Conference 39th Chaos Communications Congress

One

Constanze Kurz, khaleesi, Matthias Marx, Linus Neumann, erdgeist

Das war nicht das Jahr 2025, das wir bestellt hatten.

Verlorene Domains, offene Türen - Was alte Behördendomains verraten (de)

Tim Philipp Schäfers (TPS)

Was passiert, wenn staatliche Domains auslaufen - und plötzlich jemand anderes sie besitzt? In diesem Vortrag wird berichtet, wie mehrere ehemals offizielle, aber unregistrierte Domains deutscher Bundesministerien und Behörden erworben werden konnten - und welche Datenströme dadurch sichtbar wurden. Über Monate hinweg konnten so DNS-Anfragen aus Netzen des Bundes empfangen werden - ein erhebliches Sicherheitsrisiko. Unter anderem da es so möglich war Accounts zu übernehmen, Validierungen von E-Mailsignaturen zu manipulieren, Anfrage umzuleiten und im Extremfall Code auf Systemen auszuführen. (Keine sensiblen Daten werden veröffentlicht; der Fokus liegt auf Forschung, Aufklärung und verantwortungsvollem Umgang mit den Ergebnissen.)

Don’t look up: There are sensitive internal links in the clear on GEO satellites (en)

Nadia Heninger, Annie Dai

We pointed a commercial-off-the-shelf satellite dish at the sky and examined all of the geostationary satellite communications visible from our vantage point. A shockingly large amount of sensitive traffic is being broadcast unencrypted, including critical infrastructure, internal corporate and government communications, private citizens’ voice calls and SMS, and consumer Internet traffic from in-flight wifi and mobile networks.

Zero

How To Minimize Bugs in Cryptography Code (en)

Jade

"Don't roll your own crypto" is an often-repeated aphorism. It's good advice -- but then how does any cryptography get made? Writers of cryptography code like myself write code with bugs just like anyone else, so how do we take precautions against our own mistakes? In this talk, I will give a peek into the cryptographer's toolbox of advanced techniques to avoid bugs: targeted testing, model checking, mathematical proof assistants, information-flow analysis, and more. None of these techniques is a magic silver bullet, but they can help find flaws in reasoning about tricky corner cases in low-level code or prove that higher-level designs are sound, given a defined set of assumptions. We'll go over some examples and try to give a high-level feel for different workflows that create "high-assurance" code. Whether you know it or not, you use this type of cryptography code every day: in your browser, your messaging apps, and your favorite programming language standard libraries.

When Vibe Scammers Met Vibe Hackers: Pwning PhaaS with Their Own Weapons (en)

Chiao-Lin Yu (Steven Meow)

What happens when AI-powered criminals meet AI-powered hunters? A technical arms race where both sides are vibing their way through exploitation—and the backdoors write themselves. In October 2025, we investigated Taiwan's fake delivery scam ecosystem targeting convenience store customers. What started as social engineering on social media became a deep dive into two distinct fraud platforms—both bearing the unmistakable fingerprints of AI-generated code. Their developers left more than just bugs: authentication flaws, file management oversights, and database implementations that screamed "I asked LLM and deployed without reading." We turned their sloppiness into weaponized OSINT. Through strategic reconnaissance, careful database analysis, and meticulous operational security, we achieved complete system access on multiple fraud infrastructures. By analyzing server artifacts and certificate patterns, we mapped 100+ active domains and extracted evidence linking thousands of victim transactions worth millions of euros in fraud. But here's the twist: we used the same AI tools they did, just with better prompts. The takeaway isn't just about hunting scammers—it's about the collapse of the skill gap in both offense and defense. When vibe coding meets vibe hacking, the underground economy democratizes in ways we never anticipated. We'll share our methodology for fingerprinting AI-assisted crime infrastructure, discuss the ethical boundaries of counter-operations, and demonstrate how to build sustainable threat intelligence pipelines when your adversary can redeploy in 5 minutes. This talk proves that in 2025, the real exploit isn't zero-day—it's zero-understanding.

The Small Packet of Bits That Can Save (or Destabilize) a City (en)

Manuel Rábade

The Emergency Alert System (EAS) and its SAME (Specific Area Message Encoding) protocol are public alerting technologies that broadcast short digital bursts over VHF triggering emergency messages on millions of receivers across North America. In Mexico, this technology was integrated into the Seismic Alert System (SASMEX) which more than 30 million people in the central part of the country rely on to prepare for frequent earthquakes. While new alerting technologies have emerged, the EAS-SAME network continues to play an important role for public safety in the U.S., Mexico, and Canada. Yet, the same small packets of bits that can help protect a city could also, in the wrong hands, destabilize it. This talk examines how these systems operate and reveals a troubling truth: spoofing these alerts is far easier than most people expect.

Fuse

Power Cycle B7 oder Warum kauft man eine Zeche? (de)

Kohlenpod, kater, Stephan

Aus einem Barwitz wurde ein Projekt! Blumenthal7 ist die letzte vollständig erhaltene Schachtanlage des ehemaligen Steinkohlebergwerks General Blumenthal in Recklinghausen im nördlichen Ruhrgebiet. Nach diversen Startschwierigkeiten ist aus einer im Dornröschenschlaf liegenden Industriebrache ein Projekt geworden, das bereits jetzt einer Vielzahl von Entitäten und Gruppen eine Heimat und einen großen, nahezu grenzenlosen Spielplatz bietet. Begleitet uns gerne beim Power Cycle B7…!

