BEGIN:VCALENDAR VERSION:2.0 CALSCALE:GREGORIAN X-WR-CALNAME:39th Chaos Communications Congress ICal Feed BEGIN:VEVENT SUMMARY:Opening Ceremony DTSTART:20251227T093000Z DTEND:20251227T100000Z UID:0c8b0cb4-6cf9-5ff8-928a-0a0f49558c48 CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/openin g-ceremony\n\nDescription:\nDas Opening gibt euch die wichtigsten Infos f ür den Congress\, stimmt euch ein und ... äh ... bis Späti!\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/opening-ceremony END:VEVENT BEGIN:VEVENT SUMMARY:All Sorted by Machines of Loving Grace? "AI"\, Cybernetics\, and F ascism and how to Intervene DTSTART:20251227T100000Z DTEND:20251227T104000Z UID:304dd87b-7de5-557c-9951-1add24396a0b CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/all-so rted-by-machines-of-loving-grace-ai-cybernetics-and-fascism-and-how-to-int ervene\n\nDescription:\nThe idea of the Super-Human is not a new one\, nei ther is the idea of charismatic „good“ leader nor to sort humans into classes\, races\, abilities. The idea of a view controlling many by force and ideas that justify their rulership and cruelties is an old one\, as is the opposing idea of a free society and humans as equals.\nA central aspe ct is how people involved see the human nature and according to that what society they want to build. And what role is intended for technology.\nIn the 19th century the beliefs of both the opposing sides dripped into scien ce\, as well as individual’s heads\, and social movements around the wor ld. While some wanted to form a wold society of equals others wanted to br eed a master race that to control everything.\n\nThe love of industrial le aders for authoritarianism has played an important role since the beginnin g in funding and providing access to powerful networks. Industrialists lik e Henry Ford loved and promoted ideas at least close to fascism. German\, Italian\, and Austrian counterparts funded Hitler and Mussolini. And it is not that they did it because they did not understand the fascist leader ’s yearning – it was because they shared and loved their aims and viol ence.\n\nIn Futurism\, one of the often overlooked roots of fascism\, and its Manifesto the enemies and societal goals are proclaimed crystal clear: “We will glorify war — the only true hygiene of the world — militar ism\, patriotism\, the destructive gesture of anarchist\, the beautiful Id eas which kill\, and the scorn of woman.“\n\nAfter WWII most of the peop le believing in dominating others by force and eugenics lived on\, they an d their cronies had slaughtered millions and destroyed whole social moveme nts were opposing them. These people warning us about authoritarian prophe ts of doom and concentration camps are still missing.\n\nIn the post-war t ime ideas of authoritarianism met a new player: Cybernetics\, the believe in a future\, where all problems will be solved through technology and we are “All Watched Over by Machines of Loving Grace” (Richard Brautigam \, 1967). The ideas split\, merged\, and melted into new beliefs and quasi -religions. Into something that is called “Cyber-Libertarianism” by Da vid Golumbia or “TESCREAL” by Émile P. Torres and Timnit Gebru.\n\nTh is talk will address an aspect that is often missing in analyses: What kin d of breeding ground is it where ideas of fascism hatches best? And how ca n we stop iFascism instead of participating in it?\n\nFurthermore\, as bei ng sorted by machines is not everyone's secret dream\, ways to stop iFasci sm will be provided.\n\nBecause we are more\, we care for people in need – and we are the chaos!\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/all-sorted-by-machines-of-lo ving-grace-ai-cybernetics-and-fascism-and-how-to-intervene END:VEVENT BEGIN:VEVENT SUMMARY:Zentrum für Politische Schönheit: Ein Jahr Adenauer SRP+ und der Walter Lübcke Memorial Park DTSTART:20251227T105500Z DTEND:20251227T113500Z UID:926c987a-2dd9-54f6-9a3a-45222dc9c4b7 CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/zps-ei n-jahr-adenauer-srp-und-mehr\n\nDescription:\nEs ist genau ein Jahr her\, dass der Adenauer SRP+ in der Halle des 38C3 stand. Damals war er noch ein e Baustelle\, aber schon bald machte er sich auf den Weg\, um Geschichte z u schreiben. Wir nehmen euch mit auf eine Reise: von Blockade über Protes t\, von Sommerinterviews bis zu Polizeischikanen lassen wir ein Jahr Adena uer SRP+ Revue passieren. Das könnte lustig werden.\nAußerdem: alles zum Walter Lübcke-Memorial-Park\, den wir gerade direkt vor die CDU-Zentrale gebaut haben.\n\nOwei owei: Das wird viel für 40 Minuten.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/zps-ein-jahr-adenauer-srp-un d-mehr END:VEVENT BEGIN:VEVENT SUMMARY:Building hardware - easier than ever - harder than it should be DTSTART:20251227T115000Z DTEND:20251227T123000Z UID:4bfb9f9c-a8cd-5bcb-8b0f-ce20509f2a36 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/buildi ng-hardware-easier-than-ever-harder-than-it-should-be\n\nDescription:\nEle ctronics is easier and more fun to get into than it's ever been before. Al l the tools and resources are easily accessible and super cheap or free. T here's an enormous amount of things to build from and build on.\n\nIt's al so never been more important to be able to build and understand electronic s\, as assholes running corporations are wasting their workers' unpaid ove rtime on making all the electronics in our lives shittier\, more full of a ds\, slop\, and spyware\, and more frustrating to use. Encountering a devi ce that works for you instead of against you is a breath of fresh air. Bui lding one is an act of resistance and power. Not depending on the whims of corporate assholes is freedom.\n\nHowever\, the culture around electronic s and the electronics industry is one of exclusion and gatekeeping. It doe sn't need to be. It would be stupidly easy to make things better\, and we should. I've been teaching absolute beginners advanced electronics manufac turing skills for many years now. It's absolutely shocking how much more d iverse the people who I teach are compared to the industry. The "hardware is hard" meme is true in some cases but toxic when worn as a badge of prid e or a warning to people attempting it.\n\nI will tell you why designing a nd building electronics is not nearly as hard as it seems\, how it's almos t never been easier to get into it\, and why it's very important that peop le who think or have been told they can't do it should be doing more of it . I'll tell you my experiences of what building devices is like\, show and tell a few useful skills\, and tell the story of how trying to prove some one wrong on the internet turned into a decade of teaching people with zer o experience how to handle the most complex electronic components at all s orts of community events.