BEGIN:VCALENDAR VERSION:2.0 CALSCALE:GREGORIAN X-WR-CALNAME:39th Chaos Communications Congress ICal Feed BEGIN:VEVENT SUMMARY:A Tale of Two Leaks: How Hackers Breached the Great Firewall of Ch ina DTSTART:20251227T100000Z DTEND:20251227T104000Z UID:ba655198-f461-5a1b-998c-12ed49fc7aae CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/a-tale -of-two-leaks-how-hackers-breached-the-great\n\nDescription:\nWhile probin g the Great Firewall’s DNS injection system in 2021\, we noticed somethi ng strange: Sometimes the injected responses contained weird garbage. Afte r some investigation\, we realized we’d stumbled onto a memory disclosur e vulnerability that would give us an unprecedented window into the Great Firewall’s internals: Wallbleed.\n\nSo we crafted probes that could leak up to 125 bytes per response and repeatedly sent them for two years. Five billion responses later\, the picture that emerged was... concerning. Ove r 2 million HTTP cookies leaked. Nearly 27\,000 URL parameters with passwo rds. SMTP commands exposing email addresses. We found traffic from RFC 191 8 private addresses - suggesting we were seeing the Great Firewall’s own internal network. We saw x86_64 stack frames with ASLR-enabled pointers. We even sent our own tagged traffic into China and later recovered those e xact bytes in Wallbleed responses\, proving definitively that real user tr affic was being exposed.\n\nIn September 2023\, the patching began. We wat ched in real-time as blocks of IP addresses stopped responding to our prob es. But naturally the same developers that made this error in the first pl ace made further mistakes. Within hours\, we developed “Wallbleed v2” queries that still triggered the leak. The vulnerability persisted for ano ther six months until March 2024.\n\nGFW measurement research went back to business as usual until September of this year when an anonymous source r eleased 600GB of leaked source code\, packages\, and documentation via Enl ace Hacktivista. This data came from Geedge Networks - a company closely c onnected to the GFW and the related MESA lab. Geedge Networks develops cen sorship software not only for the GFW but also for other repressive countr ies such as Pakistan\, Myanmar\, Kazakhstan\, and Ethiopia.\n\nWe will dis cuss some of our novel findings from the Geedge Networks leak\, including new insights about how the leak relates to Wallbleed.\n\nWallbleed and the Geedge Networks leak show that censorship measurement research can be abo ut more than just actively probing censored networks. We hope this talk wi ll be a call to arms for hackers against Internet censorship.\n\n\nMore in formation about Wallbleed can be found at the GFW Report:\nhttps://gfw.rep ort/publications/ndss25/en/\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/a-tale-of-two-leaks-how-hack ers-breached-the-great END:VEVENT BEGIN:VEVENT SUMMARY:ISDN + POTS Telephony at Congress and Camp DTSTART:20251227T105500Z DTEND:20251227T113500Z UID:382a6def-2dbb-5ba8-bde5-0bf509c5eb02 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/isdn-p ots-telephony-at-congress-and-camp\n\nDescription:\nJust like at this very event (39C3)\, the last few years a small group of volunteers has delpoye d and operated legacy telephony networks for ISDN (digital) and POTS (anal og) services at CCC-camp2023 and 38C3. Anyone on-site can obtain subscribe r lines (POTS\, ISDN BRI or PRI service) and use them for a variety of ser vices\, including telephony\, fax machines\, modem dial-up into BBSs as we ll as dial-up internet access and video telephony.\n\nThese temporary even t networks are not using soft-PBX or VoIP\, but are built using actual de- commissioned hardware from telecom operators\, including a Siemens EWSD di gital telephone exchange\, Nokia EKSOS V5 access multiplexers\, a SDH ring for transporting E1 carriers and much more.\n\nWhile some may enjoy this for the mere hack value\, others enjoy it to re-live the digital communica tion sear of their childhood or youth. Howevre\, there is a more serious aspect to this: The preservation and restoration of early digital communic ations infrastructure from the 1970s to 1990s\, as well as how to operate such equipment. As part of this effort\, we have already been able to hel p communications museums to fill gaps in their collections.\n\nThe talk wi ll cover\n* the equipment used\,\n* the network hierarchy we build\,\n* th e services operated\n* the lessons learnt\n* newly-written open source sof tware for interfacing retro telcommunications gear\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/isdn-pots-telephony-at-congr ess-and-camp END:VEVENT BEGIN:VEVENT SUMMARY:FeTAp 611 unplugged: Taking a rotary dial phone to the mobile age DTSTART:20251227T115000Z DTEND:20251227T123000Z UID:cc16de00-c31f-5c44-a34a-615e6beba883 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/fetap- 611-unplugged-taking-a-rotary-dial-phone-to-the-mobile-age\n\nDescription: \nThere are people who throw away old telephones - and then there are thos e who find them in the garbage and think\, „How can a microcontroller ac tually read the digits from a rotary dial?“\nThis talk follows the journ ey of transforming a classic German FeTAp 611 rotary phone into a mobile d evice while keeping its vintage charm. Building on earlier retrofits\, thi s project aims to combine the following design goals into a mobile version of the Fernsprechtischapparat:\n\n- Grandparents-compatible – The phone shall be easy to use by non-technical people\, showing the same look and feel as the original phones\, including details such as a dial tone.\n- ea sy phone switching – Switching between FeTAp and regular cellphone shall not require unscrewing the phone to switch SIM cards.\n- standard compone nts – PCB/PCBA suppliers shall be capable of manufacturing boards at a r easonable price.\n- device-agnostic circuit design – Adapting to differe nt phones (e.g. W48\, FeTAp 791\, FeTAp 611) shall minimize the need for c hanges in the schematic. This includes a ringing voltage generator that sh all be powerful enough to drive an old W48 phone.\n\nThis talk will walk y ou through certain aspects of the German analog telephony standard 1TR110- 1\, and the challenges faced when implementing those on a battery-powered device with little space. It explains\n- the state machine implemented on an STM32 microcontroller\,\n- how to connect old carbon microphones to mod ern audio electronics\,\n- designing (and avoiding mistakes in) a flyback based SMPS to generate 32V - 75V ringing voltage\,\n- how to generate 25 H z AC using an H-bridge\,\n- and how to layout the PCB such that the ancien t second handset connector can now be used for USB-C charging.\n\nIn the c ourse of the development\, I discovered that the project is not only a goo d way to get a glimpse into various aspects of ancient and modern types of electronics - but also into people’s reactions when such a phone sudden ly starts ringing on a flea market… :-)\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/fetap-611-unplugged-taking-a -rotary-dial-phone-to-the-mobile-age END:VEVENT BEGIN:VEVENT SUMMARY:Developing New Medicines in the Age of AI and Personalized Medicin e DTSTART:20251227T125000Z DTEND:20251227T133000Z UID:5cf7d973-5a94-5e8f-9f8d-8b5f4ec5bb6d CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/develo ping-new-medicines-in-the-age-of-ai-and-personalized-medicine\n\nDescripti on:\nAfter presenting a high-level overview of the path from an idea to th e medicine that you can buy at a pharmacy\, this talk will present and dis cuss the following aspects of the drug discovery and development process: \n(1) The translation of an idea into a drug for a human patient faces man y critical moments along the development process. This so-called “transl ational gap” is addressed through experiments in a test tube (or Petri d ish)\, experimentation in lab animals\, and eventually testing in humans. However\, findings in a standard cell line or in a mouse do not necessaril y reflect the complexity of biological processes in a human patient. Curre ntly\, there are many technological advancements under way to improve the current drug discovery and development process\, and possibly even replace animal studies in the future (e.g.\, organs-on-chip). Nevertheless\, the fundamental issues surrounding translational research remain\, such as the lack of standardization\, the limitations of model systems\, and various underlying clinical biases.\n(2) Like in many industries today\, AI applic ations are introduced at multiple levels and for various purposes within t he drug discovery and development continuum. Often\, a lot of hope is plac ed in AI-based technologies to accelerate the R&D process\, increase effic iency and productivity\, and identify new therapeutic approaches. Indeed\, there are many highly useful examples\, such as the automation of image a nalysis in research\, which replaces repetitive tasks and hence frees up a lot of time for researchers to do meaningful research. However\, there ar e also many applications that are likely misguided\, because they still fa ce fundamental problems in evaluating scientific knowledge. For instance\, the use of LLMs to summarize huge amounts of very complex and heterogeneo us scientific data relies on the accuracy\, completeness\, and reproducibi lity of the available scientific data\, which is often not the case. In ad dition\, AI is often employed in an IT environment with questionable data security and ownership practices\, such as the storage of sensitive resear ch data on third-party cloud platforms.