Conference 39th Chaos Communications Congress

One

All Sorted by Machines of Loving Grace? "AI", Cybernetics, and Fascism and how to Intervene (en)

Katika Kühnreich

While the extreme right is on the rise in many countries and climate change is unrolling, a promising future seems to be written: According to Elon Musk, Sam Altman, and some other “tech bros” it is to leave the dying planet to go to space. With the help of something called “A(G)I”. But what kind of future is the one that is promised? And what is the connection between power cycles of tech company owners and people who's believes can be called fascist? As we moved power through data in the hands of very view, it is important to examine what ideas these view have in their heads. This talk will explore the roots of today's tech fascism and its love for tech. From the early thoughts and movements in the US and Europe to Futurism and the Holocaust, organised with Hollerith punching cards. It will dive into the its blooming relationship with cybernetics, and take a look in the future the “tech bros” want to lure us in. This talk will address the often overlooked topic of how and when people get comfy with diving into movements of hate and how to stop a white supremacy future where we will be sorted by machines. And, in taking a look on past movements opposing authoritarianism and will examine mindsets and possibilities of resistance as well as the possibility of restarting everything. Because we have a planet and loved ones to lose. Wear your safety cat-ears, buckle up, it will be a wild, but entertaining ride.

Opening pAMDora's box and unleashing a thousand paths on the journey to play Beatsaber custom songs (en)

tihmstar

While trying to apply fault injection to the AMD Platform Security Processor with unusual (self-imposed) requirements/restrictions, it were software bugs which stopped initial glitching attempts. Once discovered, the software bug was used as an entry to explore the target, which in turn lead to uncovering (and exploiting) more and more bugs, ending up in EL3 of the most secure core on the chip. This talk is about the story of trying to glitch the AMD Platform Security Processor, then accidentally discovering several bugs and getting a good look inside the target, before returning to trying to hammer it with novel physical strategies.

All my Deutschlandtickets gone: Fraud at an industrial scale (en)

Q Misell, 551724 / maya boeckh

The Deutschlandticket was the flagship transport policy of the last government, rolled out in an impressive timescale for a political project; but this speed came with a cost - a system ripe for fraud at an industrial scale. German public transport is famously decentralised, with thousands of individual companies involved in ticketing and operations. Unifying all of these under one national, secure, system has proven a challenge too far for politicians. The end result: losses in the hundreds of millions of Euros, compensated to the transport companies from state and federal budgets to keep the system afloat, and nobody willing to take responsibility. This talk will cover the political, policy, and technical mistakes that lead to this mess; how we can learn from these mistakes; and what we can do to ensure the Deutschlandticket has a viable future.

To sign or not to sign: Practical vulnerabilities in GPG & friends (en)

49016, Liam

Might contain zerodays. https://gpg.fail/ From secure communications to software updates: PGP implementations such as *GnuPG* ubiquitously relied on to provide cryptographic assurances. Many applications from secure communications to software updates fundamentally rely on these utilities. Since these have been developed for decades, one might expect mature codebases, a multitude of code audit reports, and extensive continuous testing. When looking into various PGP-related codebases for some personal use cases, we found these expectations not met, and discovered multiple vulnerabilities in cryptographic utilities, namely in *GnuPG*, *Sequoia PGP*, *age*, and *minisign*. The vulnerabilities have implementation bugs at their core, for example in parsing code, rather than bugs in the mathematics of the cryptography itself. A vulnerability in a parser could for example lead to a confusion about what data was actually signed, allowing attackers without the private key of the signer to swap the plain text. As we initially did not start with the intent of conducting security research, but rather were looking into understanding some internals of key management and signatures for personal use, we also discuss the process of uncovering these bugs. Furthermore, we touch on the role of the OpenPGP specification, and the disclosure process.

Chatkontrolle - Ctrl+Alt+Delete (de)

khaleesi, Markus Reuter

Seit jetzt schon vier Jahren droht aus der EU die Chatkontrolle. In Deutschland ist das Thema nach den Protesten im Oktober aktueller denn je - und sogar Jens Spahn und Rainer Wendt sind plötzlich gegen diese Form der Überwachung. In diesem Vortrag schauen wir zurück und erklären was, vor allem im Hintergrund, passiert ist. Wir nehmen die Position der Bundesregierung genau unter die Lupe und werfen einen Blick auf die Schritte, die auf EU-Ebene vor uns liegen.

