Conference 39th Chaos Communications Congress

One

Opening pAMDora's box and unleashing a thousand paths on the journey to play Beatsaber custom songs (en)

tihmstar

While trying to apply fault injection to the AMD Platform Security Processor with unusual (self-imposed) requirements/restrictions, it were software bugs which stopped initial glitching attempts. Once discovered, the software bug was used as an entry to explore the target, which in turn lead to uncovering (and exploiting) more and more bugs, ending up in EL3 of the most secure core on the chip. This talk is about the story of trying to glitch the AMD Platform Security Processor, then accidentally discovering several bugs and getting a good look inside the target, before returning to trying to hammer it with novel physical strategies.

All my Deutschlandtickets gone: Fraud at an industrial scale (en)

Q Misell, 551724 / maya boeckh

The Deutschlandticket was the flagship transport policy of the last government, rolled out in an impressive timescale for a political project; but this speed came with a cost - a system ripe for fraud at an industrial scale. German public transport is famously decentralised, with thousands of individual companies involved in ticketing and operations. Unifying all of these under one national, secure, system has proven a challenge too far for politicians. The end result: losses in the hundreds of millions of Euros, compensated to the transport companies from state and federal budgets to keep the system afloat, and nobody willing to take responsibility. This talk will cover the political, policy, and technical mistakes that lead to this mess; how we can learn from these mistakes; and what we can do to ensure the Deutschlandticket has a viable future.

To sign or not to sign: Practical vulnerabilities in GPG & friends (en)

49016, Liam

Might contain zerodays. https://gpg.fail/ From secure communications to software updates: PGP implementations such as *GnuPG* ubiquitously relied on to provide cryptographic assurances. Many applications from secure communications to software updates fundamentally rely on these utilities. Since these have been developed for decades, one might expect mature codebases, a multitude of code audit reports, and extensive continuous testing. When looking into various PGP-related codebases for some personal use cases, we found these expectations not met, and discovered multiple vulnerabilities in cryptographic utilities, namely in *GnuPG*, *Sequoia PGP*, *age*, and *minisign*. The vulnerabilities have implementation bugs at their core, for example in parsing code, rather than bugs in the mathematics of the cryptography itself. A vulnerability in a parser could for example lead to a confusion about what data was actually signed, allowing attackers without the private key of the signer to swap the plain text. As we initially did not start with the intent of conducting security research, but rather were looking into understanding some internals of key management and signatures for personal use, we also discuss the process of uncovering these bugs. Furthermore, we touch on the role of the OpenPGP specification, and the disclosure process.

Bluetooth Headphone Jacking: A Key to Your Phone (en)

Dennis Heinze, Frieder Steinmetz

Bluetooth headphones and earbuds are everywhere, and we were wondering what attackers could abuse them for. Sure, they can probably do things like finding out what the person is currently listening to. But what else? During our research we discovered three vulnerabilities (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) in popular Bluetooth audio chips developed by Airoha. These chips are used by many popular device manufacturers in numerous Bluetooth headphones and earbuds. The identified vulnerabilities may allow a complete device compromise. We demonstrate the immediate impact using a pair of current-generation headphones. We also demonstrate how a compromised Bluetooth peripheral can be abused to attack paired devices, like smartphones, due to their trust relationship with the peripheral. This presentation will give an overview over the vulnerabilities and a demonstration and discussion of their impact. We also generalize these findings and discuss the impact of compromised Bluetooth peripherals in general. At the end, we briefly discuss the difficulties in the disclosure and patching process. Along with the talk, we will release tooling for users to check whether their devices are affected and for other researchers to continue looking into Airoha-based devices. Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active).

Unnecessarily Complicated Kitchen – Die Wissenschaft des guten Geschmacks (de)

LukasQ

In unserer „Unnecessarily Complicated Kitchen“ hacken wir die Gesetze der Kulinarik. Ich zeige live, wie Hitze, Chemie und Chaos zusammenwirken, wenn Moleküle tanzen, Dispersionen emulgieren und Geschmack zu Wissenschaft wird. Zwischen Pfanne und Physik entdecken wir, warum Kochen im Grunde angewandtes Debugging ist – und wie man Naturgesetze so würzt, dass sie schmecken.