\n(3) Until now\, the overwhelming majority of drugs have been developed to treat large patient populations\, which represent a considerable market and ultimately ensure a return on i nvestment. Today\, however\, most common and homogeneous diseases can alre ady be managed\, often with several (generic) drugs. Slight improvements t o current drugs do not justify a large profit margin anymore\, so the focu s of drug discovery and development is shifting toward more heterogeneous and rare diseases\, for which no or only poor treatments are available. No vel medicines in those disease areas hold the promise of substantial impro vement for patients\; however\, these new patient (sub)populations\, and t hus markets\, are much smaller\, leading to premium prices for individuali zed therapies in order to ensure a return on investment. This paradigm shi ft toward individualized therapy - referred to as precision and personaliz ed medicine - is supported by the advent of novel technologies and the acc umulation of large bodies of data.\n(4) The rise of precision and personal ized medicine is challenging the current business model of today’s pharm aceutical industry\, suggesting that the era of blockbuster drugs might be over. Moreover\, many intellectual property rights for blockbuster drugs are going to expire in the next few years\, ending the market dominance of a number of pharma companies and sending the current industry landscape i nto turmoil. These developments will likely alter the current modus operan di of the entire biopharmaceutical development process\, and it is not cle ar how the next few years will look like.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/developing-new-medicines-in- the-age-of-ai-and-personalized-medicine END:VEVENT BEGIN:VEVENT SUMMARY:KIM 1.5: Noch mehr Kaos In der Medizinischen Telematikinfrastruktu r (TI) DTSTART:20251227T134500Z DTEND:20251227T144500Z UID:eeb77e44-8a29-5235-960b-e50575570c5c CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/kim-1- 5-noch-mehr-kaos-in-der-medizinischen-telematikinfrastruktur-ti\n\nDescrip tion:\nKIM hat sich als Dienst für medizinische E-Mails etabliert: Elektr onische Arbeitsunfähigkeitsbescheinigungen (eAU)\, zahnärztliche Heil- u nd Kostenpläne\, Laborinformationen\, und Medikamentendosierungen sollen sicher per KIM übermittelt werden. Die Sicherheit soll unauffällig und a utomatisiert im Hintergrund\, ohne Interaktion mit den Benutzenden gewähr leistet werden. Dazu werden die Ver- und Entschlüsselung sowie die Signie rungsfunktionalitäten in einer extra Software\, dem sogenannten Clientmod ul\, abstrahiert.\n\nIn diesem Vortrag wird das Design dieser Sicherheits- Abstraktion und dadurch bedingte Schwachstellen\, wie das Fälschen oder E ntschlüsseln von KIMs\, beleuchtet.\n\nFortsetzung von 37C3: KIM: Kaos In der Medizinischen Telematikinfrastruktur (TI) [https://media.ccc.de/v/37c 3-12030-kim_kaos_in_der_medizinischen_telematikinfrastruktur_ti]\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/kim-1-5-noch-mehr-kaos-in-de r-medizinischen-telematikinfrastruktur-ti END:VEVENT BEGIN:VEVENT SUMMARY:„KI“\, Digitalisierung und Longevity als Fix für ein kaputtes Gesundheitssystem? DTSTART:20251227T150000Z DTEND:20251227T160000Z UID:4b106a63-ac7e-5c39-945a-26ce0d071897 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/ki-dig italisierung-und-longevity-als-fix-fur-ein-kaputtes-gesundheitssystem\n\nD escription:\nIn der Analyse sind sich alle einig: Das Gesundheitssystem st eht vor großen Herausforderungen\, die von explodierenden Kosten\, wachse nden Zugangsbarrieren bis hin zum anstehenden demographischen Wandel reich en: viele Menschen werden alt und kränker\, während gleichzeitig sehr vi ele Mitarbeiter:innen des Gesundheitswesens in Rente gehen. Wir brauchen a lso Lösungen fürs Gesundheitssystem\, die nachhaltig tragen und Menschen würde ermöglichen.\n\nWährend ganz unterschiedliche Lösungsansätze di skutiert werden\, taucht ein Narrativ immer wieder auf: Dass Digitalisieru ng durch massive Effizienzgewinne die bestehenden Probleme im Gesundheitsw esen fixen werden: Dank „KI“ sollen Menschen weniger häufig Ärzt:inn en brauchen\, zum Beispiel\, indem durch Symptomchecker und Co vorgefilter t wird\, wer wirklich behandelt werden muss\, und wer nicht. Manche behaup ten\, dass Hausärzt:innen künftig ein vielfaches an Patient:innen behand eln könnten\, wenn nur die richtigen technischen Hilfsmittel gefunden wur den. Und längst befinden wir uns tatsächlich in einer Realität\, in der Chats mit LLMs an vielen Stellen zumindest Dr. Google ersetzt haben.\n\nW eitere Lösungsansätze zielen auf mehr Eigenverantwortung ab: "Longevity" ist das Trendwort in aller Munde. Ein Ansatz der „Langlebigkeit“\, de r maßgeblich durch technische \nMaßnahmen gestützt sein soll: Selbstopt imierung per App\, „KI“ als individueller Gesundheitsassistent und all erlei experimentelle Untersuchungen. Die Grundidee: Wenn Menschen länger gesund bleiben und leben\, wird das Gesundheitssystem weniger belastet\, w ährend Menschen länger zu Gesellschaft und Wirtschaft beitragen können. Die ideologischen Grundzüge und Geschäftsmodelle der „Longevity“ ko mmen aus den USA\, von Tech-Milliardären und ihren Unsterblichkeitsfantas ien bis hin zu wenig seriösen Gesundheitsinfluencer:innen\, die am Ende o ft mehr schaden als dass sie zu einem größeren Wohlbefinden ihrer Kund:i nnen beitragen würden - und trotzdem hunderttausende auf Social Media in ihren Bann ziehen.\n\nDer Vortrag zieht Verbindungslinien zwischen naiver Technikgläubigkeit\, aktuellen Diskursen im Gesundheitswesen\, ihren frag würdigen ideologischen Wurzeln und der Frage\, wie wir Herausforderungen und insbesondere sozialen Ungleichheiten im Feld der Gesundheit wirklich e ffektiv begegnen.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/ki-digitalisierung-und-longe vity-als-fix-fur-ein-kaputtes-gesundheitssystem END:VEVENT BEGIN:VEVENT SUMMARY:Pwn2Roll: Who Needs a 595€ Remote When You Have wheelchair.py? DTSTART:20251227T161500Z DTEND:20251227T171500Z UID:4435af8f-b96a-5593-be42-47a04ba5f47e CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/pwn2ro ll-who-needs-a-599-remote-when-you-have-wheelchair-py\n\nDescription:\nThi s talk depicts the reverse engineering of a popular electric wheelchair dr ive system - the Alber e-motion M25: a several thousand euro assistive dev ice that treats mobility like a SaaS subscription. Through Android app rev erse engineering\, proprietary Bluetooth protocol analysis\, hours of star ing at hex dumps (instead of the void)\, and good old-fashioned packet sni ffing\, we'll expose how manufacturers artificially limit essential featur es and monetize basic human mobility.\n\nWhat you'll learn:\n\n- how a 22- character QR code sticker\, labeled as "Cyber Security Key"\, becomes AES encryption\n- why your 6000€ wheelchair drive includes an app with Googl e Play Billing integration for features the hardware already supports\n- t he internals\, possibilities and features of electronics worth 30€ cospl aying as a 595€ medical device\n- the technical implementation of the "p ay 99.99€ or stay slow" speed limiter (6 km/h vs 8.5 km/h)\n- how nearly 2000€ in hardware and app features can be replaced by a few hundred lin es of Python\n- why the 8000€ even more premium (self-driving) variant i s literally identical hardware with a different Boolean flag and firmware plus another (pricier) remote\n\nWe'll cover the complete methodology: fro m initial reconnaissance\, sniffing and decrypting packets to reverse-engi neer the proprietary communication protocol\, to PoCs of Python replacemen ts\, tools\, techniques\, and ethical considerations of reverse engineerin g medical devices.\n\nThis is a story about artificial scarcity\, exploita tive DRM\, ethics and industry power\, and how hacker-minded creatures sho uld react and act to this.\n\nThis talk will be simultaneously interpretat ed into German sign language (Deutsche Gebärdensprache aka. DGS).\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/pwn2roll-who-needs-a-599-rem ote-when-you-have-wheelchair-py END:VEVENT BEGIN:VEVENT SUMMARY:1965 + 60 Years of Algorithmic Art with Computers DTSTART:20251227T181500Z DTEND:20251227T191500Z UID:5aaab022-3cb6-5d1a-9326-eec204bbb8f1 CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/1965-6 0-years-of-algorithmic-art-with-computers\n\nDescription:\nWe want to look at the complex topic of art created with computers\, beginning with some careful and barely noticed first experiments and emerging into an ever mor e diverse and creative field\, from different angles. In particular\, we w ant to focus on the dynamics of power and how these developments were infl uenced by their context - from social movements to political pressure.\n\n We want to start with explaining how the initial developments\, both from an artistic - concrete art - and technological - the evolution of computer s and the creation of the drawing machine Zuse Z64 in Germany and film tec hniques in the US\, respectively - took place. We will do so in the contex t of the first three exhibitions that all took place in the year 1965. The ir artworks were created by Georg Nees in Stuttgart\, A. Michael Noll with Béla Julesz in New York and Frieder Nake with Georg Nees\, again in Stut tgart.\n\nIn the following\, we will try to give an outline of further dev elopments. We provide examples how hierachies in art and science have deve loped and played a role in different events. In the domain of computer-gen erated art\, similar to other art\, there are two large influences hidden for the typical recipent of this art - galleries and critics. We will disc uss this exemplary with early exhibitions of Frieder Nake being described by the FAZ and later on\, how the east-west conflict has influenced the ar t and its exhibitions. Among other issues\, we discuss patriarchal structu res\, the commercial side of art\, how old tech is sold as revolutionary a nd how progress is still as connected with threatening feelings as in the early years.