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/building-hardware-easier-tha n-ever-harder-than-it-should-be END:VEVENT BEGIN:VEVENT SUMMARY:Liberating Bluetooth on the ESP32 DTSTART:20251227T125000Z DTEND:20251227T133000Z UID:760c1f6b-349e-5ee3-9eeb-4a0f20dc902a CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/libera ting-bluetooth-on-the-esp32\n\nDescription:\nThe ESP32 has become an ubiqu itous platform in the hacker and maker communities\, powering everything f rom badges and sensors to mesh networks and custom routers. While its Wi-F i stack has been the subject of previous reverse engineering efforts\, its Bluetooth subsystem remains largely undocumented and closed source despit e being present in millions of devices.\n\nThis talk presents a reverse en gineering effort to document Espressif’s proprietary Bluetooth stack\, w ith a focus on enabling low-level access for researchers\, security analys ts\, and developers to improve existing affordable and open Bluetooth tool ing.\n\nThe presentation covers the reverse engineering process itself\, t echniques and the publication of tooling to simplify the process of periph eral mapping\, navigating broken memory references and symbol name recover y.\n\nThe core of the talk focuses on the internal workings of the Bluetoo th peripheral. The reverse engineering effort led to the discovery of the peripheral architecture\, it’s memory regions\, interrupts and a little bit of information about other related peripherals.\n\nBy publishing open tooling\, SVD files and other documentation\, this work aims to empower re searchers\, hackers\, and developers to build custom Bluetooth stacks\, au dit existing ones\, and repurpose the ESP32 for novel applications. This m ay interest you if you care about transparency\, low-level access\, and co llaborative tooling.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/liberating-bluetooth-on-the- esp32 END:VEVENT BEGIN:VEVENT SUMMARY:Opening pAMDora's box and unleashing a thousand paths on the journ ey to play Beatsaber custom songs DTSTART:20251227T134500Z DTEND:20251227T144500Z UID:3aa9e859-d4b0-5e7d-8f5c-7741e6c9856e CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/openin g-pamdora-s-box-and-unleashing-a-thousand-paths-on-the-journey-to-play-bea tsaber-custom-songs\n\nDescription:\n# BACKSTORY\n---------------\nSo here is the backstory of how it all started:\n- I bought a commercial gaming c onsole\n- Then bought a VR headset (for this console) because of exclusive game\n- But also wanted to play beatsaber\n- I could\, but builtin song s election was very limited\n- Custom songs exist (for example on steam)\, b ut not for this console\n- I didn't want to buy a second headset for steam \n That's when i decided i want to hack this console so that i can port c ommunity created customs songs to the console and play them there with the VR headset i already have.\n\nInitially starting with an approach similar to the usual "entrypoint through browser"\, then go for kernel and call i t a day\, but quickly annoying hurdles blocked my way. For one\, the Hyper visor makes your live just miserable with it's execute only kernel text bl ind exploitation. Other issues were that one needs to be on latest version to download the game\, which exists only as digital purchase title\, prev enting me to share my efforts with others even if i can get it working on my console.\nThough\, what finally put the nail in the coffin was when por ting a kernel zeroday to the console failed because of heavy sandboxing\, unreachable syscalls or even entirely stripped kernel functions. \nSome ma y call it "skill issue". Anyways\, that's when i was full of it and decide d to bring this thing down for good. \nEverybody does glitching nowadays and according to rumors people did have success on this thing with glitchi ng before\, so how hard can it really be\, right?\n\nSo the question becam e: Is it possible to build a modchip\, which glitches the board and lets m e play beatsaber custom songs? \nStuff like that has been done on other c onsoles before (minus the beatsaber part :P)\n\nTurns out that when manufa cturing produces chips with broken GPUs\, they are sold as spinoff desktop mainboards (with disabled GPU) rather than thrown away. Which is great\, because those mainboards are much cheaper\, especially if you buy broken s pinoff mainboards on ebay.\n\nSo on the journey to beatsaber custom songs \, breaking this desktop mainboard became a huge chunk of the road. Becaus e if i can glitch this and build a modchip for it\, surely i can also do i t for the console\, right? I mean it's the exact same SoC afterall! \nBack when i started i didn't know i would be about to open pAMDoras box and di scover so many bugs and hacks.\n\n# Actual talk description\n------------- --\n**Disclaimer: This is not a console hacking talk!** \nThis talk is go nna be about breaking nearly every aspect of the AMD Platform Security Pro cessor of the desktop mainboard with the same SoC as the console. While ce rtainly usefuly for _several_ other AMD targets\, unfortunately not every finding can directly be ported to the console. Still\, it remains very us eful nonetheless!\n\nNote: The final goal of custom songs on beatsaber has not been reached yet\, this talk is presenting the current state of thing s.\n\nIn this talk you'll be taken on a ride on how everything started and how almost every aspect of the chip was broken. How bugs were discovered \, what strategies were used to move along. \nNot only will several novel techniques be presented for applying existing physical attacks to targets where those couldn't really be applied before\, but also completely new a pproaches are shared which bring a whole different perspective on glitchin g despite having lots of capacitors (which we don't really want to remove) and extremely powerfull mosfets (which smooth out crowbar attempts in a b link of an eye).\n\nBut that's not all! \nWhile trying to perform physica l attacks on the hardware\, the software would just start falling apart by itself. Which means\, at least **6 unpatchable\\* bugs** were discovered \, which are gonna be presented in the talk alongside with **5 zero-day ex ploits**. Getting EL3 code execution on the most secure core inside AMDs S oC? No Problem! \nApart from just bugs and exploits\, many useful techniqu es and discovery strategies are shared which will provide an excellent kno wedgle base and attack inspiration for following along or going for other targets.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/opening-pamdora-s-box-and-un leashing-a-thousand-paths-on-the-journey-to-play-beatsaber-custom-songs END:VEVENT BEGIN:VEVENT SUMMARY:All my Deutschlandtickets gone: Fraud at an industrial scale DTSTART:20251227T150000Z DTEND:20251227T160000Z UID:a2dd3dc7-ecae-50b3-82d9-266ad02f7a40 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/all-my -deutschlandtickets-gone-fraud-at-an-industrial-scale\n\nDescription:\nAt last years Congress Q presented [a deep-dive into the technical details of train ticketing](https://media.ccc.de/v/38c3-what-s-inside-my-train-ticke t) and its [Zügli](https://zügli.app) platform for this\; since then\, t hings have gone rather out of hand. The little side-project for looking in to the details of train tickets turned into a full-time project for detect ing ticketing fraud. This talk details an executive summary of the madness that has been the past year\, and how we accidentally ended up in nationa l and international politics working to secure the Deutschlandticket.