Schedule

Schedule




















 

Day 4
09:00

09:30

10:00

10:30

11:00

11:30

12:00

12:30

13:00

13:30

14:00

14:30

15:00

15:30

16:00

16:30

17:00

17:30

18:00

18:30
From Simulation to Tenant Takeover (en)

Vaisha Bernard

All I wanted was for Microsoft to deliver my phishing simulation. This journey took me from discovering trivial vulnerabilities in Microsoft's Attack Simulation platform, to a Chinese company to which Microsoft outsourced its support department that wanted all my access tokens. I finally ended up hijacking remote PowerShell sessions and obtaining all data from random Microsoft 365 tenants, all the while reeling in bug bounties along the way.

Ten Years of Rowhammer: A Retrospect (and Path to the Future) (en)

Daniel Gruss, Martin Heckel, Florian Adamsky

The density of memory cells in modern DRAM is so high that disturbance errors, like the Rowhammer effect, have become quite frequent. An attacker can exploit Rowhammer to flip bits in inaccessible memory locations by reading the contents of nearby accessible memory rows. Since its discovery in 2014, we have seen a cat-and-mouse security game with a continuous stream of new attacks and new defenses. Now, in 2024, exactly 10 years after Rowhammer was discovered, it is time to look back and reflect on the progress we have made and give an outlook on the future. Additionally, we will present an open-source framework to check if your system is vulnerable to Rowhammer.

All Brains are Beautiful! – The Biology of Neurodiversity (en)

Marcello

How do you think? People can experience thoughts, feelings, and sensory inputs very differently. While context and substances are known to promote changes in perception and thinking, the biological basis is very diverse, contrary to what is often assumed. Brain cells come in extraordinary varieties in size, shape, and complexity. Their synaptic connectivity provides the foundation of all our sensory input, motor output, cognitive functions, and thoughts. In short: They shape us. This talk gives an introduction about the extent of variability in neuronal patterns that underlies neurodiversity and critically discusses the idea of neurodivergence, diagnosis criteria in Autism and ADHD from a biological and first person-perspective. We find that biological variability of brains is an evolutionary feature that helps us to adapt to our environment but comes with certain risks and downsides in our modern society. While many things are still unknown, scientists have identified genes and environmental impacts that shape our network architecture during brain development and which help to explain why we think and experience the world so differently.

identity theft, credit card fraud and cloaking services – how state-sponsored propaganda makes use of the cyber criminal toolbox (en)

Alexej Hock, Max Bernhard

The Russian disinformation campaign Doppelgänger is considered to be technically highly sophisticated. Research by CORRECTIV and Qurium has revealed that the Russian state relies on the toolbox of internet fraudsters for the dissemination of propaganda and fakes. A talk on the state's possible alliance with the criminal world - and on possibilities and limitations of countering it.

Find My * 101 (en)

Henryk Plötz

I'll introduce the technology underlying bluetooth trackers from Apple and Google, and will describe and show what can actually be seen on the air (using a hackrf/rad1o for example). This is part demonstration of what is possible right now, part explanation of the underlying principles, and part invitation to would-be hackers to make creative use of this technology.

Security Nightmares (de)

Ron, Constanze Kurz

Der IT-Sicherheitsalptraum-Rück­blick: Manchmal belustigend, zuweilen beunruhigend, aber mit Ausblick.

38C3: Return to legal constructions (en)

Gabriela Bogk, Senficon, Aline Blankertz

Let's join in a quiet moment to bid farewell to the chaotic wonderland that has been 38C3 and prepare ourselves for the harsh reality outside.

Dude, Where's My Crypto? - Real World Impact of Weak Cryptocurrency Keys (en)

sather

We present Milksad, our research on a class of vulnerabilities that exposed over a billion dollars worth of cryptocurrency to anyone willing to 'crunch the numbers'. The fatal flaw? Not enough chaos. Learn how we found and disclosed issues in affected open source wallet software, brute-forced thousands of individual affected wallets on a budget, and traced over a billion US dollars worth of prior transactions through them.

Is Green Methanol the missing piece for the Energy Transition? (en)

Hanno Böck

In an accelerating climate crisis, renewable energy and electrification are the most important tools to reduce greenhouse gas emissions. However, in sectors where electrification is infeasible or impossible, other solutions will be needed. While hydrogen gets a lot of attention, it suffers from challenges like being difficult to transport and store. While it does not receive nearly as much attention as hydrogen, another molecule, methanol, could play a crucial role in bringing down emissions in challenging sectors like shipping, aviation, or the chemical industry.