A Quick Stop at the HostileShop (en)

Mike Perry

HostileShop is a python-based tool for generating prompt injections and jailbreaks against LLM agents. I created HostileShop to see if I could use LLMs to write a framework that generates prompt injections against LLMs, by having LLMs attack other LLMs. It's LLMs all the way down. HostileShop generated prompt injections for a winning submission in OpenAI's GPT-OSS-20B RedTeam Contest. Since then, I have expanded HostileShop to generate injections for the entire LLM frontier, as well as to mutate jailbreaks to bypass prompt filters, adapt to LLM updates, and to give advice on performing injections against other agent systems. In this talk, I will give you an overview of LLM Agent hacking. I will cover LLM context window formats, LLM agents, agent vulnerability surface, and the prompting and efficiency insights that led to the success of HostileShop.

How to render cloud FPGAs useless (en)

Dirk

While FPGA developers usually try to minimize the power consumption of their designs, we approached the problem from the opposite perspective: what is the maximum power consumption that can be achieved or wasted on an FPGA? Short answer: we found that it’s easy to implement oscillators running at 6 GHz that can theoretically dissipate around 20 kW on a large cloud FPGA when driving the signal to all the available resources. It is interesting to note that this power density is not very far away from that of the surface of the sun. However, such power load jump is usually not a problem as it will trigger some protection circuitry. This led us to the next question: would a localized hotspot with such power density damage the chip if we remain within the typical power envelope of a cloud FPGA (~100 W)? While we could not “fry” the chip or induce permanent errors (and we tried several variants), we did observe that a few routing wires aged to become up to 70% slower in just a few days of stressing the chip. This basically means that such an FPGA cannot be rented out to cloud users without risking timing violations. In this talk, we will present how we optimized power wasting, how we measured wire latencies with ps accuracy, how we attacked 100 FPGA cloud instances and how we can protect FPGAs against such DOS attacks.

Am Spätverkauf

Punkrock-Songtext-Lesung (de)

tomate, anna

Kultivierte Personen rezitieren Punkrock-Songtexte mit der ganzen Ernsthaftigkeit und dem dramatischen Pathos, wie sonst nur von Goethe-Abenden im Literaturhaus bekannt. Anarchie meets Bildungsbürgertum. Chaos meets Chaiselongue.

4ever punk (en)

DJ Baba Grande

one hour of punk music, encompassing many different styles

Antifaschistischer Akkordeon-Punk - Grölen gegen Rechts (de)

Pianostein

Klassiker des antifaschistischen Deutschpunk-Liedguts – von Die Ärzte über Die Toten Hosen bis WIZO und Terrorgruppe – neu interpretiert auf dem Akkordeon. Laut, links und garantiert mitgröltauglich.

Chaos Computer Music Club

Sportbrigade Sparwasser (de)

Hüp Now

We are well aware of the fact, that as DJs we play other peoples´(as well as our own) music. This means we want to ensure the musicians get the credit and respect they deserve for their work. Whenever reasonably possible (communication get quite intense for us at times) we´ll be happy to supply track IDs, although sometimes it may take a little while. Also we´re happy about reposts if you like what we´re doing.

The 39c3 Drag Show (en)

Keks

Finally a drag show at the chaos! Blinking lights, colorful outfits, and queers everywhere already seems normal at the congress. So how can it be, that all of this did not come together as drag on stage?! It is time for a really awesome, great drag show at the 39c3! And to show right away how divers drag is, a wonderful cast of drag artists of various genders and expressions can spread their queer joy and art for the audience. The show is hosted by Milky Gay, the nerdiest drag king from NRW, who does not only want to throw glitter at the congress incognito this year. And he is bringing an amazing cast with him Bingus Bongus (Drag Queen, Hamburg) Neuro Spicy (Drag King, NRW) Missass Nostalgia (Drag Queen, NRW) and Kaín Mensch (Drag Thing, Hamburg) will bring their queer art to finally merge chaos and drag! Everyone is welcome, we are trying to have as little barriers as possible to come and watch. No blinking lights during the show (no guarantee for the path there and acts before and after), Music Club accessible with mobility aids and wheel chairs (ask assigned angles). Mostly standing room, few seats at the side might not allow for a good view of the show. Content notes for certain parts of the show include death, cancer, violence, fake weapons, and sexual violence, and will be announced in time so people can leave and come back afterwards. Cheering is encouraged, so it might get loud. (more details tba). Please be nice to each other and especially help short people as well as queers to find a spot where they can see enough. Also, as drag is expensive, there will be a tipping round in the end - please bring some cash if you consider tipping the artists, but of course you are also welcome either way.

Hitstorm aka The Jakob Sister b2b RaverPik (en)

RaverPik

This DJ Team the combines all the Sachsentrance craziness :D since both DJs run the Sachsentrance Label and organize their famous events, widely known for their ecstatic vibes. It's pure Joy!