\n\nS hortly after last year's talk\, we were contacted about some *interesting* looking tickets someone noticed\, issued by the Vetter GmbH Omnibus- und Mietwagenbetrieb - or so they claimed to be. These were normal Deutschland tickets\, but with a few weird mistakes in them. At first\, we thought not hing much of it\; mistakes happen. But\, on further investigation\, these turned out to not be legitimate tickets at all\, but rather from a fraudul ent website by the name of d-ticket.su\, using the private signing key obt ained under suspicious circumstances. How exactly this key came into the w rong hands remains unclear\, but we present the possible explanations for how this could've happened\, how many responsible have been thoroughly unc ooperative in getting to the bottom of this\, and how the supporting syste ms and processes of the Deutschlandticket were unable to cope with this si tuation.\n\nParallel to this\, another fraud has been draining the transpo rt companies of their much-needed cash: SEPA Direct Debit fraud. Often\, a direct debit payment can be setup online with little more than an IBAN an d ticking a box\; and most providers of the Deutschlandticket offer an opt ion to pay via direct debit. Fraudsters have noticed this\, and mass purch ase Deutschlandtickets with invalid or stolen IBANs before flipping them f or a discounted price on Telegram\; made easier because most transport com panies issue a ticket immediately\, before the direct debit has been fully processed. The supporting systems of the Deutschlandticket in many cases don't even provide for the revocation of such tickets. We will detail the hallmarks of this fraud\, how transport companies can work to prevent it\, and how we tracked down the fraudsters by their own careless mistakes.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/all-my-deutschlandtickets-go ne-fraud-at-an-industrial-scale END:VEVENT BEGIN:VEVENT SUMMARY:To sign or not to sign: Practical vulnerabilities in GPG & friends DTSTART:20251227T161500Z DTEND:20251227T171500Z UID:e448ef16-47cf-57ad-9fbd-a5f91aa4aa3b CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/to-sig n-or-not-to-sign-practical-vulnerabilities-i\n\nDescription:\nBeyond the u nderlying mathematics of cryptographic algorithms\, there is a whole other layer of implementation code\, assigning meaning to the processed data. F or example\, a signature verification operation both needs robust cryptogr aphy **and** assurance that the verified data is indeed the same as was pa ssed into the signing operation. To facilitate the second part\, software such as *GnuPG* implement parsing and processing code of a standardized fo rmat. Especially when implementing a feature rich and evolving standard\, there is the risk of ambivalent specification\, and classical implementati on bugs.\n\nThe impact of the vulnerabilities we found reaches from variou s signature verification bypasses\, breaking encryption in transit and enc ryption at rest\, undermining key signatures\, to exploitable memory corru ption vulnerabilities.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/to-sign-or-not-to-sign-pract ical-vulnerabilities-i END:VEVENT BEGIN:VEVENT SUMMARY:Die Känguru-Rebellion: Digital Independence Day DTSTART:20251227T181500Z DTEND:20251227T191500Z UID:514cda00-fd8e-5417-ba56-a882572a660e CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/die-ka nguru-rebellion-digital-independence-day\n\nDescription:\nVielleicht auch was von Elon und Jeff on Mars.\nUnd dann ruft das Känguru zum Digital Ind ependence Day auf.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/die-kanguru-rebellion-digita l-independence-day END:VEVENT BEGIN:VEVENT SUMMARY:Chatkontrolle - Ctrl+Alt+Delete DTSTART:20251227T193000Z DTEND:20251227T203000Z UID:9296cd85-f869-5687-94cb-e87d805249a2 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/episod e-ii-der-rat-schlagt-zuruck\n\nDescription:\nDie Chatkontrolle liest sich mehr wie eine tragische Komödie\, als ein Gesetzgebungsverfahren. Nach de m dramaturgischen Rückblick auf dem 37C3 wird es nun Zeit einen Blick auf die Seite der Rebellen zu werfen. \nMarkus Reuter und khaleesi haben den Gesetzgebungsprozess rund um die Chatkontrolle von Anfang an eng begleitet \, er aus der der journalistischen\, sie aus der Policy-Perspektive. \nNac h den ersten Jahren mit großen Rummel und Hollywoodstars ist es nach den EU-Wahlen doch etwas ruhig geworden. Doch die Gefahr ist nicht vom Tisch: \n\nZwar steht die Position des EU-Parlaments gegen die Chatkontrolle - ab er wie sicher sie wirklich ist\, ist unklar.\nDerzeit hängt alles am Rat: Es gab sehr positive Vorschläge (polnische Ratspräsidentschaft) und neg ative Vorschläge (dänische Ratspräsidentschaft) - doch einigen können sich die Länder nicht und eine Mehrheit will die Chatkontrolle\, kann sic h aber nicht durchsetzen.\n\nUnd auch in Deutschland hat die Chatkontrolle den ganz großen Sprung in die Öffentlichkeit geschafft und die Gegner:i nnen einen Etappensieg errungen. Was dieser Erfolg mit der Arbeit der letz ten vier Jahre zu tun hat und warum auch in Deutschland noch nichts in tro ckenen Tüchern ist\, erzählen wir in diesem Talk.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/episode-ii-der-rat-schlagt-z uruck END:VEVENT BEGIN:VEVENT SUMMARY:Hacking washing machines DTSTART:20251227T204500Z DTEND:20251227T214500Z UID:efa55b63-86b6-56c5-88ab-46408b59b18d CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/hackin g-washing-machines\n\nDescription:\nModern home appliances may seem simple from the outside\, but inside they contain complex electronic systems\, p roprietary communication protocols\, and diagnostic interfaces rarely docu mented outside the manufacturer. In this talk\, we'll explore the challeng es of reverse-engineering these systems: from analyzing appliance control boards and internal communication buses to decompiling and modifying firmw are to better understand device functionality.\n\nWe'll also look at the s ecurity mechanisms designed to protect diagnostic access and firmware read out\, and how these protections can be bypassed to enable deeper insight i nto device operation. Finally\, this talk will demonstrate how the results of this research can be used to integrate even legacy home appliances int o popular home automation platforms.\n\nThis session combines examples and insights from the reverse-engineering of B/S/H/ and Miele household appli ances.