Going Long! Sending weird signals over long haul optical networks (en)

Ben Cartwright-Cox

Computer network operators depend on optical transmission everywhere as it is what glues together our interconnected world. But most of the industry is running the same kinds of signals down the optical transceivers. As part of my need to "Trust, but verify" I wanted to check my assumptions on how the business end of modern optical modules worked, so join me in a adventure of sending weird signals many kilometres, and maybe set some records for the most wasteful bandwidth utilisation of optical spectrum in 2024!

Microbes vs. Mars: A Hacker's Guide to Finding Alien Life (en)

Anouk Ehreiser

Mars is famously the only planet (we know of) that is entirely inhabited by robots. And these robots are working hard on looking for something that would be one of the most significant discoveries in the history of science: Alien life. But how do you look for something that no one has ever seen? And would we recognize it if we find it? Join me on a journey through Mars’ ancient past and Earth’s most extreme environments, where scientists hunt for strange microbes that defy all our expectations: Organisms thriving in salt lakes, breathing metal, and building bizarre microbial ‘cities’ out of rock. Are they the blueprint of what alien life might look like? I will introduce you to the cutting-edge technology we use to analyse and understand them, and how we detect their “biological fingerprints” that might one day help us to find Martian life. This talk will not only give you a deep look behind the scenes of the search for life on Mars, but also a new appreciation for the strange and wonderful life on our own planet.

Von Ionen zu Daten: Die Funktionsweise und Relevanz von (Quadrupol-)Massenspektrometern (de)

Sally

Massenspektrometer sind unverzichtbare Analysewerkzeuge in der Chemie und zudem hochinteressante und verblüffende Instrumente. In diesem Talk wird die Massenspektrometrie mit Schwerpunkt auf Quadrupolmassenspektrometer anschaulich vorgestellt.

Philosophical, Ethical and Legal Aspects of Brain-Computer Interfaces (en)

Christoph Bublitz

This talk examines philosophical, legal, and ethical questions of the merging of human minds with intelligent machines through Brain-Computer-Interfaces, provides an overview of current debates and international regulatory development - and what might be at stake when technologies increasingly access the human brain.

38C3: Infrastructure Review (en)

nicoduck

This talks gives a behind the scenes on how the infrastructure side of the event is done.

Longtermismus – der „Geist“ des digitalen Kapitalismus (de)

Max Franz Johann Schnetker

Der Vortrag wirft einen sozialwissenschaftlichen Blick auf die Ideologie des Longtermismus. Seine Funktion im digitalen Kapitalismus wird analysiert. Mithilfe von Klassikern der Soziologie wird dargestellt, warum sich diese Ideologie in eine faschistische Richtung entwickelt.

Moving with feelings: Behind the scenes of a one man show mobile & fiber operator in Spain (en)

Edgar Saumell Oechsle

How to run an MVNO with values: What are the requirements? Do you need a government license, maybe a lot of investment? There are different types of MVNOs. We will talk about how to do business as an MVNO while respecting users' privacy, supporting free software, believing in the right to repair and making your customers technologically sovereign.

GLAM zwischen LOD und ¯\_(ツ)_/¯. Museumskritik für Hacker*innen (de)

Lukas Fuchsgruber

Habt ihr euch immer schon gefragt wie Museumssammlungen ins Netz kommen, warum online Sammlungen meist immer noch aussehen wie Kataloge seit dem 19. Jahrhundert, was für Strategien und Förderprogramme dahinter stecken, welche Firmen hier quasi-Monopole haben, und warum Museen so viele Hoffnungen (Zugang! Partizipation! Demokratie!) mit der Digitalisierung verbinden? Der Talk ist eine Einladung an Hacker*innen sich an der kritischen Weiterentwicklung, Öffnung und Reflexion von Museen zu beteiligen.

From Convenience to Contagion: The Libarchive Vulnerabilities Lurking in Windows 11 (en)

NiNi Chen

In the October 2023 update, Windows 11 introduced support for 11 additional compression formats, including RAR and 7z, allowing users to manage these types of files natively within File Explorer. The enhancement significantly improves convenience; however, it also introduces potential security risks. To support these various compression formats, Windows 11 utilizes the libarchive library, a well-established open-source library used across multiple operating systems like Linux, BSD, and macOS, and in major projects such as ClickHouse, Homebrew, and Osquery. The libarchive has been continuously fuzzed by Google’s OSS-Fuzz project, making it a time-tested library. However, its coverage in OSS-Fuzz has been less than ideal. In addition to the two remote code execution (RCE) vulnerabilities disclosed by Microsoft Offensive Research & Security Engineering (MORSE) in January, we have identified several vulnerabilities in libarchive through code review and fuzzing. These include a heap buffer overflow vulnerability in the RAR decompression and arbitrary file write and delete vulnerabilities due to insufficient checks of libarchive’s output on Windows. Additionally, in our presentation, we will reveal several interesting features that emerged from the integration of libarchive with Windows. And whenever vulnerabilities are discovered in widely-used libraries like libarchive, their risks often permeate every corner, making it difficult to estimate the potential hazards. Moreover, when Microsoft patches Windows, the corresponding fixes are not immediately merged into libarchive. This delay gives attackers the opportunity to exploit other projects using libarchive. For example, the vulnerabilities patched by Microsoft in January were not merged into libarchive until May, leaving countless applications exposed to risk for four months. The worst part is that the developers might not know the vulnerability details or even be aware of its existence. To illustrate this situation, we will use the vulnerabilities we reported to ClickHouse as an example to demonstrate how attackers can exploit the vulnerabilities while libarchive remains unpatched.