Ground

Of Boot Vectors and Double Glitches: Bypassing RP2350's Secure Boot (en)

stacksmashing, nsr

In August 2024, Raspberry Pi released their newest MCU: The RP2350. Alongside the chip, they also released the RP2350 Hacking Challenge: A public call to break the secure boot implementation of the RP2350. This challenge concluded in January 2025 and led to five exciting attacks discovered by different individuals. In this talk, we will provide a technical deep dive in the RP2350 security architecture and highlight the different attacks. Afterwards, we talk about two of the breaks in detail---each of them found by one of the speakers. In particular, we first discuss how fault injection can force an unverified vector boot, completely bypassing secure boot. Then, we showcase how double glitches enable direct readout of sensitive secrets stored in the one-time programmable memory of the RP2350. Last, we discuss the mitigation of the attacks implemented in the new revision of the chip and the lessons we learned while solving the RP2350 security challenge. Regardless of chip designer, manufacturer, hobbyist, tinkerer, or hacker: this talk will provide valuable insights for everyone and showcase why security through transparency is awesome.

Zero

A Tale of Two Leaks: How Hackers Breached the Great Firewall of China (en)

Jade Sheffey

The Great Firewall of China (GFW) is one of, if not arguably the most advanced Internet censorship systems in the world. Because repressive governments generally do not simply publish their censorship rules, the task of determining exactly what is and isn’t allowed falls upon the censorship measurement community, who run experiments over censored networks. In this talk, we’ll discuss two ways censorship measurement has evolved from passive experimentation to active attacks against the Great Firewall.

KIM 1.5: Noch mehr Kaos In der Medizinischen Telematikinfrastruktur (TI) (de)

Christoph Saatjohann

Zwei Jahre nach dem ersten KIM-Vortrag auf dem 37C3: Die gezeigten Schwachstellen wurden inzwischen geschlossen. Weiterhin können mit dem aktuellen KIM 1.5+ nun große Dateien bis 500 MB übertragen werden, das Signaturhandling wurde für die Nutzenden vereinfacht, indem die Detailinformationen der Signatur nicht mehr einsehbar sind. Aber ist das System jetzt sicher oder gibt es neue Probleme?

BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets (en)

Alon Leviev

This talk reveals our in-depth vulnerability research on the Windows Recovery Environment (WinRE) and its implications for BitLocker, Windows’ cornerstone for data protection. We will walk through the research methodology, uncover new 0-day vulnerabilities, and showcase full-chain exploitations that enabled us to bypass BitLocker and extract all the protected data in several different ways. This talk goes beyond theory - as each vulnerability will be accompanied by a demo video showcasing the complete exploitation chain. To conclude the talk, we will share Microsoft’s key takeaways from this research and outline our approach to hardening WinRE and BitLocker.

Fuse

Who cares about the Baltic Jammer? – Terrestrial Navigation in the Baltic Sea Region (en)

Lars, Niklas Hehenkamp, Markus

Reports of GNSS interference in the Baltic Sea have become almost routine — airplanes losing GPS, ships drifting off course, and timing systems failing. But what happens when a group of engineers decides to build a navigation system that simply *doesn’t care* about the jammer? Since 2017, we’ve been developing **R-Mode**, a terrestrial navigation system that uses existing radio beacons and maritime infrastructure to provide independent positioning — no satellites needed. In this talk, we’ll share our journey from an obscure research project that “nobody needs” to a system now seen as crucial for resilience and sovereignty. Expect technical insights, field stories from ships in the Baltic, and reflections on what it means when a civilian backup system suddenly attracts military interest.

Escaping Containment: A Security Analysis of FreeBSD Jails (en)

ilja, Michael Smith

FreeBSD’s jail mechanism promises strong isolation—but how strong is it really? In this talk, we explore what it takes to escape a compromised FreeBSD jail by auditing the kernel’s attack surface, identifying dozens of vulnerabilities across exposed subsystems, and developing practical proof-of-concept exploits. We’ll share our findings, demo some real escapes, and discuss what they reveal about the challenges of maintaining robust OS isolation.

Not To Be Trusted - A Fiasco in Android TEEs (en)

0ddc0de, gannimo, Philipp

Trusted Execution Environments (TEEs) based on ARM TrustZone form the backbone of modern Android devices' security architecture. The word "Trusted" in this context means that **you**, as in "the owner of the device", don't get to execute code in this execution environment. Even when you unlock the bootloader and Magisk-root your device, only vendor-signed code will be accepted by the TEE. This unfortunate setup limits third-party security research to the observation of input/output behavior and static manual reverse engineering of TEE components. In this talk, we take you with us on our journey to regain power over the highest privilege level on Xiaomi devices. Specifically, we are targeting the Xiaomi Redmi 11s and will walk through the steps necessary to escalate our privileges from a rooted user space (N-EL0) to the highest privilege level in the Secure World (S-EL3). We will revisit old friends like Trusted Application rollback attacks and GlobalPlatform's design flaw, and introduce novel findings like the literal fiasco you can achieve when you're introducing micro kernels without knowing what you're doing. In detail, we will elaborate on the precise exploitation steps taken and mitigations overcome at each stage of our exploit chain, and finally demo our exploits on stage. Regaining full control over our devices is the first step to deeply understand popular TEE-protected use cases including, but not limited to, mobile payment, mobile DRM solutions, and the mechanisms protecting your biometric authentication data.

DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices (en)

Zhongrui Li, Yizhe Zhuang, Kira Chen

The spyware attack targeting WhatsApp, disclosed in August as an in-the-wild exploit, garnered significant attention. By simply knowing a victim's phone number, an attacker could launch a remote, zero-interaction attack against the WhatsApp application on Apple devices, including iPhones, iPads, and Macs. Subsequent reports indicated that WhatsApp on Samsung devices was also targeted by similar exploits. In this presentation, we will share our in-depth analysis of this attack, deconstructing the 0-click exploit chain built upon two core vulnerabilities: CVE-2025-55177 and CVE-2025-43300. We will demonstrate how attackers chained these vulnerabilities to remotely compromise WhatsApp and the underlying iOS system without any user interaction or awareness. Following our analysis, we successfully reproduced the exploit chain and constructed an effective PoC capable of simultaneously crashing the target application on iPhones, iPads, and Macs. Finally, we will present our analysis of related vulnerabilities affecting Samsung devices (such as CVE-2025-21043) and share how this investigation led us to discover additional, previously unknown 0-day vulnerabilities.

Am Spätverkauf

No-Input (de)

CooperfrauMelissengeist

Ein geschlossener Kreislauf aus Klang und Störung. Kein Instrument, kein Ursprung, nur das Rauschen, das sich selbst gebiert. Frequenzen kratzen an der Grenze zum Bewusstsein, Feedback wird zum Atem einer Maschine ohne Körper. Aus dem Dunkel des Signals erhebt sich ein sirrendes Mantra — chaotisch, unheilig, autark. Eine Beschwörung der Leere durch elektrische Selbstzerstörung.

Tippeln am Rande des Abgrunds (de)

tippel radio

Das "tipple radio" ist eine Collage von Singer-Songwriter-Konzert und szenischer Lesung. Es trägt gecoverte und selbstgeschriebene Songs und Medleys von Punk über Hamburger Schule bis Schlager mit Gitarre und Gesang vor und verknüpft die Inhalte der Songs miteinander. Es entsteht ein Geflecht von Musik und Text, dass Aufbrüche in Abgründen aufzeigt und Hoffnung macht sich gegen die Faschisierung in der Gesellschaft zusammen zu schließen.

Mittagspausenpunk live (de)

Einschiss

Einschiss ist DER Ausnahmekünstler zwischen den Stationen Paracelsus Bad und Rathaus Reinickendorf der U8. Gefangen im Körper eines Mannes mit Charaktermodell German_default_3_bearded.obj macht Einschiss Musik gegen die Dinge die nerven: Nazis, Arbeit und Consent Forms (und Arbeit). Dabei setzt er modernste Technologien ein, um einen Typen so klingen zu lassen, als wäre es ein Typ mit Backing Track. Für mehr Musiker:innen hat das Bier nicht gereicht. Sorry.

Gepflegtes Grölen am Späti: Antifa-Jodler, Punkrock und Umverteilungs-Hits (de)

elenos

Das Konzept ist simpel: Wir singen zusammen. Im Angebot haben wir vier Kategorien: Politische Classics, Punkrock-Hymnen, Antifaschistische Jodler und Umverteilungs-Hits des Quartiersmanagements Grunewald in der ansprechenden Karaoke-Variante. Man muss nichts können. Mit charmanter Anleitung manövrieren wir uns zusammen durch kollektive Dissonanzen!

Chaos Computer Music Club

GAYLIENZ (en)

Oliotronix

Gaylienz is the new project of 3 gayliens coming from various universes. They got united to bring us an audio-visual glitch rave experience where we surf with an alien cats thru chaos and love cosmos. The audience is invited to participate too and of course to dance. Expect acid basslines, circuit bent, gayboy noise, beat constructions and analog glitch and videogame visuals - by Yelo555, Oliotronix and Maria Mam. https://www.instagram.com/gali3nz/ https://www.instagram.com/yelough.strobez/

Chill Floor

The Uncontrolled Manifold : dancing with sympoetic machines (de)

Christian Faubel

The Uncontrolled Manifold works with electronics and machines that possess autonomy and obstinacy. These machines are brought into interaction with each other, creating danceable polyrhythms and, at the same time, a fascinating shadow play, because the machines are mounted on an overhead projector and their interaction is projected. Analog oscillators generate self-organizing coordination dynamics and organic patterns, while motors strike rubber strings producing deep, resonant bass sounds reminiscent of shamanic drumming. Supported by the visuals spectators may feel like being dragged into the vortex of a living clock, compelled to join the performance through movement and dance.

Theme

Schedule