Bluetooth Headphone Jacking: A Key to Your Phone (en)

Dennis Heinze, Frieder Steinmetz

Bluetooth headphones and earbuds are everywhere, and we were wondering what attackers could abuse them for. Sure, they can probably do things like finding out what the person is currently listening to. But what else? During our research we discovered three vulnerabilities (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) in popular Bluetooth audio chips developed by Airoha. These chips are used by many popular device manufacturers in numerous Bluetooth headphones and earbuds. The identified vulnerabilities may allow a complete device compromise. We demonstrate the immediate impact using a pair of current-generation headphones. We also demonstrate how a compromised Bluetooth peripheral can be abused to attack paired devices, like smartphones, due to their trust relationship with the peripheral. This presentation will give an overview over the vulnerabilities and a demonstration and discussion of their impact. We also generalize these findings and discuss the impact of compromised Bluetooth peripherals in general. At the end, we briefly discuss the difficulties in the disclosure and patching process. Along with the talk, we will release tooling for users to check whether their devices are affected and for other researchers to continue looking into Airoha-based devices. Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active).

Ground

Not an Impasse: Child Safety, Privacy, and Healing Together (en)

Kate Sim

From the EU’s “Chat Control” to the UK’s age verification, there is a growing legislative momentum across jurisdictions to regulate the Internet in the name of protecting children. The monstrosity of child sexual abuse looms large in shaping how policymakers, advocates, and the public understand the problem area of and propose solutions for detecting, reporting, and removing harmful/illegal content. Children’s safety and adults’ privacy are thus pitted against each other, deadlocked into an impasse. As technologists deeply concerned with safety and privacy, where do we go from here?

Of Boot Vectors and Double Glitches: Bypassing RP2350's Secure Boot (en)

stacksmashing, nsr

In August 2024, Raspberry Pi released their newest MCU: The RP2350. Alongside the chip, they also released the RP2350 Hacking Challenge: A public call to break the secure boot implementation of the RP2350. This challenge concluded in January 2025 and led to five exciting attacks discovered by different individuals. In this talk, we will provide a technical deep dive in the RP2350 security architecture and highlight the different attacks. Afterwards, we talk about two of the breaks in detail---each of them found by one of the speakers. In particular, we first discuss how fault injection can force an unverified vector boot, completely bypassing secure boot. Then, we showcase how double glitches enable direct readout of sensitive secrets stored in the one-time programmable memory of the RP2350. Last, we discuss the mitigation of the attacks implemented in the new revision of the chip and the lessons we learned while solving the RP2350 security challenge. Regardless of chip designer, manufacturer, hobbyist, tinkerer, or hacker: this talk will provide valuable insights for everyone and showcase why security through transparency is awesome.

Handy weg bis zur Ausreise – Wie Cellebrite ins Ausländeramt kam (de)

Chris Köver

Seit Anfang 2024 dürfen Ausländerbehörden Smartphones von ausreisepflichtigen Menschen nicht nur durchsuchen, sondern gleich ganz behalten – „bis zur Ausreise“. Was als geringfügige Änderung im Aufenthaltsgesetz daherkommt, erweist sich als massiver Eingriff in Grundrechte: Menschen verlieren nicht nur die Kontrolle über ihre Daten, sondern auch ihr wichtigstes Kommunikationsmittel – auf unbestimmte Zeit. Hier hört ihr, welche absurden Blüten das treibt. Von Bayern bis NRW haben Bundesländer inzwischen eigene IT-forensische Tools für ihre Behörden angeschafft, um auf den Geräten nach “Indizien” für die Herkunft zu suchen. Sie setzen Methoden ein, wie wir sie sonst aus Ermittlungsverfahren oder von Geheimdiensten kennen – um die Geräte von Menschen zu durchsuchen, die nichts verbrochen haben.