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/hacking-washing-machines END:VEVENT BEGIN:VEVENT SUMMARY:Bluetooth Headphone Jacking: A Key to Your Phone DTSTART:20251227T220000Z DTEND:20251227T230000Z UID:887fe87e-6ef2-5d94-98c8-f582cb22f442 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/blueto oth-headphone-jacking-a-key-to-your-phone\n\nDescription:\nAiroha is a ven dor that\, amongst other things\, builds Bluetooth SoCs and offers referen ce designs and implementations incorporating these chips. They have become a large supplier in the Bluetooth audio space\, especially in the area of True Wireless Stereo (TWS) earbuds. Several reputable headphone and earbu d vendors have built products based on Airoha’s SoCs and reference imple mentations using Airoha’s Software Development Kit (SDK).\n\nDuring our Bluetooth Auracast research we stumbled upon a pair of these headphones. D uring the process of obtaining the firmware for further research we initia lly discovered the powerful custom Bluetooth protocol called *RACE*. The p rotocol provides functionality to take full control of headphones. Data ca n be written to and read from the device's flash and RAM.\n\nThe goal of t his presentation is twofold. Firstly\, we want to inform about the vulnera bilities. It is important that headphone users are aware of the issues. In our opinion\, some of the device manufacturers have done a bad job of inf orming their users about the potential threats and the available security updates. We also want to provide the technical details to understand the i ssues and enable other researchers to continue working with the platform. With the protocol it is possible to read and write firmware. This opens up the possibility to patch and potentially customize the firmware.\n\nSecon dly\, we want to discuss the general implications of compromising Bluetoot h peripherals. As smart phones are becoming increasingly secure\, the focu s for attackers might shift to other devices in the environment of the sma rt phone. For example\, when the Bluetooth Link Key\, that authenticates a Bluetooth connection between the smart phone and the peripheral is stolen \, an attacker might be able to impersonate the peripheral and gain its ca pabilities.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/bluetooth-headphone-jacking- a-key-to-your-phone END:VEVENT BEGIN:VEVENT SUMMARY:Unnecessarily Complicated Kitchen – Die Wissenschaft des guten G eschmacks DTSTART:20251227T232000Z DTEND:20251228T002000Z UID:341961a3-599d-52b9-8262-34c1757c9698 CATEGORIES:official,Entertainment DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/unnece ssarily-complicated-kitchen-die-wissenschaft-des-guten-geschmacks\n\nDescr iption:\nWillkommen in der „Unnecessarily Complicated Kitchen“ – ein er Küche\, in der Naturwissenschaft\, Technik und kulinarisches Chaos auf einandertreffen.\nWir sezieren das Kochen aus der Perspektive von Hacker*i nnen: Warum Hitzeübertragung ein deinen Tschunk kühlt\, warum Emulsionen wie BGP funktionieren und wie sich die Kunst des Abschmeckens in Datenpun kten erklären lässt.\n\nIn diesem Talk verbinden wir naturwissenschaftli che Experimente mit kulinarischer Praxis. Wir erhitzen\, rühren\, messen und analysieren – live auf der Bühne. Dabei übersetzen wir Physik und Chemie in Geschmack\, Textur und Aha-Momente.\nKochen wird so zum Laborver such\, zum Hack\, zum Reverse Engineering des guten Geschmacks.\n\nIch zei ge\, dass hinter jeder gelungenen Marinade ein Protokoll steckt\, hinter j eder Soße ein Algorithmus – und dass man auch in der Küche mit Trial & Error\, Open Source und einer Prise Chaos zu erstaunlichen Ergebnissen ko mmt.\n\nAm Ende steht nicht nur Erkenntnis\, sondern auch Genuss: Denn wer versteht\, warum etwas schmeckt\, kann die Regeln brechen – und sie dab ei besser würzen.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/unnecessarily-complicated-ki tchen-die-wissenschaft-des-guten-geschmacks END:VEVENT BEGIN:VEVENT SUMMARY:Protecting the network data of one billion people: Breaking networ k crypto in popular Chinese mobile apps DTSTART:20251228T100000Z DTEND:20251228T110000Z UID:a19d5bca-7949-5353-abaf-1c43655f7c26 CATEGORIES:not recorded,official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/protec ting-the-network-data-of-one-billion-people-breaking-network-crypto-in-pop ular-chinese-mobile-apps\n\nDescription:\nTLS is not as universal as we mi ght think. Applications with hundreds of millions of active users continue to use insecure\, home-rolled proprietary network encryption to protect s ensitive user data. This talk demonstrates that this is a widespread and s ystemic issue affecting a large portion of the most popular applications i n the world. These issues are particularly concentrated in mobile applicat ions developed in China\, which have been overlooked by the global securit y community despite their massive popularity and influence.\n\nWe found th at 47.6% of top Mi Store applications used proprietary network cryptograph y without any additional encryption\, compared to only 3.51% of top Google Play Store applications. We analyzed the most popular of these protocols \, including cryptosystems designed by Alibaba\, iQIYI\, Kuaishou\, and Te ncent. Of the top 9 protocol families\, we discovered vulnerabilities in 8 that allowed network eavesdroppers to decrypt underlying data. We also di scovered additional vulnerabilities in several other protocols used by app s with hundreds of millions of users.\n\nThrough the vulnerabilities fixed as a result of this work\, this research has directly improved the networ k security of up to one billion people. However\, there were hundreds more proprietary protocols used by popular applications that we discovered. Ve rifying all of their security through manual reverse-engineering and vulne rability reporting is not feasible at this scale. What can we do as a comm unity to fix this systemic issue and prevent such failures from occurring in the future?\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/protecting-the-network-data- of-one-billion-people-breaking-network-crypto-in-popular-chinese-mobile-ap ps END:VEVENT BEGIN:VEVENT SUMMARY:Skynet Starter Kit: From Embodied AI Jailbreak to Remote Takeover of Humanoid Robots DTSTART:20251228T111500Z DTEND:20251228T121500Z UID:e6837a00-672c-532b-9bfa-319453667c03 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/skynet -starter-kit-from-embodied-ai-jailbreak-to-remote-takeover-of-humanoid-rob ots\n\nDescription:\nUnitree is among the highest-volume makers of commerc ial robots\, and their newest humanoid platforms ship with multiple contro l stacks and on-device AI agents. If the widespread\, intrusive presence o f these robots in our lives is inevitable\, should we take the initiative to ensure they are completely under our control? What paths might attacker s use to compromise these robots\, and to what extent could they threaten the physical world?\n\nIn this talk\, we first map the complete attack sur face of Unitree humanoids\, covering hardware interfaces\, near-field ra dios and Internet-accessible channels. We demonstrate how a local attacke r can hijack a robot by exploiting vulnerabilities in short-range radio co mmunications (Bluetooth\, LoRa) and local Wi-Fi. We also present a fun exp loit of the embodied AI in the humanoid: With a single spoken/text sentenc e\, we jailbreak the on-device LLM Agent and pivot to root-priviledged re mote code execution. Combined with a flaw in the cloud management service \, this forms a full path to gain complete control over any Unitree robot connected to the Internet\, obtaining root shell\, camera livestreaming\, and speaker control.