\n\nLooking back at the beginnings\, it is interesting to obse rve how artists - also with an artistic\, rather than technical background - worked with the limitations and overcame them. Fortunately\, the techno logical entry barrier to create algorithmic art yourself has drastically d ecreased over time and we want to encourage you to experiment yourself!\n \nFrieder Nake is creating algorithmic drawings and doing visual research since 1964. In 1971\, he published the influential essay "there should be no computer art" and he has been teaching computer graphics at the Univers ity of Bremen for decades. Enna Gerhard is pursuing a PhD in theory of com puter science and creates algorithmic drawings in the meantime.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/1965-60-years-of-algorithmic -art-with-computers END:VEVENT BEGIN:VEVENT SUMMARY:BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secr ets DTSTART:20251227T193000Z DTEND:20251227T203000Z UID:f09b0595-daf8-52ac-89cb-5cf5e222c3dc CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/bitunl ocker-leveraging-windows-recovery-to-extract-bitlocker-secrets\n\nDescript ion:\nIn Windows\, the cornerstone of data protection is BitLocker\, a Ful l Volume Encryption technology designed to secure sensitive data on disk. This ensures that even if an adversary gains physical access to the device \, the data remains secure and inaccessible.\n\nOne of the most critical a spects of any data protection feature is its ability to support recovery o perations in case of failure. To enable BitLocker recovery\, significant d esign changes were implemented in the Windows Recovery Environment (WinRE) . This led us to a pivotal question: did these changes introduce any new a ttack surfaces impacting BitLocker?\n\nIn this talk\, we will share our jo urney of researching a fascinating and mysterious component: WinRE. Our ex ploration begins with an overview of the WinRE architecture\, followed by a retrospective analysis of the attack surfaces exposed with the introduct ion of BitLocker. We will then discuss our methodology for effectively res earching and exploiting these exposed attack surfaces. Our presentation wi ll reveal how we identified multiple 0-day vulnerabilities and developed f ully functional exploits\, enabling us to bypass BitLocker and extract all protected data in several different ways.\n\nNotably\, the findings descr ibed reside entirely in the software stack\, not requiring intrusive hardw are attacks to be exploited.\n\nFinally\, we will share the insights Micro soft gained from this research and explain our approach to hardening and f urther securing WinRE\, which in turn strengthens BitLocker.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/bitunlocker-leveraging-windo ws-recovery-to-extract-bitlocker-secrets END:VEVENT BEGIN:VEVENT SUMMARY:Throwing your rights under the Omnibus - how the EU's reform agend a threatens to erase a decade of digital rights DTSTART:20251227T204500Z DTEND:20251227T214500Z UID:bc5b663a-1e48-5525-afbd-1e6895b71db0 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/throwi ng-your-rights-under-the-omnibus-how-the-eu-s-reform-agenda-threatens-to-e rase-a-decade-of-digital-rights\n\nDescription:\nThe new EU Commission has an agenda. What started with the report of former European Central Bank c hief Mario Draghi on Europe's "competitiveness" has quickly turned into "g etting rid of bureaucracy"\, then into "simplification"\, and finally open "deregulation". What this means is that a large number of European laws t hat were adopted in the last decade to ensure sustanabiliy\, protect human rights along the whole supply chain\, or to ensure our digital rights\, a re watered down\, and core elements are scrapped.\n\nIn terms of the EU's digital rulebook\, it has already started in May with the deletion of a co re compliance element in the General Data Protection Regulation (GDPR) - t he obligation to keep records of your processing activities. While it soun ds harmless - all the other rights and obligations still appy - it means t hat companies have no clue anymore what personal data they process\, for w hich purposes\, and how.\n\nA much larger revision has been proposed on 19 th November 2025\, with the "omnibus" legislation dubbed "Digital Simplifi cation Package". This will affect rules on data protection\, data governan ce\, AI\, obligations to report cybersecurity incidents\, and protections against cookies and other tracking technologies. Furthermore\, the EU's ne t neutrality rules are scheduled to be opened for reform in December by th e so called Digital Networks Act.\n\nIn this talk we discuss what to expec t from the new EU agenda\, who is driving it and how to resists. Our goal is to leave you better informed and equipped to fight back against this de regulatory trend. This talk may contain hope.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/throwing-your-rights-under-t he-omnibus-how-the-eu-s-reform-agenda-threatens-to-erase-a-decade-of-digit al-rights END:VEVENT BEGIN:VEVENT SUMMARY:The Eyes of Photon Science: Imaging\, Simulation and the Quest to Make the Invisible Visible DTSTART:20251227T220000Z DTEND:20251227T224000Z UID:44d1ae6d-febc-5035-8379-d2030e7f59a2 CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/the-ey es-of-photon-science-imaging-simulation-and-the-quest-to-make-the-invisibl e-visible\n\nDescription:\nX-ray imaging detectors have come a long way in the last 15 years\, turning ideas that once seemed impossible into realit ies. Imaging detectors in photon science are more than just high-speed cam eras. They are complex systems operating at the limits of what’s physica lly measurable. Understanding how they behave before\, during\, and after experiments is essential to advancing both the technology and the science it enables.\n\nIn this talk\, I’ll take you inside the world of detector simulation and performance modelling. I’ll explore how tools like Monte Carlo simulations\, sensor response models\, and system-level performance evaluations are used to:\n\n- Predict detector behaviour in extreme condi tions (such as MHz X-ray bursts)\, and\n- identify critical performance bo ttlenecks before production.\n\nBy linking imaging technology with simulat ion and modelling\, we can better interpret experimental data and design t he next generation of scientific cameras. Beyond the technical aspects\, t his talk reflects on the broader theme of how we “see” though technolo gy\, what it means to make the invisible visible\, and how simulation chan ges not only how we build instruments\, but also how we understand them.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/the-eyes-of-photon-science-i maging-simulation-and-the-quest-to-make-the-invisible-visible END:VEVENT BEGIN:VEVENT SUMMARY:Building a NOC from scratch DTSTART:20251227T225500Z DTEND:20251227T233500Z UID:ab19e1f1-ca13-531e-9d30-0ca5b0c7551c CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/buildi ng-a-noc-from-scratch\n\nDescription:\nZum Zeitpunkt der 29. Eurofurence ( also dieses Jahr) hatte das Event eine Größe erreicht\, bei der typische Event-Locations unsere speziellen Anforderungen nicht mal eben so erfüll en konnten. Beispielsweise ist eine aufwändige Audio/Video-Produktion Tei l der Eurofurence\, welche ein IP-Netz mit hoher Bandbreite\, niederiger L atenz\, niedrigem Jitter\, Multicast-Transport und präzise Zeitsynchronis ierung benötigt. Deshalb wurde dieses Jahr das _Onsite Eurofurence Networ k Operation Center_ _(EFNOC)_ gegründet. Unsere Aufgabe sollte es sein\, alle Anforderungen der anderen Teams kompetent zu erfüllen wovon wir euch in diesem Vortrag etwas aus dem Nähkästchen erzählen wollen.\n\nGrob h aben wir wärend der EF29 das Team etabliert und ein Netzwerk gebaut\, wel ches für A/V-Produktion\, Event-Koordination und Event-Management (z.B. S ecurity\, Ticketing) benutzt wurde. Unser persönliches Ziel war es außer dem\, ein benutzbares WLAN-Netzwerk für alle Besuchenden über dies gesam te Event-Venue hinweg zu schaffen – also von Halle H bis zum Vorplatz.\n Unsere Architektur bestand dafür aus einem simplen Layer2-Netzwerk mit VL AN-Unterteilung\, welches von _Arista DCS-7050TX-72Q_ mit 40Gbit/s Optiken bereitgestellt wurde. Die Aristas haben außerdem ein PTP-Signal propagie rt\, welches von einer Meinberg Master-Clock gesteuert wurde. Zusätzlich war ein Linux-Server als Hypervisor für diverse Netzwerk-Services wie DNS \, DHCP\, Monitoring und Routing im Einsatz.\nSo zumindest der Plan\, denn während des Events wurden wir mit der Realität und vielen „spaßigen “ Problemen konfrontiert.\n\nUnser Talk wird sich unter anderem mit dies en technischen Problemen beschäftigen\, allerdings den Fokus nicht nur au f die technische Darstellung legen. Stattdessen werden wir auch beleuchten \, wie wir als Team menschlich untereinander und in der Kommunikation mit anderen Teams damit umgegangen sind.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/building-a-noc-from-scratch END:VEVENT BEGIN:VEVENT SUMMARY:Lightning Talks - Tag 2 DTSTART:20251228T100000Z DTEND:20251228T120000Z UID:860a362f-4666-5fe0-9f0a-8d26485f730e CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/lightn ing-talks-tag-2\n\nDescription:\n- **Lightning Talks Introduction**\n- **C haos auf der Schiene: Die Wahrheit hinter den Verspätungen** — *poschi* \n- **EventFahrplan - The 39C3 Fahrplan App for Android** — *tbsprs*\n- **Quantum computing myths and reality** — *Moonlit*\n- **Return to attac ker.com** — *Safi*\n- **Teilchendetektor im Keller? Ich habs gemacht. Di e Theorie und der Bau einer Funkenkammer** — *Rosa*\n- **What's the most secure phone?** — *jiska*\n- **reverse engineering a cinema camera’s peripheral port** — *3nt3*\n- **Youth Hacking 4 Freedom: the European Fr ee Software competition for teenagers** — *Ana Galan*\n- **From word clo uds to Word Rain: A new text visualisation technique** — *Maria Skeppste dt*\n- **Spaß mit Brettspielen** — *Marco Bakera*\n- **Creative Commons Radio - I really didn't want to become a copyright activist!