And so it begins - Wie unser Rechtsstaat auf dem Highway Richtung Trumpismus rast – und warum afghanische Kläger*innen für uns die Notbremse ziehen (de)

Eva, Elaha

Wenn die Regierung sich nicht mehr an das eigene Recht gebunden fühlt, markiert das nicht nur einen politischen Spurwechsel, sondern die Auffahrt auf den Highway to Trumpism. Zeit die Notbremse zu ziehen! Normalerweise trifft es in solchen Situationen immer zuerst diejenigen, die sich am wenigsten wehren können. Doch was passiert, wenn genau diese Menschen mit juristischen Werkzeugen bewaffnet werden, um zurückzuschlagen? Anhand von über 100 Klagen afghanischer Schutzsuchender zeigen wir, wie Ministerien das Bundesaufnahmeprogramm sabotieren, Gerichte sie zurückpfeifen – und die Zivilgesellschaft zum letzten Schutzwall des Rechtsstaats wird. Und wir verraten, warum sich Beamte im BAMF vielleicht lieber krankmelden sollten und welche anderen Möglichkeiten sie haben, um nicht straffällig zu werden.

Doomsday-Porn, Schäferhunde und die „niedliche Abschiebung“ von nebenan: Wie autoritäre Akteure KI-generierte Inhalte für Social Media nutzen (de)

Katharina Nocun

Der amtierende US-Präsident postet ein Video, in dem er Demonstrierende aus einem Kampfjet heraus mit Fäkalien bewirft und das Weiße Haus zelebriert den „Star Wars Day“ mit einem pompösen Trump-Bild mit Lichtschwert. Accounts von AfD-Sympathisanten posten KI-Kitsch einer vermeintlich heilen Welt voller blonder Kinder und Frauen im Dirndl. Ist das lediglich eine geschmackliche Entgleisung oder steckt da mehr dahinter?

AI-generated content in Wikipedia - a tale of caution (en)

Mathias Schindler

I successfully failed with a literature related project and accidentally built a ChatGPT detector. Then I spoke to the people who uploaded ChatGPT generated content on Wikipedia.

Zero

A Tale of Two Leaks: How Hackers Breached the Great Firewall of China (en)

Jade Sheffey

The Great Firewall of China (GFW) is one of, if not arguably the most advanced Internet censorship systems in the world. Because repressive governments generally do not simply publish their censorship rules, the task of determining exactly what is and isn’t allowed falls upon the censorship measurement community, who run experiments over censored networks. In this talk, we’ll discuss two ways censorship measurement has evolved from passive experimentation to active attacks against the Great Firewall.

KIM 1.5: Noch mehr Kaos In der Medizinischen Telematikinfrastruktur (TI) (de)

Christoph Saatjohann

Zwei Jahre nach dem ersten KIM-Vortrag auf dem 37C3: Die gezeigten Schwachstellen wurden inzwischen geschlossen. Weiterhin können mit dem aktuellen KIM 1.5+ nun große Dateien bis 500 MB übertragen werden, das Signaturhandling wurde für die Nutzenden vereinfacht, indem die Detailinformationen der Signatur nicht mehr einsehbar sind. Aber ist das System jetzt sicher oder gibt es neue Probleme?

„KI“, Digitalisierung und Longevity als Fix für ein kaputtes Gesundheitssystem? (de)

Manuel Hofmann

Großen Herausforderungen im Gesundheitswesen soll mittels Technik und Eigenverantwortung begegnet werden. Die Hoffnung: „KI“ und Digitalisierung machen das System effizienter; Selbstoptimierung und mehr Eigenverantwortung halten die Menschen länger gesund. Der Vortrag analysiert aktuelle Diskurse rund um Digitalisierung und Gesundheit, und fragt kritisch, wie diese Entwicklung ohnehin bestehende soziale Ungleichheiten verschärfen könnte. Am Ende bleibt die Frage: Wie könnten tragfähige Lösungen fürs Gesundheitssystem aussehen?

BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets (en)

Alon Leviev

This talk reveals our in-depth vulnerability research on the Windows Recovery Environment (WinRE) and its implications for BitLocker, Windows’ cornerstone for data protection. We will walk through the research methodology, uncover new 0-day vulnerabilities, and showcase full-chain exploitations that enabled us to bypass BitLocker and extract all the protected data in several different ways. This talk goes beyond theory - as each vulnerability will be accompanied by a demo video showcasing the complete exploitation chain. To conclude the talk, we will share Microsoft’s key takeaways from this research and outline our approach to hardening WinRE and BitLocker.

Throwing your rights under the Omnibus - how the EU's reform agenda threatens to erase a decade of digital rights (en)

Thomas Lohninger, Ralf Bendrath

A spectre is haunting Europe—the spectre of bureaucracy. All the Powers of old Europe have entered into an unholy alliance to exorcise this spectre: The EU Commission, Member States, industry, even J.D. Vance. This threatens the digital rights and rules built up in the last decade.

Fuse

Brennende Wälder und Kommentarspalten - Klimaupdate mit dem FragDenStaat Climate Helpdesk (de)

Joschi Wolf

Das Klima-Update vom FragDenStaat Climate Helpdesk.

Who cares about the Baltic Jammer? – Terrestrial Navigation in the Baltic Sea Region (en)

Lars, Niklas Hehenkamp, Markus

Reports of GNSS interference in the Baltic Sea have become almost routine — airplanes losing GPS, ships drifting off course, and timing systems failing. But what happens when a group of engineers decides to build a navigation system that simply *doesn’t care* about the jammer? Since 2017, we’ve been developing **R-Mode**, a terrestrial navigation system that uses existing radio beacons and maritime infrastructure to provide independent positioning — no satellites needed. In this talk, we’ll share our journey from an obscure research project that “nobody needs” to a system now seen as crucial for resilience and sovereignty. Expect technical insights, field stories from ships in the Baltic, and reflections on what it means when a civilian backup system suddenly attracts military interest.

RedScout42 – Zur digitalen Wohnungsfrage (de)

Sandra, Leonard

Wer heutzutage eine Wohnung sucht, kommt kaum noch darum herum, sich einen Account bei Immoscout24 & Co. zu erstellen. Diese „Platform Real Estate“ sind eine besondere Art der „Walled Gardens“, die ihr Geschäftsmodell auf die sich immer weiter verschärfende Wohnungskrise ausgerichtet haben. Und das ist äußerst profitabel für die Besitzer dieser Strukturen der Daseinsvorsorge: Im September 2025 stieg Scout24 in den DAX auf und reiht sich damit in Unternehmen wie BMW, Rheinmetall und SAP ein.

Escaping Containment: A Security Analysis of FreeBSD Jails (en)

ilja, Michael Smith

FreeBSD’s jail mechanism promises strong isolation—but how strong is it really? In this talk, we explore what it takes to escape a compromised FreeBSD jail by auditing the kernel’s attack surface, identifying dozens of vulnerabilities across exposed subsystems, and developing practical proof-of-concept exploits. We’ll share our findings, demo some real escapes, and discuss what they reveal about the challenges of maintaining robust OS isolation.

Life on Hold: What Does True Solidarity Look Like Beyond Duldung, Camps, Deportation, and Payment Cards? (en)

H-Shaaib, Eric Noel Mbiakeu

Lager, Duldung, Bezahlkarte, Essensscheine – Criminalization, Radicalization, Reality for Many People in East Germany This talk sheds light on how these terms shape everyday life. We dive into an existence marked by uncertainty, isolation, and psychological strain, both in anonymous big cities and rural areas of East Germany. We ask: What does “solidarity” really mean in this context?

Not To Be Trusted - A Fiasco in Android TEEs (en)