corebooting Intel-based systems (en)

aprl, elly

Gaining a reasonable level of trust on the firmware that runs your everyday activities

Mit OpenType ein X für ein U vormachen (de)

Martin Braun

In OpenType-Fonts stecken nicht nur Buchstaben, sondern auch Logik – und die kann man hacken.

Blackscreen im Kopf – Leben mit Afantiasie (de)

Martin Braun

Afantasie bedeutet, kein bildliches Vorstellungsvermögen zu besitzen. Bilder im Kopf zu haben ist für die meisten selbstverständlich, dem Vortragenden jedoch fremd. Erst vor kurzem hat er von diesem Unterschied erfahren und möchte nun seine Erfahrungen mitteilen.

Resource Consumption of AI - Degrow or Die (en)

Thomas Fricke

Not only the energy consumption of AI is exploding. Less known is that other resources like water or metal are also affected. The talk gives an overview on the devastating impact of datacenters on our environment. Degrowth scenarios seem to be the only way to escape from this ecological nightmare.

Small seeds - why funding new ideas matters (en)

Marie Kreil, Marie-Lena Wiese

More money for Free and Open Source Software - a never ending issue. In a tech world built on start-ups, venture capital and data-gathering apps, the fight for sustainable funding for ethical technology projects is a fierce one. After some big victories for FOSS funding in the last years, this talk is about the importance of not forgetting the small, underdog civil society projects.

Observability is just Contextualized Monitoring. Change my mind. (en)

Obsidian (he/him)

The infrastructure industry has recently started co-opting a well-established software engineering practice and is doing so badly. Observability is being overhyped as something revolutionary that you can only practice using the latest new shiny tool. Real observability provides insight only when we take the time to understand what we’re monitoring, why it matters to our organization, and how each metric connects to our goals. This talk critiques the tool-centric approach that has taken over infrastructure monitoring, encouraging infrastructure teams to step out of their offices, touch grass, and talk with their organizations to answer the essential question: What is it you want monitored anyway and why? We’ll explore the power of applying observability as a practice, not just a product, and highlight F/L/OSS tools that offer powerful, adaptable solutions without the hype. If you’re tired of replacing one flashy dashboard with the next, or if you’ve ever wondered whether observability is really the game-changer it’s made out to be, this talk is for you. Let’s take a cue from our software engineering friends and approach observability as a collaborative, cross-functional practice that builds on strategy rather than the next tool.

Wie man auch mit FOSS Katastrophen-Warnungen bekommt (de)

Nucleus, Volker Krause

Wetter- und Notfallwarnungen empfangen zu können kann Leben retten. Nutzende, die ihre Privatsphäre nicht Google oder Apple ausliefern möchten sollten dabei nicht im Nachteil sein. Wir berichten über den aktuellen Stand der FOSS Entwicklung und allerlei Beobachtungen rund um Notfallwarnungen.

Stadt.Land.Klima! - Für Transparenz im Kommunalen Klimaschutz (de)

Lukas (@strategielukas)

Kommunaler Klimaschutz ist oft undurchsichtig, komplex und bürokratisch – das wollen wir ändern! Als gemeinsames bewegungsübergreifendes Projekt "Stadt.Land.Klima!" machen wir (fehlenden) kommunalen Klimaschutz sichtbar, messbar & verständlich! Mit einem einheitlichen Maßnahmenkatalog können alle klimainteressierten Menschen den Fortschritt ihrer Stadt oder Gemeinde bewerten und in unserem Ranking sichtbar machen: https://www.stadt-land-klima.de/municipalities Darüber hinaus möchten wir die vielen verschiedenen lokalen Akteure der Klimagerechtigkeitsbewegung in den einzelnen Kommunen zusammenbringen, Kooperationen fördern und Erfolgsprojekte einzelner Gruppen deutschlandweit teilen!

Computing Genomes & what that has to do with privacy (en)

Polaris

What does it take to get a Genome into the computer? A slightly technical, political and personal dive into the field of genomics.

Basics of software publication (en)

Carina Haupt

You want to share your code with the world. That's great! But how? Just uploading it to Github? Or how do I do this? In this talk I want to give you an overview about the minimal steps you should take to prepare your code for publication. Covering what belongs into a repository, how to make your code sharable and which license to pick.