\n\nTo achieve this\, we combined hardware inspection \, firmware extraction\, software-defined radio tooling\, and deobfuscati on of customized\, VM-based protected binaries. This reverse engineering b reakthrough also allowed us to understand the overall control logic\, patc h decision points\, and unlock advanced robotic movements that were delib erately disabled on consumer models like G1 AIR.\n\nTakeaways. Modern hum anoids are networked\, AI-powered cyber-physical systems\; weaknesses acro ss radios\, cloud services\, and on-device agents could allow attackers to remotely hijack robot operations\, extract sensitive data or camera lives treams\, or even weaponize the physical capabilities. As robotics continue their transition from controlled environments to everyday applications\, our work highlights the urgent need for security-by-design in this emergin g technology landscape.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/skynet-starter-kit-from-embo died-ai-jailbreak-to-remote-takeover-of-humanoid-robots END:VEVENT BEGIN:VEVENT SUMMARY:A post-American\, enshittification-resistant internet DTSTART:20251228T123000Z DTEND:20251228T133000Z UID:c9f5a6df-6c79-5492-b3e0-110347358445 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/a-post -american-enshittification-resistant-internet\n\nDescription:\nEnshittific ation wasn't an accident. It also wasn't inevitable. This isn't the iron l aws of economics at work\, nor is it the great forces of history.\n\nEnshi ttification was a choice: named individuals\, in living memory\, enacted p olicies that created the enshittogenic environment. They created a world t hat encouraged tech companies to merge to monopoly\, transforming the inte rnet into "five giant websites\, each filled with screenshots of the other four." They let these monopolists rip us off and spy on us.\n\nAnd they b anned us from fighting back\, claiming that anyone who modified a technolo gy without permission from its maker was a pirate (or worse\, a terrorist) . They created a system of "felony contempt of business-model\," where it' s literally a crime to change how your own devices work. They declared war on the general-purpose computer and demanded a computer that would do wha t the manufacturer told it to do (even if the owner of the computer didn't want that).\n\nWe are at a turning point in the decades-long war on gener al-purpose computing. Geopolitics are up for grabs. The future is ours to seize.\n\nIn my 24 years with EFF\, I have seen many strange moments\, but never one quite like this. There's plenty of terrifying things going on r ight now\, but there's also a massive\, amazing\, incredibly opportunity t o seize the means of computation.\n\nLet's take it. '\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/a-post-american-enshittifica tion-resistant-internet END:VEVENT BEGIN:VEVENT SUMMARY:Chaospager - How to construct an Open Pager System for c3 DTSTART:20251228T134500Z DTEND:20251228T142500Z UID:f9204594-d3f2-5c45-ba71-542a99eb9e5d CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/chaosp ager-how-to-construct-an-open-pager-system-for-c3\n\nDescription:\nAt 38c3 \, we conducted an experiment to test out our self-built POCSAG Pager infr astructure. Together with DL0TUH and CERT\, we are now working on an open pager solution leveraging well-known components in the maker commmunity (e .g. ESP32\, SX1262) to support the alarming of action forces at c3 events. In this talk\, we will guide you through the process of developing such a project\, problems that are occuring and what our future plans are.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/chaospager-how-to-construct- an-open-pager-system-for-c3 END:VEVENT BEGIN:VEVENT SUMMARY:Cracking open what makes Apple's Low-Latency WiFi so fast DTSTART:20251228T144000Z DTEND:20251228T152000Z UID:c8fe18e8-6cd5-5354-aad7-1a51e64fd529 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/cracki ng-open-what-makes-apple-s-low-latency-wifi-so-fast\n\nDescription:\nApple 's Continuity features make up a big part of their walled garden. From Air Drop and Handoff to AirPlay\, they all connect macOS and iOS devices wirel essly. In recent years\, security researchers have opened up several of th ese features showing that the Apple ecosystem is technically compatible wi th third-party devices.\n\nIn this talk\, we present the internal workings of Low-Latency WiFi (LLW) – Apple's link-layer protocol for several rea l-time Continuity features like Continuity Camera and Sidecar Display. We talk about the concepts behind LLW\, how it achieves its low-latency requi rement and how we got there in the reverse engineering process.\n\nWe also present the tooling we built to enable more kernel-level tracing and logg ing on iOS through a reimplementation of cctool from macOS and the source code of trace that was buried deep inside of Apple’s open-source reposit ory system_cmds. We build a log aggregator that combines various kernel- a nd user-space traces\, log messages and pcap files from both iOS and macOS into a single file and finally investigate the network stack on Apple pla tforms that is implemented in both user- and kernel space. There we find i nteresting configuration values of LLW that make it the go-to link-layer p rotocol for Apple's proprietary real-time Continuity applications.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/cracking-open-what-makes-app le-s-low-latency-wifi-so-fast END:VEVENT BEGIN:VEVENT SUMMARY:CCC-Jahresrückblick DTSTART:20251228T153500Z DTEND:20251228T171500Z UID:49b35210-41ea-547d-86da-1ca62612c7b6 CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/ccc-ja hresruckblick\n\nDescription:\n2025 war ein gutes Jahr für Exploits\, kei n gutes Jahr für die Freiheit und ein herausragendes für schlechte Ideen . Regierungen kämpften weiter für Massenüberwachung\, natürlich mit KI -Unterstützung™. Kriege wurden weiter „digitalisiert“\, Chatkontrol le als Kinderschutz verkauft\, Waffensysteme haben inzwischen mehr Autonom ie als die meisten Bürger*innen und künstliche Intelligenz löst endlich alle Probleme – vor allem die\, die bisher niemand hatte.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/ccc-jahresruckblick END:VEVENT BEGIN:VEVENT SUMMARY:In-house electronics manufacturing from scratch: How hard can it b e? DTSTART:20251228T181500Z DTEND:20251228T185500Z UID:151d4fb0-5d25-586b-8063-c7706bbd9094 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/in-hou se-electronics-manufacturing-from-scratch-how-hard-can-it-be\n\nDescriptio n:\nOur industry needs a reboot as well\, it no longer serves the people. \n\nOur work is based on our belief that high-quality high-mix/low volume manufacturing of electronics in Europe is economically viable and accessib le to small companies with a lower-than-expected up-front investment.