0ddc0de, gannimo, Philipp

Trusted Execution Environments (TEEs) based on ARM TrustZone form the backbone of modern Android devices' security architecture. The word "Trusted" in this context means that **you**, as in "the owner of the device", don't get to execute code in this execution environment. Even when you unlock the bootloader and Magisk-root your device, only vendor-signed code will be accepted by the TEE. This unfortunate setup limits third-party security research to the observation of input/output behavior and static manual reverse engineering of TEE components. In this talk, we take you with us on our journey to regain power over the highest privilege level on Xiaomi devices. Specifically, we are targeting the Xiaomi Redmi 11s and will walk through the steps necessary to escalate our privileges from a rooted user space (N-EL0) to the highest privilege level in the Secure World (S-EL3). We will revisit old friends like Trusted Application rollback attacks and GlobalPlatform's design flaw, and introduce novel findings like the literal fiasco you can achieve when you're introducing micro kernels without knowing what you're doing. In detail, we will elaborate on the precise exploitation steps taken and mitigations overcome at each stage of our exploit chain, and finally demo our exploits on stage. Regaining full control over our devices is the first step to deeply understand popular TEE-protected use cases including, but not limited to, mobile payment, mobile DRM solutions, and the mechanisms protecting your biometric authentication data.

DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices (en)

Zhongrui Li, Yizhe Zhuang, Kira Chen

The spyware attack targeting WhatsApp, disclosed in August as an in-the-wild exploit, garnered significant attention. By simply knowing a victim's phone number, an attacker could launch a remote, zero-interaction attack against the WhatsApp application on Apple devices, including iPhones, iPads, and Macs. Subsequent reports indicated that WhatsApp on Samsung devices was also targeted by similar exploits. In this presentation, we will share our in-depth analysis of this attack, deconstructing the 0-click exploit chain built upon two core vulnerabilities: CVE-2025-55177 and CVE-2025-43300. We will demonstrate how attackers chained these vulnerabilities to remotely compromise WhatsApp and the underlying iOS system without any user interaction or awareness. Following our analysis, we successfully reproduced the exploit chain and constructed an effective PoC capable of simultaneously crashing the target application on iPhones, iPads, and Macs. Finally, we will present our analysis of related vulnerabilities affecting Samsung devices (such as CVE-2025-21043) and share how this investigation led us to discover additional, previously unknown 0-day vulnerabilities.

Am Spätverkauf

Störmoment (en)

Vale

All styles Punk from hc, grunge and garage to indie, pop and post, female fronted only.

Chaos Computer Music Club

Katja Ruge (en)

Katja Ruge

„Planetary Visions“ with Katja Ruge (Can Love Be Synth/Synthesizerstudio HH, Electric Lights/Planetarium HH) Katja Ruge’s DJ sets are a seamless fusion of Italo, New Wave, Cosmic Sounds, 80s, Dark Disco, and Electro.

Analog to Algorithm: RSS Disco’s Underground Journey (en)

RSS Disco

From crackling Kraut and Disco records to hyper produced Techno tracks - dance music has come a long way in the last six decades, and was always strongly influenced by evolving technology. Dance music’s history is a feedback system between culture and circuitry. Each new invention—from the disco subwoofer to today’s neural-driven mastering tools—reshapes sound itself. RSS Disco’s timeline approach celebrates this continuum: a story of machines learning to groove, and humans learning to listen differently through them.

Steve Simon (de)

Steve

Als Part der ToxicFamily, die seit mittlerweile 25 Jahren Label, elektronisches Magazin, Veranstalter und einfach eine Institution in Frankfurt ist, fördert Steve, der übrigens einer der dienstältesten Residents des Tanzhaus West in Frankfurt ist, aktiv die Frankfurter Underground Clubszene und vor allem den Nachwuchs. Ob es ein Gig bei der Toxic Family Radio Show im lokalen FM Radio ist, ein CDJ Lehrgang oder einfach nur aufmunterte Worte während eines Sets - viele Frankfurter DJs haben eine Geschichte über Steve zu erzählen. Wenn Steve House Musik spielt, sieht man oft DJ Kollegen mit gespitzen Ohren an der Bar stehen - oder auch mal mitten auf der Tanzfläche - weil das Barpersonal selbst auf der Theke tanzt.

Angie Taylor (en)

Angie Taylor

Angie Taylor is specialized in Hybrid Techno LIVE-DJ SETS, often blending it with live bass guitar and vocals to create a unique, electrifying hybrid Techno experience.

YMNA (en)

Nina_art&play

Heute Nacht wird der Dancefloor zur globalen Schnittstelle. YMNA kalibriert mit ihrem Mix aus global inspirierten Soundscapes und moderner Club-Musik unsere Sinne neu. Es ist die perfekte Balance zwischen dem Rohen, Ursprünglichen und der polierten Kraft des heutigen melodischen Techno.