What's inside my train ticket? (en)

TheEnbyperor (it/its)

Ever wondered what data is stored inside DB print-at-home train tickets or those in your local transport association's app? Join me for the deep dive into digital railway ticketing you didn't know you needed.

Lokalnews-Mining (de)

Alexton

Ihr wolltet schon immer wissen was der „Morgenthau-Plan“ mit Kreisverkehren und „Schönwetterfreizeitsportgeräten“ zu tun hat? Dann lasst mich euch mitnehmen in die wundersamen, obskuren und humoristisch wertvollen Untiefen eines lokalen Nachrichtenportals. Was kann die interessierte Beobachterin von außen über das System lernen? Welche Werkzeuge brauchen wir für diese Expedition? Welche Kreaturen der Nacht kriechen durch die Untiefen der anonymen Kommentarfunktion? Und kann man eigentlich auch etwas Schönes aus den Daten machen, die da täglich ins Netz gekippt werden?

Everyone VS. MP3 - Audio Datei-Formate für DJs und co. (de)

function

Dieser Talk deckt die Fundamentals zu Samplingrate, Bitdepth und Bitrate ab und erklärt die Stärken und Schwächen aller Audio Datei-Formate, die für DJs und Produzent/innen relevant sind: MP3, AAC, FLAC, WAV, AIFF und vielleicht noch mehr.

Rekordbox, gib mir meine Daten! - Überblick von Datenzugriff in DJ Software & Hardware (de)

function

Wir Hackende müssen eine große Gefahr für unsere eigenen Daten sein, wenn die Hersteller die Maßnahmen ergreifen, die ich euch in diesem Talk unter Anderem vorstelle. Wie bekomme ich Daten aus DJ-Systemen und vielleicht auch wieder hinein?

Hack the Beat: Opensource DJ Workshop! (en)

Brett Preston

DJ workshop using open-source software: Mixxx. The workshop is aimed at a beginner level audience with no or minimal DJ-ing or music creation experience. We will present the basic theory and tools sufficient to start the journey of DJ-ing for everyone with the use of opensource software, free content, and explanations of all the components necessary. Later we will go over more advanced techniques.

MIMIZAN (de)

ostend, Leipzig https://soundcloud.com/mimi_zan

Pet View (en)

DLVR

"Pet View" – the ultimate feline symphony! This band has made it their mission to bring the soundscape of cats into the spotlight. Sampling purrs, hisses, and, of course, the iconic meow, they create musical masterpieces that not only captivate human listeners but also get cats grooving worldwide. Their hit single, Purrfect Beats, makes every bowl of kibble a party, while Feline Frequency resonates with everyone from Tom the tabby to Grandma Lisa’s Persian. Their live shows? An absolute cat-tastic experience! Laser pointers, fur costumes, and scratching posts as stage props guarantee a performance that will leave everything meowing for more. Warning: Purring is mandatory at concerts. 🐾🎶 https://www.simonweckert.com/petview.html https://www.simonweckert.com/img/petview/pet-view-4x4.mp4

Vegan Chaos: Farewell Meeting (de, en)

ganzesaetze (he/him)

Heute brechen wir die Zelte ab. Wir treffen uns als vegane Hacktivist:innen und Wesen mit Interesse an Tierrechten und nachhaltiger Entwicklung zum Farewell Meeting – um gemeinsam das Erlebte Revue passieren zu lassen und konkrete Absprachen zu treffen: Wie setzen wir die Organisierung der Vegan Chaos Community fort, was sind die nächsten Ideen, Pläne und Projekte?

Anti-Longtermistische Vernetzung (de)

MSchnetker

Vernetzungs-Meetup für alle, die Longtermismus und verwandte Ideologien wie Transhumanismus kritisch sehen. Offener Austausch zu diesen Ideologien, Vernetzung für Arbeit dazu über den Kongress hinaus.

Museum hacker meetup (en)

HouseOfTea

Tea drinking and exchange about data politics in museums and how we could critically engage with them

Post-Congress Blues (en)

AdeptVeritatis

Let's talk about our own experiences with post-congress blues.

To the last drop! Hold that tear(-down)... (en)

HouseOfTea

Come and join us for a last teapot, a last cup and a last drop! We will stay cozy together until the very last minute of the Congress, so no need to stress out. The second the closing event finishes, signaling the official beginning of the tear down, you are free to stay and help us out (we should even have a plan, this time! ;)) ). With no constraint, no stress, and just out of the sheer joy of being together, things should be folded back in no time... until 39C3. We shall also maybe have an occasion to discuss together how the House of Tea experience went that year, what it meant for everyone, and how it could be improved until next time. <3

Archived page - Impressum/Datenschutz