts. Besides taking care of the position and speed of the spacecraft this includes e.g. detailed modeling of the power usage, planning of ground station contacts, payload operations and dealing with unexpected anomalies. In this talk we will see many examples of problems particular to space crafts and how they influence the way space craft mission operations works.</abstract>
<description><p>Suppose you built your own satellite and somehow managed to launch it into space, what are you going to do next? Can you just ssh into your onboard computer and try out a couple of things to take a picture of earth and download the file? Did you just lose contact with your satellite due to an empty battery, because it heated up too much or because it rotated in the wrong direction? What are other issues you might forget to account for?</p>
<p>After understanding why in spacecraft operations nothing works the way one expects we will have some answers to these questions. Also we will see how these problems are nowadays tackled by mission control centers all over the world, what happens in emergencies, what FDS, GDS, LEOP and TTC stand for and why spacecraft operators worry so much about weird particularities of time systems. Everything will be illustrated by real-life examples.</p>
<p>The only prerequisite for this talk is that you know that earth is not flat!</p></description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8640">sven</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9508" guid="385ac419-50f5-49b5-b571-701691d2734f">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9508.html</url>
<logo>/system/events/logos/000/009/508/large/Screenshot_2018-12-09_21-08-08.png?1544386150</logo>
<date>2018-12-27T17:30:00+01:00</date>
<start>17:30</start>
<duration>01:00</duration>
<room>Clarke</room>
<slug>35c3-9508-digital_airwaves</slug>
<title>Digital Airwaves</title>
<subtitle>Software Defined Radio Basics and some Modulation Theory </subtitle>
<track>Hardware & Making</track>
<type>lecture</type>
<language>en</language>
<abstract>Encoding or decoding random radio-waveforms doesn't need incredible expensive hardware anymore which offers new possibilities for building up over-the-air communication systems. There are Software Defined Radios providing affordable cellular radio to remote villages, Community Radios are using SDR to build up digital radio networks and other cool stuff.
Some basic knowledge what is going on in SDR Hard/Software as the influence of the samplerate, I/Q-data of the math behind the waterfall-diagram is helpful to have fun with SDR. Some theory on modulation techniques helps you to decode or encode your waveforms. </abstract>
<description>With a cheap DVB-T USB receiver used with some SDR-Software you can already have a look whats going on in the airwaves around you at certain frequencies. But what happens between the antenna and your computer display showing or decoding the signal? The talk should give basic information and background about SDR and some modulation theory.
There will probably be a SDR Challenge at the Congress to practice you new skills. </description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="5073">Friederike</person>
</persons>
<links/>
<attachments/>
</event>
<event id="9372" guid="eff16504-08ce-4de0-bf44-d877d286aac9">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9372.html</url>
<logo>/system/events/logos/000/009/372/large/edri_logo.png?1536831004</logo>
<date>2018-12-27T18:50:00+01:00</date>
<start>18:50</start>
<duration>01:00</duration>
<room>Clarke</room>
<slug>35c3-9372-citzens_or_subjects_the_battle_to_control_our_bodies_speech_and_communications</slug>
<title>Citzens or subjects? The battle to control our bodies, speech and communications</title>
<subtitle>A call to action to defend our ePrivacy and eliminate upload filters</subtitle>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>en</language>
<abstract>Technology is the solution: What is the problem? This seems to be the motto. Algorithms may be about to control our free speech while tracking technologies could control our bodies and communications. Will we react or stay quiet?</abstract>
<description>Technology is the solution: What is the problem? This seems to be the motto. Whether it is about preventing the dissemination of terrorist content or to prevent copyright infringements the solution from the legislator is upload filters.
While content is controlled by algorithms, devices need to be under scrutiny. That is why confidentiality of communications needs to be secured now too.
We have little time to stop these threats from becoming a reality, but we have most citizens on our side and the EU elections near. We still can and have to win this battle. Otherwise, once filters are put for copyright or terrorist content, they will be used for anything else. And if software and hardware does not defend our privacy by design and by default, 24/7 surveillance will be the new "normal".</description>
<recording>
<license/>
<optout>false</optout>
</recording>
<persons>
<person id="8131">Diego Naranjo (EDRi)</person>
<person id="8770">Andreea Belu (EDRi)</person>
</persons>
<links>
<link href="https://edri.org/press-release-eu-parliament-flip-flops-backwards-on-copyright/">EDRi's analysis on the adoption of upload filters</link>
<link href="https://www.eff.org/deeplinks/2018/09/today-europe-lost-internet-now-we-fight-back">EFF analysis of upload filters in the EU</link>
</links>
<attachments/>
</event>
<event id="9358" guid="a9c0c28c-4f40-4d06-99da-d73fbb2655c4">
<url>https://fahrplan.events.ccc.de/congress/2018/Fahrplan/events/9358.html</url>
<logo>/system/events/logos/000/009/358/large/Wikipedia_ZDF.gif?1536738413</logo>
<date>2018-12-27T20:50:00+01:00</date>
<start>20:50</start>
<duration>01:00</duration>
<room>Clarke</room>
<slug>35c3-9358-chaos_im_fernsehrat</slug>
<title>Chaos im Fernsehrat</title>
<subtitle/>
<track>Ethics, Society & Politics</track>
<type>lecture</type>
<language>de</language>
<abstract>Seit Juli 2016 darf ich – nominiert unter anderem vom CCC – den Bereich "Internet" im Fernsehrat des ZDF vertreten. Nach gut zwei Jahren ist es Zeit für eine Zwischenbilanz: Was macht ein Fernsehrat, was machen öffentlich-rechtliche Angebote im Netz, und was sollten sie eigentlich tun? </abstract>
<description><blockquote>Der Fernsehrat vertritt die Interessen der Allgemeinheit gegenüber dem ZDF. Deshalb ist er kein Expertengremium, sondern so vielfältig wie die Gesellschaft selbst. Seine Mitglieder werden von unterschiedlichen gesellschaftlichen Gruppen entsandt. Der Fernsehrat tagt öffentlich. Sowohl die Tagesordnung als auch die Zusammenfassungen der wesentlichen Ergebnisse der Sitzungen werden im Internet veröffentlicht.</blockquote>
So beschreibt sich der ZDF-Fernsehrat auf seiner Webseite selbst. Nach einem Urteil des Bundesverfassungsgerichts im Jahr 2014 mussten die Länder den ZDF-Staatsvertrag neu formulieren, der Fernsehrat ist deshalb seit Juli 2016 neu zusammengesetzt. Nur noch maximal 20 von 60 Mitgliedern dürfen aktive Politiker sein, der Rest soll verschiedene gesellschaftliche Gruppen repräsentieren. Neu hinzu kamen im Zuge der Neuordnung Vertreter, die von den Ländern – in der Regel auf Vorschlag von Vereinen oder Verbänden – für Bereiche wie Minderheiten, Menschen mit Behinderung, Digitales oder LGBTQI nominiert werden.