\n\nW e believe that relocation of industry to Europe depends on small innovativ e companies\, and will not come from slow and bloated industry giants whos e products are victims of enshittification and maximum profit extraction. \n\nBy using open-source hardware and software whenever possible\, we are attempting to set up our own production operation in Hamburg and we want t o share the solutions and enable others to do the same and collectively re claim ownership of the means of production.\n\nWe will cover:\n- How we ac quired and set up production machines\, their costs\, and our learnings\n- Quirks of paste printing and reflow soldering at scale (up to 50 batches a day)\n- Component inventory\, tracking\, DfM\, etc.\n- How OpenPnP is a key enabler of our prcesses\n - Our proposed changes to OpenPnP\n - Our work integrated Siemens Siplace Feeders in OpenPnP\n\nCheck out our re ssources on the topic at https://eilbek-research.de/blog/thank-you-for-att ending-our-talk-at-39c3/\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/in-house-electronics-manufac turing-from-scratch-how-hard-can-it-be END:VEVENT BEGIN:VEVENT SUMMARY:freiheit.exe - Utopien als Malware DTSTART:20251228T191000Z DTEND:20251228T195000Z UID:4c285dd4-58fc-5378-9434-628f7871ee9f CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/freihe it-exe-utopien-als-malware\n\nDescription:\nIch lade das CCC-Publikum ein \, die Betriebssysteme hinter unseren Betriebssystemen zu untersuchen.\nW ährend wir uns mit Verschlüsselung\, Datenschutz und digitaler Selbstbes timmung beschäftigen\, installieren Tech-Milliardäre ihre Weltanschauung en als Default-Einstellungen unserer digitalen Infrastruktur. Die Recherch en beleuchten die mitgelieferte Malware.\n\nIch navigiere durch die Ideeng eschichte zwischen Marinettis Futuristischem Manifest (1909) und Musks Mar s-Kolonien\, von den ersten Programmiererinnen zur Eroberung des Alls\, vo n neoliberalen Think Tanks zur Schuldenbremse\, von nationalen Christen zu Pronatalisten.\nInvestigative Recherche trifft auf performative Vermittlu ng. \nMit O-Tönen von Peter Thiel\, Nick Land und anderen zeigt die Lectu re ideologische Verbindungslinien zwischen Theoretikern autoritär-technoi der Träume und den Visionen der Tech-Oligarchen auf:\n\nEs geht um „Fre edom Cities“\, Steuerflucht und White Supremacy.\nUm Transhumanismus als Upgrade-Zwang bis hin zu neo-eugenischen Gedanken.\nUm Akzeleration als p olitische Strategie: Geschwindigkeit statt Reflexion\, Disruption statt De mokratie\, Kolonisierung – jetzt auch digital.\n\nAus Theaterperspektive betrachte ich das Revival der Cäsaren und die Selbstinszenierung von Tec h-CEOs als Künstler\, Priester oder Genies. \nUnd mit der Investigativ Re porterin Sylke Grunwald habe ich recherchiert\, was all das mit den Debatt en rund um Palantir zu tun hat.\n\nDie scheinbar alternativlose Logik von "Move Fast and Break Things" ist nicht unvermeidlich – sie ist gewollt\, gestaltet\, ideologisch aufgeladen.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/freiheit-exe-utopien-als-mal ware END:VEVENT BEGIN:VEVENT SUMMARY:Verlorene Domains\, offene Türen - Was alte Behördendomains verr aten DTSTART:20251228T200500Z DTEND:20251228T204500Z UID:6a747cc1-1320-5027-b7f9-050a6f3b2134 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/verlor ene-domains-offene-turen-was-alte-behordendomains-verraten\n\nDescription: \nIm Rahmen der Untersuchung zeigten sich nicht nur Fehlkonfigurationen\, sondern auch Phänomene wie Bitsquatting und Typoquatting innerhalb der Ve rwaltungsnetze. Mit dem Betrieb eines DNS-Servers und dem Erwerb von bund. ee (naher Typosquatting/Bitquatting zu bund.de) konnten u.a. zahlreiche DN S-Anfragen von Servern des Bundesministerium des Innern (BMI) und weiterer Einrichtungen des Bundes empfangen werden.\n\nDer Vortrag beleuchtet die technischen und organisatorischen Schwachstellen\, die hinter solchen Vorg ängen stehen - und zeigt\, wie DNS-Details Einblicke in die IT-Infrastruk tur des Staates ermöglichen können. Abgerundet wird das Ganze durch prak tische Beispiele\, Datenanalysen und Empfehlungen\, wie sich ähnliche Vor fälle künftig vermeiden lassen.\n\nIn anderen Ländern sind gov-Domains als TLDs längst üblich (bspw. gov.uk) - in Deutschland ist bund.de oder gov.de allerdings nicht so verbreitet wie man glaubt\, unter anderem da Bu ndesministerien eigene Domains nutzen oder nach Regierungsbildung umbenann t werden.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/verlorene-domains-offene-tur en-was-alte-behordendomains-verraten END:VEVENT BEGIN:VEVENT SUMMARY:Don’t look up: There are sensitive internal links in the clear o n GEO satellites DTSTART:20251228T210500Z DTEND:20251228T214500Z UID:832b4de9-1ee3-5905-a4dc-692a71ac87d3 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/don-t- look-up-there-are-sensitive-internal-links-in-the-clear-on-geo-satellites \n\nDescription:\nIn this talk\, we will cover our hardware setup\, alignm ent techniques\, our parsing code\, and survey some of the surprising find s in the data. This talk will include some previously unannounced results . This data can be passively observed by anyone with a few hundred dollar s of consumer-grade hardware. There are thousands of geostationary satelli te transponders globally\, and data from a single transponder may be visib le from an area as large as 40% of the surface of the earth.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/don-t-look-up-there-are-sens itive-internal-links-in-the-clear-on-geo-satellites END:VEVENT BEGIN:VEVENT SUMMARY:Xous: A Pure-Rust Rethink of the Embedded Operating System DTSTART:20251228T220000Z DTEND:20251228T224000Z UID:d92af8c4-40fb-54e2-9535-bcc683f4a010 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/xous-a -pure-rust-rethink-of-the-embedded-operating-system\n\nDescription:\nThe w orld is full of small\, Internet-of-Things (IoT) gadgets running embedded operating systems. These devices generally fall into two categories: large r devices running a full operating system using an MMU which generally mea ns Linux\, or smaller devices running without an MMU using operating syste ms like Zephyr\, chibios\, or rt-thread\, or run with no operating system at all. The software that underpins these projects is written in C with co arse hardware memory protection at best. As a result\, these embedded OSes lack the security guarantees and/or ergonomics offered by modern language s and best practices.\n\nThe Xous microkernel borrows concepts from heavie r operating systems to modernize the embedded space. The open source OS is written in pure Rust with minimal dependencies and an emphasis on modular ity and simplicity\, such that a technically-savvy individual can audit th e code base in a reasonable period of time. This talk covers three novel a spects of the OS: its incorporation of hardware memory virtualization\, it s pure-Rust standard library\, and its message passing architecture.