** — *Marti n*\n- **lernOS für Dich - Selbstmanagement & persönliches Wissensmanagem ent leicht gemacht** — *Simon Dückert*\n- **Was man in Bluetooth Advert isements so alles findet** — *Paul*\n- **The Sorbus Computer** — *SvOl li*\n- **AI doesn’t have to slop - Introducing an open source alternativ e to big-tech AI agents** — *Kitty*\n- **Interoperability and the Digita l Markets Act: collecting experiences from the community** — *Dario Pres utti*\n- **Leveraging Security Twin for on-demand resilience assessment ag ainst high-impact attacks** — *Manuel Poisson*\n- **A seatbelt for inner HTML** — *Frederik Braun*\n- **Toxicframe - Ghost in the Switch: Vier Ja hre Schweigen in der Netgate SG-2100** — *Wim Bonis*\n- **KI³Rat = Mens ch x Daten x Dialog** — *ceryo / Jo Tiffe*\n- **iPod Nano Reverse Engine ering** — *hug0*\n- **Interfaces For Society - Wenn Demokratie Auf Proto kollen Läuft** — *Pauline Dimmek*\n- **Security problems with electroni c invoices** — *Hanno Böck*\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/lightning-talks-tag-2 END:VEVENT BEGIN:VEVENT SUMMARY:Agentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents DTSTART:20251228T123000Z DTEND:20251228T133000Z UID:05e9ba1f-11c5-5d4e-b907-4feecc857ae5 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/agenti c-probllms-exploiting-ai-computer-use-and-coding-agents\n\nDescription:\nD uring the Month of AI Bugs (August 2025)\, I responsibly disclosed over tw o dozen security vulnerabilities across all major agentic AI coding assist ants. This talk distills the most severe findings and patterns observed.\n \nKey highlights include:\n* Critical prompt-injection exploits enabling z ero-click data exfiltration and arbitrary remote code execution across mul tiple platforms and vendor products\n* Recurring systemic flaws such as ov er-reliance on LLM behavior for trust decisions\, inadequate sandboxing of tools\, and weak user-in-the-loop controls.\n* How I leveraged AI to find some of these vulnerabilities quickly\n* The AI Kill Chain: prompt inject ion\, confused deputy behavior\, and automatic tool invocation\n* Adaptati on of nation-state TTPs (e.g.\, ClickFix) into AI ClickFix techniques that can fully compromise computer-use systems.\n* Insights about vendor respo nses: from quick patches and CVEs to months of silence\, or quiet patching \n* AgentHopper will highlight how these vulnerabilities combined could ha ve led to an AI Virus\n\nFinally\, the session presents practical mitigati ons and forward-looking strategies to reduce the growing attack surface of probabilistic\, autonomous AI systems.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/agentic-probllms-exploiting- ai-computer-use-and-coding-agents END:VEVENT BEGIN:VEVENT SUMMARY:Live\, Die\, Repeat: The fight against data retention and boundles s access to data DTSTART:20251228T134500Z DTEND:20251228T142500Z UID:693e18d6-e777-596b-a21d-dd9e9f0282e6 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/live-d ie-repeat-the-fight-against-data-retention-and-boundless-access-to-data\n \nDescription:\nThe Specter of Data Retention is back in the political are na\, both as a harmonized\, EU-wide approach as well as being part of the coalition agreement of the new German national government. Other countries have already recently implemented new data retention laws\, i.e. Belgium or Denmark. \nIn parallel\, access to all types of stored data – and not only data stored under a data retention regime – by law enforcement has been radically reformed by groundbreaking new legislation\, undermining b oth exiting national safeguards as well as protections implemented by busi nesses aiming for a higher standard in cyber security and data protection. \nThe talk will give an overview on recent developments for a harmonized “minimum” approach to data retention under the Polish and Danish EU p residency as well as the new German legislation currently under considerat ion. \nIt will introduce the upcoming international release mechanisms for stored data under the e-evidence legislation\, the 2nd protocol to the EU cybercrime convention as well as future threats from the UN cybercrime co nvention. \nIt will address how a cross-border request for information wor ks in practice\, which types of data can be requested by whom\, and who wi ll be responsible for the few remaining safeguards – including an analys is of the threat model and potential “side channel” attacks by cybercr ime to gain access to basically all data stored by and with service provid ers.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/live-die-repeat-the-fight-ag ainst-data-retention-and-boundless-access-to-data END:VEVENT BEGIN:VEVENT SUMMARY:Amateurfunk im All – Kontakt mit Fram2 DTSTART:20251228T144000Z DTEND:20251228T152000Z UID:0df52094-ee30-5d05-bf48-573a5eae1a8d CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/amateu rfunk-im-all-kontakt-mit-fram2\n\nDescription:\nSchon kurz nachdem die ers ten Satelliten den Weltraum eroberten\, waren auch Amateurfunkende dabei u nd brachten ihr Hobby in dieses Feld ein. Auch bei Fram2\, der ersten bema nnten Mission\, die beide Polarregionen überflog\, war der Sprechfunkkont akt mit einer Universität fest eingeplant.\n\nDer studentische Funkclub " AFuTUB" (https://dk0tu.de) an der TU Berlin hat die Crew der Fram2 angefun kt – mit einem experimentellen Funksetup\, das für viele von uns Neulan d war.\n\nWir geben Einblicke in zwei intensive Wochen Planung\, Koordinat ion und Aufbau\, den Betrieb einer (improvisierten) Bodenstation\, spreche n über technische Hürden\, Antennendesign und Organisation – und wie w ir schließlich mit der Astronautin Rabea Rogge im Weltraum gefunkt haben. \n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/amateurfunk-im-all-kontakt-m it-fram2 END:VEVENT BEGIN:VEVENT SUMMARY:Lessons from Building an Open-Architecture Secure Element DTSTART:20251228T153500Z DTEND:20251228T161500Z UID:0c6e2d25-7014-5aaf-9c6a-b4347f0ff85c CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/lesson s-from-building-an-open-architecture-secure-element\n\nDescription:\nThis talk shares our engineering experience from designing and implementing an open-architecture secure element — a type of chip that is traditionally closed and opaque. We’ll outline the practical consequences of choosing openness as part of the security model: how it affected hardware architect ure\, firmware design\, verification\, and development workflows.\nThe ses sion dives into concrete technical areas including the secure boot chain\, attestation and update flow\, key storage isolation\, and the testing and fuzzing infrastructure used to validate the design. It also covers the bo undaries of openness — where third-party IP\, export control\, or certif ication requirements force certain blocks to remain closed — and how we document and mitigate those limits.\nWe’ll present anonymized examples o f external security evaluations\, show how responsible disclosure and tran sparent fixes improved resilience\, and reflect on what “community-drive n security” means in a hardware context. Attendees should leave with a c learer view of what it takes to make security verifiable at the silicon le vel — and why that process is never finished.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/lessons-from-building-an-ope n-architecture-secure-element END:VEVENT BEGIN:VEVENT SUMMARY:Variable Fonts — It Was Never About File Size DTSTART:20251228T163500Z DTEND:20251228T171500Z UID:62a4c15d-6efb-5d85-b41d-5363e08ebeae CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/variab le-fonts-it-was-never-about-file-size\n\nDescription:\nWhen the OpenType 1 .8 specification introduced variable fonts in 2016\, the idea was simple: combine all weights and styles of a font family into one file and save fil e size and therefore bandwidth. Yet in 2025\, variable fonts have become a platform for artistic and technical exploration far beyond their initial goal.\n\nThis talk follows that transformation from the inside. It starts with a short history of flexible font technologies — Adobe’s Multiple Master and Apple’s TrueType GX formats of the 1990s (I am just mentionin g the company names as they were the publishers of these technologies) — and how they failed to become standards. It then shows why variable fonts succeeded: many designers today are more tech savvy and know some basic H TML\, CSS and maybe even some JavaScript. And at the same time all major b rowsers and almost all design apps support variable fonts by now.\n\nFrom there\, I present a series of first-hand projects where typography met co de:\n– TypoLabs (2017)\, whose identity used a custom variable font anim ating between extremes of weight and width → the variable font family be came the (probably forever) unpublished variable font family Denman\;\n– Marjoree (2024)\, a pair of variable pattern fonts based on hexagonal and pentagonal tilings that explore legibility and repetition\;\n– Kario (2 025)\, a duplex variable font powering the 39C3 identity\, with uniwidth w eights\, optical-size adjustments\, and typographic Easter eggs\;\n– and Bronco (2017?)\, an experiment using the arbitrary-axis model for interpo lation to escape the cube-shaped multiple master design space of tradition al variable fonts.\n\nThe talk then moves from history to speculation. Ear ly head-tracking experiments once tried to adjust a variable font’s opti cal size based on reader position — producing total chaos as text reshap ed itself while being read. On the other hand this playful chaos marks the moment when things become truly interesting: connecting a font axis to li ve data\, to mouse movement\, to sound\, to network input — anything tha t makes type responsive and alive. That’s the kind of misbehavior I want to talk about — not breaking for the sake of breaking\, but using techn ology the “wrong” way to see what happens.