Schedule
- List
- Calendar
Martin Heckel, Florian Adamsky, Daniel Gruss
Last year at 38c3, we gave a talk titled "Ten Years of Rowhammer: A Retrospect (and Path to the Future)." In this talk, we summarized 10 years of Rowhammer research and highlighted gaps in our understanding. For instance, although nearly all DRAM generations from DDR3 to DDR5 are vulnerable to the Rowhammer effect, we still do not know its real-world prevalence. For that reason, we invited everyone at 38c3 last year to participate in our large-scale Rowhammer prevalence study. In this year's talk, we will first provide an update on Rowhammer research and present our results from that study. A lot has happened in Rowhammer research in 2025. We have evidence that DDR5 is as vulnerable to Rowhammer as previous generations. Other research shows that not only can adversaries target rows, but columns can also be addressed and used for bit flips. Browser-based Rowhammer attacks are back on the table with Posthammer and with ECC. fail, we can mount Rowhammer attacks on DDR4 with ECC memory. In our large-scale study, we measure Rowhammer prevalence in a fully automated cross-platform framework, FlippyR.AM, using the available state-of-the-art software-based DRAM and Rowhammer tools. Our framework automatically gathers information about the DRAM and uses 5 tools to reverse-engineer the DRAM addressing functions, and based on the reverse-engineered functions, uses 7 tools to mount Rowhammer. We distributed the framework online and via USB thumb drives to thousands of participants from December 30, 2024, to June 30, 2025. Overall, we collected 1006 datasets from 822 systems with various CPUs, DRAM generations, and vendors. Our study reveals that out of 1006 datasets, 453 (371 of the 822 unique systems) succeeded in the first stage of reverse-engineering the DRAM addressing functions, indicating that successfully and reliably recovering DRAM addressing functions remains a significant open problem. In the second stage, 126 (12.5 % of all datasets) exhibited bit flips in our fully automated Rowhammer attacks. Our results show that fully automated, i.e., weaponizable, Rowhammer attacks work on a lower share of systems than FPGA-based and lab experiments indicated, but at 12.5%, are still a practical vector for threat actors. Furthermore, our results highlight that the two most pressing research challenges around Rowhammer exploitability are more reliable reverse-engineering tools for DRAM addressing functions, as 50 % of datasets without bit flips failed in the DRAM reverse-engineering stage, and reliable Rowhammer attacks across diverse processor microarchitectures, as only 12.5 % of datasets contained bit flips. Addressing each of these challenges could double the number of systems susceptible to Rowhammer and make Rowhammer a more pressing threat in real-world scenarios.
Nico Semsrott
PRÜF! Prüfung Rettet übrigens Freiheit! Alles wird in Deutschland geprüft. Warum nicht auch mutmaßlich verfassungswidrige Parteien? Hier stelle ich vor, was PRÜF! anders machen will als bisherige Kampagnen.
Alvar C.H. Freude
Datenschutz darf auch Spaß machen, und alle können dabei etwas lernen, egal ob Einsteiger oder Profi-Hacker: Bei dem Datenschutz- und Datenpannen-Quiz kämpfen vier Kandidat:innen aus dem Publikum zusammen mit dem Publikum um den Sieg. Nicht nur Wissen rund um IT-Sicherheit und Datenschutz sondern auch eine schnelle Reaktion und das nötige Quäntchen Glück entscheiden über Sieg und Niederlage. Die Unterhaltsame Datenschutz-Quiz-Show mit Bildungsauftrag!
Simon Schultz
Oder: Wie die Hamburger Polizei queere Menschen auf öffentlichen Toiletten observierte, und wie ein anonymes Kollektiv im Juli 1980 dieses Überwachungsystem wortwörtlich mit dem Hammer zerschlagen hat. Ein analoger Überwachungskrimi mit sauberen Städten, lichtscheuen Elementen, queerem Aktivismus, und kollektiver Selbstorganisation; und mit einer Anleitung wie man Beamten Anfang der 80er das Handwerk legen konnte.
Davy Wang, Viktor Schlüter
Eine zwar profane Methode der Überwachung, die Polizeibehörden in Deutschland jedoch hunderttausendfach anwenden, ist das Auslesen von Daten beschlagnahmter Smartphones und Computer. Dazu nutzt die Polizei Sicherheitslücken der Geräte mithilfe forensischer Software von Herstellern wie Cellebrite oder Magnet aus. Die Verfassungsmäßigkeit der Rechtsgrundlagen ist zweifelhaft. Im Vortrag werden anhand aktueller Fälle technische und juristische Hintergründe erörtert.
Maarten W
The Dutch railways have been operating an increasingly complicated network of trains for over 80 years. The task of overseeing it is far too complex for a single human. As such, a network of specifically scoped humans has been connected. Over time, computers and software have been introduced into the system, but today there is still a significant role for humans. This talk describes the network of "human microservices" that is involved in the Dutch Railways' day to day operation from the eyes of a software developer.
Thijs Raymakers
Transient execution CPU vulnerabilities, like Spectre, have been making headlines since 2018. However, their most common critique is that these types of vulnerabilities are not really practical. Even though it is cool to leak `/etc/shadow` with a CPU bug, it has limited real-world impact. In this talk, we take Spectre out for a walk and let it see the clouds, by leaking memory across virtual machine boundaries at a public cloud provider, bypassing mitigations against these types of attacks. Our report was awarded with a $151,515 bug bounty, Google Cloud's highest bounty yet.
Wante
Wante (Cologne) is drawn to dark, tunnely sets. With a soft spot for long, atmospheric, break-driven intros, her carefully curated selections evolve into relentless, hypnotic techno with ambient soundscapes.
Rob StrobE
THE SECOND DECADE Born `78 in Germany Rob StrobE grew up and being influenced with classical music, swing and jazz in his childhood. He early discovered the likes of Depeche Mode, Michael Jackson, Kraftwerk and more early electronic music approaches. In his late youth/early adult life he frequently travelled to Frankfurt attending nights at the Omen. Those nights and weekends were filled with DJs like Sven Vaeth, Dj Rush, Chris Liebing, G-Man aka Gez Varley, Hardfloor and so many more, celebrating and transporting the spirit of those days! After the closing of the Omen in late 1998 he went on to clubs like u60311, Tanzhaus West, MTW and others and eventually started his career as professional (sound) technician and light jockey. Around the year 2002 he started music production - mostly for personal fun and recreational purposes - but some records and remixes have been released since then...some of this older work can still be found on his Soundcloud! Since then he developed his own company specialized on music studio technology, room acoustic, signal flow schemes and studio furniture. Meanwhile his own studio transformed from a small Home Studio to a „room-in-room“ environment in the Logic Haus - the former home of Harthouse, Eye-Q and Snap! If he had to describe his musical style and give it a name: it would be „DubHouseTechno with a pinch of Detroit" ;) FastFoward: Year 2021 - after a 7 year break of releasing music, Rob StrobE is back with releases on imprints like Lucidflow, ASrecords, Tantara, Motech and numerous others! Rob used the time to do a major swap from software based production over to the modular and hardware world and the output speaks for itself! Enjoy his music and come pass for a visit on his social media outlets and say „hello“! THANKS FOR YOUR SUPPORT!!! COLLABORATIONS with G-Man aka Gez Varley (Swim/Quo Vadis/UK) Bo_Irion (Conaisseur/FFM) APro (Audio Emissions/FFM) Voodoe (Audio Emissions/FFM) Frank Kusserow (Data Punk/WhiteNoise/FFM) Israel Toledo (ASRecords/Mexico)