\n\nDe sktop OSes such as Linux require a hardware MMU to virtualize memory. We e xplain how ARM has tricked us into accepting that MMUs are hardware-intens ive features only to be found on more expensive “application” CPUs\, t hus creating a vicious cycle where cheaper devices are forced to be less s afe. Thanks to the open nature of RISC-V\, we are able to break ARM’s yo ke and incorporate well-established MMU-based memory protection into embed ded hardware\, giving us security-first features such as process isolation and encrypted swap memory. In order to make Xous on real hardware more ac cessible\, we introduce the Baochip-1x\, an affordable\, mostly-open RTL 2 2nm SoC configured expressly for the purpose of running Xous. The Baochip- 1x features a Vexriscv CPU running at 400MHz\, 2MiB of SRAM\, 4MiB of nonv olatile RRAM\, and a quad-core RV32E-derivative I/O accelerator called the “BIO”\, based on the PicoRV clocked at 800MHz.\n\nMost Rust targets d elegate crucial tasks such as memory allocation\, networking\, and threadi ng to the underlying operating system’s C standard library. We want stro ng memory safety guarantees all the way down to the memory allocator and t ask scheduler\, so for Xous we implemented our standard library in pure Ru st. Adhering to pure Rust also makes cross-compilation and cross-platform development a breeze\, since there are no special compiler or linker conce rns. We will show you how to raise the standard for “Pure Rust” by imp lementing a custom libstd.\n\nXous combines the power of page-based virtua l memory and Rust’s strong borrow-checker semantics to create a safe and efficient method for asynchronous message passing between processes. This inter-process communication model allows for easy separation of different tasks while keeping the core kernel small. This process maps well onto th e Rust "Borrow / Mutable Borrow / Move" concept and treats object passing as an IPC primitive. We will demonstrate how this works natively and give examples of how to map common programming algorithms to shuttle data safel y between processes\, as well as give examples of how we implement feature s such as scheduling and synchronization primitive entirely in user space. \n\nWe conclude with a short demo of Xous running on the Baochip-1x\, brin ging Xous from the realm of emulation and FPGAs into everyday-user accessi ble physical silicon.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/xous-a-pure-rust-rethink-of- the-embedded-operating-system END:VEVENT BEGIN:VEVENT SUMMARY:Code to Craft: Procedural Generation for the Physical World DTSTART:20251228T225500Z DTEND:20251228T233500Z UID:6938a1f1-4ee3-5fca-ae37-d59274e529de CATEGORIES:official,Art & Beauty DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/code-t o-craft-procedural-generation-for-the-physical-world\n\nDescription:\nIn t his talk\, I will share practical insights from developing procedural gene ration tools for physical objects: ranging from stickers and paper lantern s to printed circuit boards and even furniture. I will outline key challen ges and considerations when generating designs for fabrication tools such as laser cutters or pen plotters\, as well as how to adapt procedural syst ems so they can be reproduced by a wide audience (not everyone has access to CNC machines or industrial equipment\, sadly!).\n\nBeyond technical con siderations\, I aim to encourage attendees to translate their own generati ve ideas into tangible artifacts and to foster a culture of open-sourcing and knowledge sharing within the community.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/code-to-craft-procedural-gen eration-for-the-physical-world END:VEVENT BEGIN:VEVENT SUMMARY:GPTDash – Der Reverse-Turing-Test DTSTART:20251229T000000Z DTEND:20251229T013000Z UID:9c8bec33-f71a-5090-857d-1648a027c8a9 CATEGORIES:official,Entertainment DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/gptdas h-der-reverse-turing-test\n\nDescription:\nIn unserem Reverse-Turing-Test schlüpfen die Teilnehmenden in die Rolle einer KI und versuchen so roboti sch-menschlich wie möglich zu klingen. In einer anschließenden Blindstud ie prüfen wir\, wer sich am besten unter KIs mischen und beim nächsten R obot Uprising die Spionin der Wahl wäre.\n\nHumor\, Kreativität und ein Hang zu allgemeingültigen\, nichtssagenden Floskeln sind die perfekten Vo raussetzungen! Ein digitales Endgerät (Smartphone\, Tablet\, Laptop\, … ) reicht zum Mitspielen aus.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/gptdash-der-reverse-turing-t est END:VEVENT BEGIN:VEVENT SUMMARY:Greenhouse Gas Emission Data: Public\, difficult to access\, and n ot always correct DTSTART:20251229T100000Z DTEND:20251229T104000Z UID:dd990a78-1e11-5c5e-aef4-6eb0214c772a CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/greenh ouse-gas-emission-data-public-difficult-to-access-and-not-always-correct\n \nDescription:\nWhich factory in my city is the largest emitter of CO2? Wh ich industrial sector is\nresponsible for the largest share of a country's contribution to climate change? It\nshould not be difficult to answer the se questions. Public databases and reporting\nrequired by international ag reements usually allow us to access this data.\n\nHowever\, trying to acce ss and work with these datasets — or\, shall we say\, Excel tables\n— can be frustrating. UN web pages that prevent easy downloads with a "secur ity\nfirewall"\, barely usable frontends\, and other issues make it needle ssly difficult to\ngain transparency about the sources of climate pollutio n.\n\nWhile working with official EU datasets\, the speaker observed data points that could not\npossibly be true. Factories suddenly dropped their emissions by orders of magnitude\nwithout any explanation\, different offi cial sources report diverging numbers for the\nsame emission source\, and responsible European and National authorities appear not to\ncare that muc h.\n\nThe talk will show how to work with relevant greenhouse gas emission data sources and\nhow we can access them more easily by converting them t o standard SQL tables. Furthermore\, we will dig into some of the\nstrange issues one may find while investigating emission datasets.\n\n# Backgroun d / Links\n\n* Why is it needlessly difficult to access UNFCCC Emission Da ta? [https://industrydecarbonization.com/news/why-is-it-needlessly-difficu lt-to-access-unfccc-emission-data.html](https://industrydecarbonization.co m/news/why-is-it-needlessly-difficult-to-access-unfccc-emission-data.html) \n* UNFCCC Emission Data Downloads: [https://industrydecarbonization.com/d ocs/unfccc/](https://industrydecarbonization.com/docs/unfccc/)\n* Code (Do cker\, MariaDB/MySQL\, phpMyAdmin) to easily access EU emisison data: [htt ps://github.com/decarbonizenews/ghgsql](https://github.com/decarbonizenews /ghgsql)\n* Errors and Inconsistencies in European Emission Databases: [ht tps://industrydecarbonization.com/news/errors-and-inconsistencies-in-europ ean-emission-data.html](https://industrydecarbonization.com/news/errors-an d-inconsistencies-in-european-emission-data.html)\n* Slides: [https://slid es.hboeck.de/39c3-climatedata/](https://slides.hboeck.de/39c3-climatedata/ )\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/greenhouse-gas-emission-data -public-difficult-to-access-and-not-always-correct END:VEVENT BEGIN:VEVENT SUMMARY:Celestial navigation with very little math DTSTART:20251229T105500Z DTEND:20251229T113500Z UID:967b7f53-aa2b-578b-9403-e1ba380cda15 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/celest ial-navigation-with-very-little-math\n\nDescription:\nSince the dawn of ti me people have asked themselves: where am I and why am I here? This talk won't help you answer the why question\, but it will discuss how determine the where in the pre-GPS age of sextants\, slide rules and stopwatches by taking the noon sight\, aka the meridian passage.