Kenji Tanaka Live (en)

Kenji Tanak

In my improvised live set, my random generators and I bounce ideas off each other. This approach allows previously created loops to flow into endless new combinations.

Tatendrang.wav (de)

Adnan

Seine Sets sind geprägt von düsteren, treibenden Beats und hypnotischen Grooves, die sich perfekt für Underground-Partys und nächtliche Dancefloors eignen. Tatendrang ist kein Mainstream-DJ, sondern ein klarer Szene-DJ, der sich auf spezielle, energiegeladene Sounds konzentriert und damit eine loyale Fangemeinde anspricht. Mit viel Gespür für Atmosphäre und Spannungsaufbau nimmt er sein Publikum mit auf eine intensive musikalische Reise.

Chill Floor

Lila-Zoé Krauß (de)

Lila-Zoé Krauß

L Twills aka Lila-Zoé Krauß ist Musikerin, Performerin und Multimedia-Künstlerin. In ihrer Arbeit entwickelt sie eine transdisziplinäre Opernpraxis, um Fragen zur (post-)moderner Subjektivität und ihrer Beziehung zu Medien, Trauma und Erinnerung zu thematisieren. Sie studierte Bildende Kunst an der HFBK Hamburg und dem CalArts Los Angeles sowie Sound Studies an der UdK Berlin. In ihrer Musik kombiniert sie Elemente aus Downtempo, Experimentalmusik, Breakbeat und Oper mit eigens entwickelten Sounddesign-Techniken. Krauß veröffentlichte 2020 und 2024 die Vinylalben [Freedom/Fiction] und [After her Destruction] und performte auf diversen Bühnen, u.a.: Documenta Fifteen (Kassel), Kampnagel (Hamburg), Volkstheater (Wien), Montez-Press Radio (NYC), NAVEL (Los Angeles).

Weebz (en)

Weebz

WEEBZ likes to move between the odds, the rough and the soft: Breakbeat, dissonances, noise and sounds of deep dungeons belong to their mixes as well as the hymns of our hearts Most of the time the genres are mixed to an eclectic collection mirroring own confusions in the spirit of making the unmatching matching xx

Gajek (de)

Unnamed user

Gajek produces and performs electronic music. Since 2014 He released five studio albums on Labels such as STROOM, Infinite Greyscale, Throttle Records and more. Gajek composes music for films and theatre. He has performed at major international venues and festivals such like Berghain, silent green, Printworks London, Traumabar Und Kino, ADE Amsterdam, Melt Festival and many more. Gajek lives and works in Berlin.

Fimi & Nush (de)

Hanni

Fimi&Nush

Felix Kubin (de)

Felix Kubin

Felix Kubin, funkensprühender Spannungs- und Weltenwandler aus Hamburg, Verachter der Nüchternheit, lenkt die musikalische Kompassnagel Richtung Stolperdisko, Art Pop und „gute Nervmusik“. Das Tanzbein zappelt, aber die Beine laufen in verschiedene Richtungen, denn sie haben sich noch nicht synchronisiert. Hier erklingen Songs am Rande des Nervenzusammenbruchs, "Musik für junge Leute" und alle, die nicht sterben wollen. Vor allem haben es ihm die obskuren Musikversuche der Heimstudios vergangener Fostex-Generationen angetan, die Art Brut und ihre Einfärbungen durch billige, leicht zu demolierende Technologien. Felix Kubins musikalische Adoleszenz wurde durch eine Zeit geprägt, in der sich die Szenen der Kunst und Musik stark durchdrangen und Songtitel wie "Die Gesunden kommen", "Adrenalin lässt das Blut kochen" und "Hosen, die nicht aneinander passen" kein Stirnrunzeln verursachten. Eine Zeit also, in der sich die Popmusik weit aus dem Fenster lehnte und die Luft einer fremden, seltsamen Welt atmete.

Lina & Nele & Peng (de)

Lina & Nele & Peng

Nele, Peng and Lina are set to create a mesmerizing experience on the chillfloor 3c39, blending their unique artistic visions into a cohesive musical journey.Lina, with her innate talent and meticulous attention to detail, weaves ethereal melodies, esoteric rhythms, and wavey melancholy into a rich narrative. As an experienced curator of sound and atmosphere, she infuses her sets with her personal journey and history, selecting tracks that evoke deep emotions and resonate with her favorites.Nele and Peng complement Lina's artistry with their exceptional taste and ability to craft transcendental musical experiences. Each of them brings their unique flair, having proven their skills in various venues, including the renowned Kraniche bei den Elbbrücken.Together, this trio invites the audience to immerse themselves in a harmonious blend of sound, encouraging exploration of consciousness and connection with the ineffable beauty of music and place.

Vorglühmarkt

Loui Beton (en)

Loui Beton

Lets get besinnlich at the 39C3

Zweite Sahne & Olga Rhythmus (en)

Tesa

A DJ duo from Frankfurt playing technoid Dark Disco. Soundcloud: https://on.soundcloud.com/ieVMVNI9qlqR6BNBHh

Theme

Schedule