\n\nThe talk will mix images \, a lot of short videos\, and a bit of behind-the-scenes insight into fon t development. It’s about what happens when design tools meet code\, and how that intersection keeps typography alive and unpredictable.\n\nLink l ist of variable font experiments:\nhttps://kario.showmefonts.com/\nhttps:/ /marjoree.showmefonts.com/\nhttps://www.bronco.varfont.com/\nhttps://www.d enman.varfont.com/\nhttps://www.seraphs.varfont.com/\n+ 39C3 visual identi ty\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/variable-fonts-it-was-never- about-file-size END:VEVENT BEGIN:VEVENT SUMMARY:Amtsgeheimnis raus\, Datenhalde rein: was die Informationsfreiheit in Österreich bringt DTSTART:20251228T181500Z DTEND:20251228T185500Z UID:7557e54c-89e9-530d-aafb-8736570661d4 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/amtsge heimnis-raus-datenhalde-rein-was-die-informationsfreiheit-in-osterreich-br ingt\n\nDescription:\nDie Kampagne – wie aus "binnen zwei Wochen" mehr a ls elf Jahre wurden\nDie Strategien – die man übernehmen kann\nDer Verg leich – wie ist Österreichische IFG im Vergleich zum Deutschen\, und is t das der richtige\nDie (besten) Preisträger – aus mehr als zehn Jahren des Schmähpreises "Mauer des Schweigens"\nDie Datenhalde – mit Aufruf \, was aus dem Datenberg zu machen\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/amtsgeheimnis-raus-datenhald e-rein-was-die-informationsfreiheit-in-osterreich-bringt END:VEVENT BEGIN:VEVENT SUMMARY:Prometheus: Reverse-Engineering Overwatch DTSTART:20251228T191000Z DTEND:20251228T195000Z UID:d08f6f41-a731-57f7-ba40-8f38464f2dcd CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/promet heus-reverse-engineering-overwatch\n\nDescription:\nHey you! Yes you! Do y ou want to pay for a game which gets forcibly taken away from you after on ly six years? Do you want to buy lootboxes in order to unlock cosmetics fa ster in the game you „own“?\n\nOverwatch 1 was released in 2016 to cri tical acclaim and millions of sales globally. It has permanently changed t he hero-shooter landscape which was in much need of a fresh new game and p laystyle. After a few hard years plagued with infrequent updates\, long ov erdue hero nerfs / reworks and broken promises\, Overwatch 1 was finally t aken offline on October 3\, 2022.\n\nEver since I started playing Overwatc h I was fascinated by the game and it’s proprietary engine\, Tank. Not m uch is known about it\, only that core components were reused from the can celled Blizzard IP\, Titan. It’s a shame that this game (engine) is not getting the recognition it deserves. From the entity-component architectur e to the deterministic graph based scripting engine which handles (almost) everything which happens ingame\, it is a truly refreshing take on networ king and game programming rarely seen in games. So\, considering this\, bu ilding a game server from scratch can’t be that hard\, riiiight?\n\nJoin me in this documentation of my gradual descent into madness while I (joki ngly) roast Overwatch developers for code which they probably do not even remember that theyve written 10+ years ago :)\n\nAll research presented in this talk was done on the first archived\, still publicly available versi on which I could find\, 0.8.0.0 Beta (0.8.24919)\, which got uploaded to a rchive.org.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/prometheus-reverse-engineeri ng-overwatch END:VEVENT BEGIN:VEVENT SUMMARY:Wie wir alte Flipperautomaten am Leben erhalten DTSTART:20251228T200500Z DTEND:20251228T204500Z UID:1511188c-92ca-5002-b411-591b5f848e14 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/wie-wi r-alte-flipperautomaten-am-leben-erhalten\n\nDescription:\nDer Vortrag gib t einen Einblick in die verschiedenen Generationen von Flippern und deren Technik. Angefangen von elektromechanischen Geräten aus den frühen Sechz igern\, über erste Prozessorsteuerungen\, bis hin zu modernsten computerg esteuerten Automaten mit Bussystemen. Jede Generation hat ihre technischen Eigenheiten\, ihre typischen Fehlermuster und Schwachstellen. \nIn öffen tlichen Räumen sind heutzutage kaum mehr Flipper anzutreffen. Das liegt i nsbesondere daran\, dass deren Wartung aufwändig ist\, weil durch die mec hanische Beanspruchung häufig Fehler auftreten. Bereits kleinste technisc he Probleme können den Spielspaß zunichte machen.\nDas Finden und Behebe n von Fehlern erfordert viel Erfahrung – und manchmal Kreativität\, ins besondere wenn alte Bauteile nicht mehr verfügbar sind oder kaum Dokument ation vorhanden ist. Technisch ist Sachverstand auf vielen Ebenen erforder lich\, vom Schaltplanlesen über Löten und elektronische Messtechnik\, bi s hin zu mechanischem Know-how.\nDie Community der Flipper-Enthusiasten is t allerdings groß und kooperativ\, sodass auch private Sammler ihre Flipp er am Laufen halten können.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/wie-wir-alte-flipperautomate n-am-leben-erhalten END:VEVENT BEGIN:VEVENT SUMMARY:How To Minimize Bugs in Cryptography Code DTSTART:20251228T210500Z DTEND:20251228T214500Z UID:3f442497-4f90-5868-ac13-3f4b0f857c59 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/how-to -minimize-bugs-in-cryptography-code\n\nDescription:\nOver the last 10 year s or so\, using mathematical proof assistants and other formal-logic tools for cryptography code has gone from a relatively new idea to standard pra ctice. I've been lucky enough to have a front-row seat to that transformat ion\, having started doing formal-methods research in 2015 and then switch ed to a focus on cryptography implementation since 2021. Code from my mast er's thesis project\, ["fiat-crypto"](https://github.com/mit-plv/fiat-cryp to)\, is [included](https://andres.systems/fiat-crypto-adoption.html) in e very major browser as well as AWS\, Cloudflare\, Linux\, OpenBSD\, and sta ndard crypto libraries for Go\, Zig\, and Rust (RustCrypto\, dalek). In ad dition to verifying code correctness\, designers of high-level protocols l ike Signal's recently announced post-quantum ratchet increasingly use math ematical tools (ProVerif in Signal's case) to check their work.\n\nDespite the growing popularity of these formal techniques and their relevance to personal information security\, few people are aware of them\, and they ma intain a reputation for being hard to learn and esoteric. I'd like to demy stify the topic and show examples of how anyone can use proof assistants i n small\, standalone ways as part of the coding or design process. My hope is that next time a colleague asks for review of a complex high-speed bit -twiddling algorithm\, instead of staring at the code line-by-line\, atten dees of my talk will know they can write a computer-checked proof to confi rm or deny that the algorithm achieves its intended result.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/how-to-minimize-bugs-in-cryp tography-code END:VEVENT BEGIN:VEVENT SUMMARY:When Vibe Scammers Met Vibe Hackers: Pwning PhaaS with Their Own W eapons DTSTART:20251228T220000Z DTEND:20251228T224000Z UID:9c5f59ba-255e-5446-9b31-13eebef85810 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/when-v ibe-scammers-met-vibe-hackers-pwning-phaas-with-their-own-weapons\n\nDescr iption:\nOur journey began with a simple question: why are so many people losing money to fake convenience store delivery websites? The answer led u s through two distinct criminal architectures\, both exhibiting characteri stics of large language model–assisted development.\n\nCase 1 ran on PHP with backup artifacts exposing implementation details and query manipulat ion opportunities. The installation package itself contained pre-existing access mechanisms—whether this was developer insurance or criminal-on-cr iminal sabotage remains unclear. We leveraged initial access to bypass sec urity restrictions using protocol-level manipulation and extracted gigabyt es of operational data.\n\nCase 2 featured authentication bypass vulnerabi lities that granted direct administrative access. The backend structure re vealed copy-pasted code patterns without proper security implementation.\n \nThroughout both systems\, we observed telltale signs of AI-generated cod e: verbose documentation in unexpected languages\, inconsistent coding pat terns\, textbook-like naming conventions\, and theoretical security implem entations. Even the UI revealed LLM fingerprints—overly polished compone nt layouts\, placeholder text patterns\, and design choices that felt dist inctly "tutorial-like." These weren't experienced developers—they were o perators deploying what LLMs gave them without understanding the internals .\n\nThe irony? We used AI extensively too: for data parsing\, pattern rec ognition\, attack surface mapping\, and intelligence queries. The differen ce was intentionality—we understood what the output meant.\n\nUsing open -source intelligence platforms and carefully crafted fingerprints\, we map ped over a hundred active domains following similar patterns. Each one sha red the same architecture\, the same weaknesses\, the same developer mista kes. This repeatability became our advantage. When scammers can redeploy i nfrastructure in days\, you don't attack individual sites—you automate t he entire reconnaissance-to-evidence pipeline.\n\nThis talk demonstrates p ractical techniques for mass-scale fraud infrastructure fingerprinting\, o perational security considerations when investigating active criminal oper ations\, and methods to recognize AI-generated code patterns that reveal t hreat actor sophistication. We'll discuss the ethical boundaries of counte r-fraud operations and evidence preservation for law enforcement\, along w ith automation strategies for sustainable threat intelligence when adversa ries rebuild faster than you can report. The demonstration will show how t o go from a single suspicious domain to a network map of 100+ sites and th ousands of victim records—using tools available to any researcher.