Security Of Railway Communication Protocols
Katja Assaf
The railway communication network looks different from your standard corporate IT. Its hardware, software and protocols have many peculiarities since it is an old, distributed, fragmented and highly standardised system. This creates problems when trying to introduce state-of-the-art IT security, and then there is the mindset: "But we always have done it this way!"
Donncha Ó Cearbhaill
Ever evolving mercenary spyware continues to threaten the safety of activists, journalist and human rights defenders around the world. Following the exposure of the Pegasus spyware scandal, this talk will be a technical deep dive into the tactics and techniques sold by the European-based spyware alliance Intellexa, which is used by governments to infect the devices and infrastructure we all depend on.
Advanced QEMU-based fuzzing
Addison Crump, andreafioraldi, domenukk, Dongjia Zhang, van Hauser
The maintainers of the AFLplusplus open-source project show crazy new ways to (ab)use QEMU to explore difficult, binary-only targets through fuzzing. We present a proof of concept using LibAFL\_qemu to find command and SQL-injections, going beyond the classic fuzzing for memory corruption. We also showcase how to build a custom fuzzer to test Android libraries without using a phone.
The cybersecurity dark side of solar energy when clouds are involved
Sebastien
In this talk we will have a look at some cybersecurity challenges raised by the trend of decentralizing our energy production. Our energy infrastructure is now changing from a centralized system based on big power plants to a more decentralized system based on renewable energy produced by smaller power plants (maybe yours). In Germany alone, [300.000 so called balcony power plants were in operation by August 2023](https://www.heise.de/hintergrund/Ueber-300-000-Balkonkraftwerke-in-Deutschland-in-Betrieb-Statistik-der-Woche-9285107.html). Most of these smaller power plants are / will be somehow connected to some cloud services. To show that security hasn't been the biggest priority, we will examine the cybersecurity controls of different solar inverters. To put it mildly: there is room for improvement. We will also discuss the need for better regulations and enforcement of cybersecurity for smaller connected power plants: altogether they probably produce more power than the bigger ones - and this trend is accelerating. Protecting our infrastructure shall have - today more than ever before - a high priority.
Finishing off the Nintendo DSi
PoroCYon
Over the years, many talks about console jailbreaks have been presented at CCC. However, one console has been left overlooked: the Nintendo DSi. It didn't see any serious hacks in its active lifetime, the ones that eventually appeared aren't completely satisfactory, and several components (such as its boot ROMs) were left untouched. In this presentation, we rectify the situation, explain how to extract the boot ROMs, and demonstrate new jailbreaks that can take over the console at an even deeper level. As a bonus, this work makes it possible to revive consoles with worn-out eMMC NAND chips.
Aarch64 binary rewriting adventures but mostly pains
@cyanpencil (Luca Di Bartolomeo)
A talk on the first heuristic-free static binary rewriter for aarch64. Why is it the first? Because everyone else already knew how much of a bad idea this would have been.
Breaking and fixing the Bluetooth standard. One More Time.
Daniele Antonioli
Ciao! We present the BLUFFS attacks (CVE-2023-24023), six novel attacks breaking Bluetooth's forward and future secrecy. Our attacks enable device impersonation and machine-in-the-middle across sessions by compromising and re-using one session key. We discuss the four vulnerabilities in the Bluetooth specification enabling the attacks, two of which are new and related to unilateral and repeatable session key derivation. We describe the toolkit we developed and open-sourced to test our attacks via firmware binary patching, our experiments where we exploited 18 heterogeneous Bluetooth devices, and the practical and backward-compliant session key derivation protocol we built to fix the attacks by design. We also cover related work like KNOB, BIAS, and BLUR, and educational Bluetooth security tips and tricks.
Ben H
A walkthrough of the assembly code idioms the Rust compiler uses to implement the language’s core features (as they appear in Klabnik’s and Nichols’ “The Rust Programming Language”) - starting with simple match expressions and all the way to monomorphized functions and iterator chains.