Chill Floor

Festnacht (de)

Festnacht

Festnacht is a fixture in Hamburg’s music scene. Together with L.F.T., he has steered the Neoprimitive label and event series for nearly a decade, releasing a broad range of mostly experimental electronic music from artists like Rosaceae, Children of Leir, and Alobhe, and inviting names such as Skee Mask, Anthony Rother, Bloody Mary, and Interstellar Funk to the iconic Golden Pudel Club. His DJ sets span the spectrum of Detroit-rooted techno and electro - always unpredictable, shaped by the night’s energy, and known for his skill in slowly and subtly warming up a room.

bushfya (de)

bushfya

For the Love of Music. Nothing else.

Afidissima & Alice (de)

Afidissima & Alice

Afidissima and Alice, two millennial stereotypes sharing music tips as emotional currency. Gabby radio host Afidissima delivers genre-chaotic sets drenched in dubby vibes and oozing with groove. A relentless cratedigger with questionable priorities. Alice unites musical moments and moods that refuse to be united. Seductive, whimsical, followed by familiar paths, so as not to upset the ear and inner balance. Mixed feelings becoming multiple emotions. Everything as usual – just enhanced momentum.

BarbNerdy (en)

BarbNerdy

Sharing Means Caring: Most of the music of this series was recorded at a Chaos Event in the last 10 (or more) years. It is time for a new episode: https://soundcloud.com/barbnerdy/sets/mixtape-sharing-means-caring-1

Dj Sloush + Zarrt (de)

Dj Sloush aka Spitz + Zarrt

The berlin based artist duo is working under different alias solo, in duos or collectives since 2011. They are sound artists, DJs, part of Cashmere Radio (Berlin), curators, event organizers, performers and multimedia artists. “Dj Sloush aka Spitz + Zarrt aka Fellmaus will make you happy. There’s gonna be these sounds coming from the speakers, new otherworldly ones mixed with seemingly familiar yet undiscovered natural feeling waves of moods, or maybe hot and twirling rapid fire bass jumping trippin balls ones. Either way they’ll provide you with a guaranteed enjoyment of the infinite kind.”

Babooshka (de)

Babooshka

Babooshka is Marian Bodenstein, who played with several punk bands such as LASSIE, LAFFF BOX, NICK NORMAL and DBR at the moment. Under the moniker FUZZZGUN Marian is working as a graphic designer for bands, labels and other "multinational corporations". Normally Babooshka would serve you a high octane dance set rooted in 70s power pop, punk and rocknroll but for the CCCChillfloor you’ll get a certain mixture of their favorite relaxin, beautiful and tearjerking tracks, combined with some broken records to serve as analog loops and audioplay records. Babooshka is happy to play records that are normally reserved for the end of an emotional night of dance and shenanigans or even never would see the lights of the dance floor under „normal“ circumstances.

g00d news (de)

g00d news

g00d news lebt und arbeitet seit 2009 in Hamburg und ist als Vinyl-DJ Teil der lokalen Underground-Szene. Er war langjähriger Resident und Kurator im Golden Pudel Club und ist Mitbetreiber des Plattenladens Remoto-Rec. sowie des Vinyl- und Kassettenlabels V I S mit Fokus auf experimenteller Musik. Seine Sets reichen von Ambient, Experimental und outernationalen Sounds bis hin zu UK-Rave, Darkside Jungle, Hardcore, Breakbeats, Deep Techno und Freetekno. Zudem ist er kuratorisch und organisatorisch im BEEK e.V. aktiv.

Vorglühmarkt

stornoline (de)

Sassi

service for dance trips ⏰✨💫⏰✨💫⏰✨💫⏰✨💫 zocke für euch housy rave essentials mit nostalgischen vocals und acid lines & mache sachen bei @diskobabel 💕 und @entropiefestival ⚡️

Aladdin (de)

Hamdi

Hamdi (Berlin) House and minimal techno built for immersion. Extended mixes, controlled pacing, and Fog-filled rooms where the story unfolds gradually.

Theme

Schedule