\n\nTh is isn't a story about elite hackers versus criminal masterminds. It's abo ut two groups equally reliant on AI vibing their way through technical pro blems—one for fraud\, one for justice. The skill barrier has collapsed. The question now is: who has better context\, better ethics\, and better c offee?\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/when-vibe-scammers-met-vibe- hackers-pwning-phaas-with-their-own-weapons END:VEVENT BEGIN:VEVENT SUMMARY:The Small Packet of Bits That Can Save (or Destabilize) a City DTSTART:20251228T225500Z DTEND:20251228T233500Z UID:0cc2fd2c-93de-5cb0-b10d-56e901b4acc4 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/the-sm all-packet-of-bits-that-can-save-or-destabilize-a-city\n\nDescription:\nIn this talk\, we’ll begin by contextualizing the importance of the seismi c alert in Mexico City\, a system born from the devastating 1985 earthquak e. We’ll examine how it was designed\, how it works\, and why it carries such a deep psychological impact.\n\nFrom there\, we’ll explore the his tory and design of Weather Radio and the SAME protocol\, looking at how me ssages are transmitted and encoded through this technology\, and how it wa s later adapted for SASMEX.\n\nI’ll also share my personal experience bu ilding compatible receivers\, from early open-source experiments that insp ired local manufacturers to create government-certified devices\, to devel oping a receiver as part of my undergraduate thesis.\n\nWe’ll analyze ho w simplicity\, one of the key strengths of these systems\, also introduces certain risks\, and how these trade-offs emerge when dealing with accessi bility\, interoperability\, and security in system design.\n\nFinally\, I ’ll demonstrate how to receive\, decode\, and encode these alert message s\, and discuss how\, with the right equipment\, it’s possible to genera te such alert signals.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/the-small-packet-of-bits-tha t-can-save-or-destabilize-a-city END:VEVENT BEGIN:VEVENT SUMMARY:Lightning Talks - Tag 3 DTSTART:20251229T100000Z DTEND:20251229T120000Z UID:7fe75d23-5966-5dca-a736-e7664a475be3 CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/lightn ing-talks-tag-3\n\nDescription:\n- **Lightning Talks Introduction**\n- **" Oma\, erzähl mir von der Zukunft" oder: Wie wir weiter interessante Sache n machen\, ohne den Planeten zu ruinieren 🌱** — *EstherD*\n- **Don't abuse the ecosystem: against overloading "ecosystem'** — *michele*\n- * *The Climatepoetry.org video tool** — *Magnus Ahltorp*\n- **Neo-Kolonial ismus & Katzenbilder - Installation zur Lieferkette von GenAI** — *Rike* \n- **Build social inventories with StashSphere** — *Maximilian Güntner *\n- **Invitation to the Fermentation Camp "Kvas 2026"** — *algoldor*\n- **Stretching nginx to its limits: a music player in the config file** — *Eloy*\n- **2D Graphics Creation with Graphite - How to Build a Hackable Graphics Editor** — *Dennis Kobert*\n- **The Modulator: a Custom Control ler for Live Music Performance** — *Jakob Kilian*\n- **Find hot electron ic devices for cheap using Lock-In Thermography** — *Clemens Grünewald* \n- **Those Who Control** — *Andreas Haupt*\n- **SearchWing - Search&Res cue Drones** — *searchwing team*\n- **Reducing E-Waste With The Reverse Engineering Toolkit** — *Raaf*\n- **Genetic engineering with CRISPR/Cas9 : how far are we today from biopunk?** — *Dmytro Danylchuk*\n- **Discove ring the Orphan Source Village** — *Martin Hamilton*\n- **kicoil - gener ate planar coils in any shape for PCBs and ICs** — *jaseg*\n- **Trade Of fer: Pentest Data for CTF Points** — *Sebastian*\n- **Soziologische Gabe ntheorie - Grundlage für die Bewertung von Social Media?** — *sozialwel ten*\n- **Hacking ID3 MP3 Metadata** — *Danilo Erazo*\n- **ICANN HAZ .ME OW? How we're (trying to) make a TLD out of sheer audacity** — *dotMeow (Aris\, Ela\, LJ\, Wordloc)*\n- **Shitty Robots** — *Neo*\n- **UNIX v4** — *aap*\n- **WissKomm Wiki - Bibliothek für Videos und Podcasts** — *TimBorgNetzWerk*\n- **Lightning** — *Vi*\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/lightning-talks-tag-3 END:VEVENT BEGIN:VEVENT SUMMARY:Watch Your Kids: Inside a Children's Smartwatch DTSTART:20251229T125000Z DTEND:20251229T133000Z UID:b51eb883-55db-5e30-9685-f7726b4da4d1 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/watch- your-kids-inside-a-children-s-smartwatch\n\nDescription:\nSmartwatches for children have entered the mainstream: Advertised on the subway and sold b y your cell provider\, manufacturers are charging premium prices comparabl e to an entry-level Apple watch.\n\nIn exchange\, parents are promised pea ce of mind: A safe\, gentle introduction into the world of technology — and a way to call\, text\, and locate their child at any time.\n\nBut how much are the vendor's promises of safety\, privacy\, GDPR compliance\, app s made in Europe and cloud servers in Germany actually worth?\n\nWe take y ou along the process of hacking one of the most popular children's watches out there\, from gaining initial access to running our own code on the wa tch. Along the way\, we find critical security issues at every turn. Our P oC attacks allow us to read and write messages\, virtually abduct arbitrar y children\, and take control over any given watch.\n\nFinally\, we'll als o talk about disclosure\, funny ideas of what passes as a security fix\, a nd how we can use what we found to build something better.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/watch-your-kids-inside-a-chi ldren-s-smartwatch END:VEVENT BEGIN:VEVENT SUMMARY:Making the Magic Leap past NVIDIA's secure bootchain and breaking some Tesla Autopilots along the way DTSTART:20251229T134500Z DTEND:20251229T144500Z UID:b98918cb-489e-5f5e-aa06-26753cb48418 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/making -the-magic-leap-past-nvidia-s-secure-bootchain-and-breaking-some-tesla-aut opilots-along-the-way\n\nDescription:\nIn mid 2024\, a friend approached m e about Magic Leap making their TX2 based XR headsets little more than a p aperweight by disabling the mandatory activation servers. I morally dislik e this\, companies shouldn't turn functional devices into e-waste just bec ause they want to sell newer devices.\n\nAfter obtaining one\, and poking at the Fastboot implementation\, I discovered it was based off NVIDIA's Fa stboot implementation\, which is source available. I found a vulnerability in the NVIDIA provided source code in how it unpacks SparseFS images (nam ed sparsehax)\, and successfully blindly exploited the modified implementa tion on the Magic Leap One. I also found a vulnerability in it that allowe d gaining persistence via how it loads the kernel DTB (named dtbhax).\n\nS till unsatisfied with this\, I used fault injection to dump the BootROM fr om a Tegra X2 devkit.\n\nIn the BootROM I discovered a vulnerability in th e USB recovery mode. Exploiting this vulnerability proved difficult due to only having access to memory from the perspective of the USB controller. I will explain what was tried\, why it didn't work\, and how I eventually got code execution at the highest privilege level via it.\n\nAs I will dem onstrate\, this exploit also functions on Tesla's autopilot hardware.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/making-the-magic-leap-past-n vidia-s-secure-bootchain-and-breaking-some-tesla-autopilots-along-the-way END:VEVENT BEGIN:VEVENT SUMMARY:APT Down and the mystery of the burning data centers DTSTART:20251229T150000Z DTEND:20251229T160000Z UID:11d5c612-0e50-500b-b071-c4ba0dd076cd CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/apt-do wn-and-the-mystery-of-the-burning-data-centers\n\nDescription:\nIn August 2025 Phrack published the dump of an APT member's workstation. The attacke r was most likely Chinese\, working on targets aligned with North Korea's doctrine. The dump was full of exploits\, attacker tools and loot. Data fr om government networks\, cell carriers and telcos\, including server datab ases and loads or private keys stemming from the government PKI. The attac ker had maintained a steady foothold in various targets in South Korea and Taiwan before accidentally "losing" their workstation.\n\nThe dump sparke d a government investigation\, and big corporations like LG\, Lotte and Ko rea Telecom were asked to explain themselves. The government also mandated an on-site audit in the data center where the hacks had taken place. On t he day of the audit\, some li-ion batteries in the data center mysteriousl y caught fire. The blaze destroyed close to 100 servers (which had no back up) and plunged public service in South Korea into disarray. \nShortly aft er\, the Lotte data center burned as well - the corporation had been victi m of a breach recently\, albeit by a different threat actor. In the beginn ing of October\, one of the officers examining the government data center fire tragically died by his own hand.\n\nThe talk aims to revisit this mys terious sequence of events that was started by an article in Phrack [#72]( https://hub.test.c3voc.de/tag/72). It doesn't hope to give answers or a so lution\, but narrates a story that could be from a spy thriller. Caution: Conspiracies and technical gore could be present.\n[TW: Suicide\, self-har m]\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/apt-down-and-the-mystery-of- the-burning-data-centers END:VEVENT BEGIN:VEVENT SUMMARY:Wer liegt hier wem auf der Tasche? Genug mit dem Bürgergeld-Fetis ch. Stürmt die Paläste! DTSTART:20251229T161500Z DTEND:20251229T171500Z UID:1e0b17f8-d1e2-5d75-b052-811b8f722b38 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/wer-li egt-hier-wem-auf-der-tasche-genug-mit-dem-burgergeld-fetisch-sturmt-die-pa laste\n\nDescription:\nDie neue Grundsicherung trumpft Hartz IV in seiner Grausamkeit und ist ein Damoklesschwert über Erwerbslosen und allen\, die Lohnarbeit machen. Zugleich nimmt die Zahl der Milliardäre und Mulitmill ionäre stetig zu. Finanzbetrug durch Überreiche wird mehr oder weniger t atenlos zugesehen\, während das Phantom des Bürgergeld-Totalverweigerers seit Jahren durch die Medien getrieben wird.\n\nWie der Angriff auf den S ozialstaat sich auf die Betroffenen in der Praxis auswirkt und was wir als Zivilgesellschaft tun können\, um nicht nur tatenlos zusehen zu müssen \, darum geht es in diesem Talk.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/wer-liegt-hier-wem-auf-der-t asche-genug-mit-dem-burgergeld-fetisch-sturmt-die-palaste END:VEVENT BEGIN:VEVENT SUMMARY:Transkultureller Hack auf die klassische Musikszene – Vortrag un d Konzert DTSTART:20251229T181500Z DTEND:20251229T194500Z UID:cc2dc346-c1fc-58ad-a723-8472c9a8e5d1 CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/transk ultureller-hack-auf-die-klassische-musikszene-vortrag-und-konzert\n\nDescr iption:\nDas transkulturelle Bridges Kammerorchester hackt die klassische Musikszene: es bringt Musizierende mit und ohne Flucht- und Migrationsbiog rafie zusammen und integriert Instrumente und Musikstile in die europäisc he Orchestertradition\, die dort traditionell nicht vorgesehen sind. Neben klassischen Orchesterinstrumenten spielen Instrumente wie Oud\, Tar\, Tip le\, Kaval\, Kamanche\, Shudraga\, Daf und Riq zentrale Rollen.\n\nIhre Mu sik komponieren die Orchestermitglieder überwiegend selbst. Auch das ist ein Hack auf die klassische Musikszene\, die bisher überwiegend Werke ver storbener männlicher Komponisten interpretiert. So steht die Musik des Br idges Kammerorchester für Vielfalt und Selbstbestimmung und macht die Div ersität der in Deutschland lebenden Gesellschaft hörbar. \nIm Vortrag ze igen Mitglieder des Bridges Kammerorchesters anhand von Erfahrungen und H örbeispielen – live und per Video – wie sie die klassische Musikszene hacken. Sie geben Einblicke in ihren kollektiven\, heterogenen Kompositio nsprozess\, berichten von Freiheiten\, Herausforderungen und Erfahrungen m it Publikum und Veranstaltern. Persönliche Migrationsgeschichten verdeutl ichen\, wie diese die musikalische Perspektive und Identität des Orcheste rs prägen. Anschließend folgt ein Konzert\, das die Vielfalt ihrer Musik erlebbar macht.\n\n*Eine Aufzeichnung dieser Session ist verfügbar [auf dem YouTube-Kanal von Bridges](https://youtu.be/R0kzNxpKaJQ).*\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/transkultureller-hack-auf-di e-klassische-musikszene-vortrag-und-konzert END:VEVENT BEGIN:VEVENT SUMMARY:Race conditions\, transactions and free parking DTSTART:20251229T200500Z DTEND:20251229T204500Z UID:28fc102e-a38e-51b2-a48b-530b0d0e49a9 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/race-c onditions-transactions-and-free-parking\n\nDescription:\nAfter the [Air Fr ance-KLM dataleak](https://media.ccc.de/v/37c3-lightningtalks-58027-air-fr ance-klm-6-char-short-code) I kept repeating this was not a real hack\, an d confessed I always wanted to hack a system based on triggering race cond itions because the lack of proper transactions.\nThis was way easier than expected. In this talk I will show how just adding `$ seq 0 9 | xargs -I@ -P10 ..` can break some systems\, and how to write safe database transacti ons that prevent abuse.\n\nIn this talk I will explain what race condition s are. Many examples of how and why code will fail. How to properly create a database transaction. The result of abusing this in real life (e.g. fre e parking).\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/race-conditions-transactions -and-free-parking END:VEVENT BEGIN:VEVENT SUMMARY:Light in the Dark(net) DTSTART:20251229T210500Z DTEND:20251229T214500Z UID:414813ee-69f4-56ee-a013-f887f26d91d6 CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/light- in-the-dark-net\n\nDescription:\nOnion services can be considered one of t he most controversial aspects of the Tor network\, because they allow the anonymous hosting of services\, which has enabled the creation of illegal services which are difficult for law enforcement to shut down. Defenders a rgue that this is a price worth paying to ensure free speech for people wh o could otherwise not speak up or run their own services.\n\nThis obviousl y raises the question what onion services are being actually used for in p ractice. Many researchers have tried to answer this question in the past. Based on their work we already know a few things:\n\n- 9% of all Websites on the Darknet are marketplaces [1]\n- 2.7% of all Websites on the Darknet are marketplaces [2]\n- 50% of all Websites on the Darknet are marketplac es [3]\n- 8.4% of all Websites on the Darknet are marketplaces [4]\n- 27% of all Websites on the Darknet are marketplaces [5]\n- 34.8% of all Websit es on the Darknet are marketplaces [6]\n\nNo\, this is not a copy and past e error\, all of the above statements can be found in peer-reviewed scient ific publications. All of these results are valid on their own and constit ute valuable contributions to science\, but it does not take an expert to notice the contradictions in their findings. \nThe reasons for these inco nsistencies are the main topic of this talk. We will discuss the informati on available to researchers and the limitations originating from it. Chall enges and current disagreements when it comes to interpreting available da ta will be addressed along with common misrepresentations of research resu lts. We will highlight how the choice of data sources can predetermine the final result before a study has even begun\, how minor changes to definit ions can lead to completely different results and how important context is when interpreting data.\n\nArmed with this knowledge\, we can tackle the challenge to find out what we know about the Darknet\, what we might figur e out in the future\, what we can reasonably assume but will never be able to prove\, and what we will (hopefully) never know.\n\n------------------ -----------------------\nSources\n[1] https://doi.org/10.1049/iet-ifs.2015 .0121\n[2] https://doi.org/10.1016/j.future.2024.03.025\n[3] https://doi.o rg/10.1145/3600160.3600167\n[4] https://doi.org/10.1109/INFOCOM53939.2023. 10229057\n[5] https://doi.org/10.1109/ICDCSW.2014.20\n[6] https://doi.org/ 10.1080/00396338.2016.1142085\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/light-in-the-dark-net END:VEVENT BEGIN:VEVENT SUMMARY:Human microservices at the Dutch Railways: modern architecture\, a ncient hardware? DTSTART:20251229T220000Z DTEND:20251229T230000Z UID:f894f246-6bd4-5750-a66b-d073e37b7acd CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/human- microservices-at-the-dutch-railways-modern-architecture-ancient-hardware\n \nDescription:\nWhen a train breaks down in the Netherlands\, a system of interconnected humans is shifted into gear. The current state of that syst em has been developed for over 80 years and as such should be seen as an a rchitectural marvel. Even though there is nowadays a significant amount of software involved in the process\, the people involved are still very muc h necessary.\n\nThis talk describes the processes and roles involved in th e Dutch railway day to day operations. We will start at a broken down trai n on a busy track and work our way towards solutions including dragging th e train\, evacuating travelers and redirecting other trains on that trajec tory. We will explore this from a software developer's perspective. We wil l consider the people involved as an ancient form of hardware\, and the pr otocols between them as software. We will also go over the more modern add itions to the system: phone lines and software running on actual computers .\n\nAfter our investigation you will have a new understanding of the comp lexity of running a railway network. And we will ask ourselves: is this an outdated system that needs to be digitized? Or is this actually a modern system with microservices and a "human in the loop"?\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/human-microservices-at-the-d utch-railways-modern-architecture-ancient-hardware END:VEVENT BEGIN:VEVENT SUMMARY:Spectre in the real world: Leaking your private data from the clou d with CPU vulnerabilities DTSTART:20251229T231500Z DTEND:20251229T235500Z UID:f1e6f4e2-875f-573c-9e68-8dfd52e29225 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/spectr e-in-the-real-world-leaking-your-private-data-from-the-cloud-with-cpu-vuln erabilities\n\nDescription:\nSeven years ago\, Spectre and Meltdown were a nnounced. These two vulnerabilities showed that instructions executed by t he CPU might accidentally access secret data. This secret data can contain files cached from disk\, cryptographic keys\, private information\, or an ything else that might be stored in memory. An attacker can use Spectre to learn the value of that secret data\, even though the attacker is not sup posed to have access to it.\n\nEven though this sounds problematic\, there is a reason why these type of vulnerabilities haven't had a significant r eal-world impact. Mitigations make it much harder to pull off\, and an att acker needs a form of remote code execution anyway to trigger the relevant CPU instructions. If an attacker can already execute arbitrary code\, the n Spectre is probably not what you should be worried about. For regular us ers\, these CPU vulnerabilities are likely not that much of a threat.\n\nH owever\, that is not the case for public cloud providers. Their business m odel is to provide *remote code execution as a service*\, and to rent out shared hardware resources as efficiently as possible. Customers run their system in an seemingly isolated virtual machine on top of shared physical hardware. Because customers can run anything they want on these systems\, public cloud providers must treat these workloads as untrusted. They have to assume the worst case scenario\, i.e. that an attacker is deliberately trying violate the confidentiality\, integrity or availability of their sy stems\, and\, by extension\, their customers' systems. For transient execu tion vulnerabilities like Spectre\, that means that they enable all reason able mitigations\, and some more.\n\nIn this talk\, we show that transient execution attacks can be used on real-world systems\, despite the deploye d software mitigations. We demonstrate this by silently leaking secret dat a from another virtual machine at a major global cloud provider\, defeatin g virtual machine isolation without leaving a trace. Additionally\, we'll discuss our coordinated disclosure process\, the currently deployed mitiga tions and how future mitigations could address the issue.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/spectre-in-the-real-world-le aking-your-private-data-from-the-cloud-with-cpu-vulnerabilities END:VEVENT BEGIN:VEVENT SUMMARY:I Hated All The Cross-Stitch Software So I Made My Own: My Derange d Outsider Software Suite For Making Deranged Outsider Art DTSTART:20251230T100000Z DTEND:20251230T104000Z UID:c43046a1-bac9-54d3-a551-d86630e7ab3b CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/i-hate d-all-the-cross-stitch-software-so-i-made-my-own-my-deranged-outsider-soft ware-suite-for-making-deranged-outsider-art\n\nDescription:\nDesigning cro ss-stitch patterns\, I got frustrated with all the programs which expected me to click around a canvas setting individual pixels. I wanted a cross-s titch design software suite that I could drive with a Makefile\, which cou ld give me an interactive interface for stitching or compile them to PDF. In short\, I wanted to say `echo "shutdown -h now" | embellish --border | export pattern --pdf` and get a design worthy of stitching on a pillow.\n \nSo\, I made the thing I wanted. I'll discuss the many yak shaves along t he way (proprietary file format reverse-engineering\, OAuth2\, what 'color ' even means\, unikernel hosting\, and more). I'll talk a bit about the jo y of making something so you can make something\, and how it feels to craf t software that is unapologetically personal.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/i-hated-all-the-cross-stitch -software-so-i-made-my-own-my-deranged-outsider-software-suite-for-making- deranged-outsider-art END:VEVENT BEGIN:VEVENT SUMMARY:“End Of 10”: How the FOSS Community is Combatting Software-Dri ven Resource and Energy Consumption DTSTART:20251230T105500Z DTEND:20251230T113500Z UID:910e5f22-945b-5196-8e21-246acbcaadd3 CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/end-of -10-how-the-foss-community-is-combatting-software-drive-resource-and-energ y-consumption\n\nDescription:\nThis is a talk about digital sustainability and the role software plays in hardware longevity. At the 38C3\, the End Of 10 campaign held a workshop to co-ordinate contributions across FOSS co mmunities. Many people currently involved started contributing after this workshop\, including 2 of the 3 presenters.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/end-of-10-how-the-foss-commu nity-is-combatting-software-drive-resource-and-energy-consumption END:VEVENT BEGIN:VEVENT SUMMARY:Fossile Industrie liebt KI! DTSTART:20251230T115000Z DTEND:20251230T123000Z UID:49ceb68c-bcbe-592f-9c62-b1085f657190 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/fossil e-industrie-liebt-ki\n\nDescription:\nObwohl die negativen Klimaauswirkung en generativer KI immer deutlicher werden\, sollen in ganz Europa Großrec henzentren gebaut werden und Deutschland „KI-Nation“ werden\, was unge ahnte „Wirtschaftskräfte freisetzen soll“ – zumindest\, wenn es nac h der Bundesregierung geht.\n\nDer Ausbau der Recheninfrastruktur für gen erative KI benötigt viel Energie\, Wasser und Ressourcen\, was global zu Umweltschäden führt. Prognosen für die EU zeigen\, dass der Energieverb rauch in Zukunft so groß werden könnte\, dass der Ausbau der erneuerbare n Energien nicht mithalten kann – doch die fossile Industrie steht berei ts in den Startlöchern.\n\nDer Hype um generative KI liefert ihnen die pe rfekte Begründung für den Ausbau fossiler Infrastruktur- mitten in der e skalierenden Klimakrise. Tech- und Fossilkonzerne investieren massiv in ne ue Gaskraftwerke für energiehungrige Rechenzentren. Dabei ist der wirtsc haftliche Nutzen und die Wertschöpfung durch die Technologie weiterhin un klar.\nKlar ist: wir erleben derzeit eine fossile Gegenoffensive im Gewand digitaler Versprechen. Auf Kosten des Klimas und der Zukunft.\n\nDieser V ortrag schließt an den Talk "Klimaschädlich by Design" vom 38C3 an und g ibt Updates zu Entwicklungen in Deutschland und Europa.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/fossile-industrie-liebt-ki END:VEVENT BEGIN:VEVENT SUMMARY:We\, the EU\, and 1064 Danes decided to look into YouTube: A story about how the EU gave us a law\, 1064 Danes gave us their YouTube histori es\, and reality gave us a headache DTSTART:20251230T125000Z DTEND:20251230T133000Z UID:d397c338-c631-5a03-a335-e3043d49188c CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/we-the -eu-and-1064-danes-decided-to-look-into-youtube-a-story-about-how-the-eu-g ave-us-a-law-1064-danes-gave-us-their-youtube-histories-and-reality-ga\n\n Description:\n**Talk Description**\nIn this talk\, we explore what happens when the European Union’s data access laws meet the practical realities of platform research. The talk opens with a shared introduction\, where D avid and LK set the stage: why social media platforms like YouTube matter for democracy and what the EU has done to make them more transparent.\n\nL K will then provide a short introduction into the legally mandated ways we can currently use to access platform data: from the GDPR’s right of acc ess\, the research data access provisions in the DSA\, to the portability obligations into the DMA. But access is not the same as insight\, a lesson David learned the hard way. Along with his team he invited over a thousan d Danes to make use of their GDPR-right to their own data and donate their YouTube watch histories\, searches\, subscriptions and comments. Using th e DSA\, the team then obtained meta-data on the millions of videos the dat a donors had interacted with. The goal: Seeing what the digital data trace s YouTube collects from its users can tell us about the platform’s effec t on people’s lives and society. Are the data carrying indicators of pol arization\, loneliness\, political extremism or any of the numerous other ails of society that YouTube has been suspected to cause? However\, the da ta are difficult to get a hold of\, messy\, not properly annotated\, and p arsing them requires an almost archeological mindset. Together\, we will p eek behind the Youtube curtain\, shine a light on what platform data actua lly looks like\, and sketch out what can and cannot be learned from them. \n\nAll around Europe\, researchers are currently facing similar challenge s\, parsing cryptic user and platform data from Facebook and TikTok to por n sites and Zalando. The platforms implement the data access laws to achie ve minimal compliance but not to provide meaningful transparency. Data gat hered by the DSA40 Data Access Collaboratory shows that application forms vary widely\, researchers are rejected for non-compliant reasons\, and app lications artificially stalled. Other researchers have shown that the data received through some of the APIs is incomplete and inaccurate. In short: there is a lot of space for improvement. But we do not need to wait for i nvestigations into platform compliance to conclude.. The basic conditions for democratic oversight have been set\, which means that theoretically va rious legal ways into the platforms exist for citizens\, researchers and c ivil society. The question that remains is which levers to use to practica lly realise as much of this potential as possible.\n\n**About the Presente rs**\nDavid Wegmann is a PhD student at Aarhus University\, Denmark. He re searches social media and its societal effects using data science. As part of DATALAB\, he led the analysis of donated data for “Data donation as a method for investigating trends and challenges in digital media landscap es at national scale: The Danish population’s use of YouTube as an illus trative case” by Bechmann and colleagues (2025).\n\nLK Seiling coordinat es the DSA40 Data Access Collaboratory\, where they research the implement ation of the DSA’s data access provisions. At the Weizenbaum Institute B erlin\, they are also looking into research engineering and data access as well as technologically mediated risks for individuals\, society\, and sc ience.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/we-the-eu-and-1064-danes-dec ided-to-look-into-youtube-a-story-about-how-the-eu-gave-us-a-law-1064-dane s-gave-us-their-youtube-histories-and-reality-ga END:VEVENT BEGIN:VEVENT SUMMARY:Infrastructure Review DTSTART:20251230T134500Z DTEND:20251230T144500Z UID:323248d0-1bcf-5440-a8b3-9d35d40fb06d CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/infras tructure-review\n\nDescription:\n39c3 is a big challenge to run\, install power\, network connectivity and other services in a short time and tear d own everything even faster. This is a behind the scenes of the event infra structure\, what worked well and what might not have worked as expected.\n LOCATION:Zero URL:https://hub.test.c3voc.de/en/event/detail/infrastructure-review END:VEVENT END:VCALENDAR