\n\nThe usual way to fin d your position using the Sun requires a large almanac of lookup tables an d some challenging math. The books are frustrating to consult on every si ght and the base 60 degree-minute-second math is frustrating even with a c alculator\, and if you're on a traditional ship it seems wrong to do tradi tional navigation with electronic devices.\n\nTo speed up the process I’ ve designed a specialized circular slide rule that handles most of the tab le lookups to correct height of eye\, semi-diameter\, temperature\, refrac tion and index errors\, and also simplifies the degree-minute-second arith metic required to calculate the exact declination of the Sun.\n\nIn this t alk I’ll demonstrate how to make your own printable paper slide rule and use it to reduce the meridian passage measurement to a lat/lon with just a few rotations of the wheels and pointer\, no electronics or bulky books necessary!\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/celestial-navigation-with-ve ry-little-math END:VEVENT BEGIN:VEVENT SUMMARY:What Makes Bike-Sharing Work? Insights from 43 Million Kilometers of European Cycling Data DTSTART:20251229T115000Z DTEND:20251229T123000Z UID:4914b889-5003-561f-90a8-5371fc09a946 CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/what-m akes-bike-sharing-work-insights-from-43-million-kilometers-of-european-cyc ling-data\n\nDescription:\nWe are Felix\, Georg\, and Martin - each of us working professionally in different research and data areas\, ranging from the future of mobility to computational fluid dynamics and machine learni ng. What unites us is our shared interest in **quantitative traffic analys es**. Building on earlier small-scale studies focused on individual cities \, we set out to launch a project that captures shared bike system data ac ross Europe - from regular bikes to e-bikes.\n\nIn our study\, which led t o an **[open-access scientific publication](https://doi.org/10.1007/s11116 -025-10661-2)**\, we scraped shared bike data across Europe at a **minute- by-minute level** over many months\, accumulating **more than 43 million r ecords**. We analyze **behavioural and systemic patterns** to understand w hat makes a bike-sharing system useful and successful within a city. As su ch\, this evidence-based research fits very well with the **39C3 Science t rack** and the theme of "**Power Cycles**" as we dissect the complex energ y and usage cycles that define urban mobility and sustainable futures for everyone. We bridge the gap between urban planning\, socioeconomics\, and technology by applying statistical modeling and engineering knowledge to a large-scale mined dataset. Join us to learn whether right-wing politics s tall sustainable mobility\, or which climate e-bikes feel most comfortable in!\n\nWe love going the extra mile and therefore provide a live\, intera ctive demo that everyone can use to explore and understand traffic flows: [bikesharingflowmap.de](https://bikesharingflowmap.de/). Therefore\, atten dees will be able to play with the data in a self-service way. We also pro vide all code on GitHub and the complete dataset on HuggingFace. And\, of course\, we will also discuss how both bike-sharing operators and our boss reacted when we told them about the dataset we already had collected (spo iler: lawyers were involved\, yet it’s still available for downloads…) .\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/what-makes-bike-sharing-work -insights-from-43-million-kilometers-of-european-cycling-data END:VEVENT BEGIN:VEVENT SUMMARY:Wer hat Angst vor dem Neutralitätsgebot? DTSTART:20251229T125000Z DTEND:20251229T133000Z UID:94c5aafc-0742-500b-92bd-ca6f2ceb37a1 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/wer-ha t-angst-vor-dem-neutralitatsgebot\n\nDescription:\n„Neutralität“ wird zum neuen Kampfbegriff: Weil sie gegen die menschenfeindliche Politik von Friedrich Merz protestieren\, wirft die CDU Gruppen wie Omas gegen Rechts \, Greenpeace und Correctiv vor\, nicht neutral zu sein. Unter Berufung au f ein angeblich verletztes Neutralitätsgebot werden staatliche Förderung en gestrichen und NGOs geraten unter Beobachtung des Verfassungsschutzes. \nJulia Klöckner verbietet im Namen der „Neutralität“ Palestine-Shir ts\, Anstecknadeln und Regenbogenflaggen im Parlament. Die AfD fordert daz u auf\, Lehrkräfte zu melden\, die sich gegen Rechtsextremismus einsetzen oder entsprechende Positionen innerhalb der AfD kritisieren.\nDoch was st eckt dahinter?\nWas bedeutet das sogenannte Neutralitätsgebot – und fü r wen gilt es überhaupt?\nUnd für wen gilt es nicht?\nZivilcourage kann nicht neutral sein – und soll es auch nicht sein. Genauso wie AfD-Hetze gegen Migrant*innen nicht „neutral“ ist\, ist die Kritik menschenfeind licher Äußerungen nicht nur legitim\, sondern Pflicht demokratischer Bü rger*innen. Das Beschwören eines „Neutralitätsgebots“ für NGOs ist ein durchschaubarer\, aber gefährlicher Versuch\, sie der eigenen Positio n zu unterwerfen.\nDie Rechtsanwältinnen Vivian Kube und Hannah Vos erkl ären den verfassungsrechtlichen Hintergrund\, zeigen die autoritären Str ategien hinter dem Ruf nach „Neutralität“ auf und geben Tipps\, wie m an sich dagegen wehren kann.\nSie engagieren sich im Projekt Gegenrechtsch utz\, um demokratische Prinzipien und Betroffene vor rechtlichen Angriffen zu verteidigen.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/wer-hat-angst-vor-dem-neutra litatsgebot END:VEVENT BEGIN:VEVENT SUMMARY:Supplements und Social Media – wenn der Online-Hype zur realen G esundheitsgefahr wird DTSTART:20251229T134500Z DTEND:20251229T144500Z UID:e5377df9-07f4-5c8c-b510-8f64e58d95e3 CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/supple ments-und-social-media-wenn-der-online-hype-zur-realen-gesundheitsgefahr-w ird\n\nDescription:\nDer Markt für Nahrungsergänzungsmittel boomt seit J ahren. Dafür sorgen unter anderem verschiedenste Influencer\, die die Pr äparate in den sozialen Medien bewerben. Statt nur Produkte der großen P layer in diesem Bereich anzupreisen\, wie More Nutrition\, ESN oder Holy E nergy\, haben einige Influencer mittlerweile sogar ihre eigenen Nahrungser gänzungsmittelmarken auf den Markt gebracht.\n\nVersprochen wird dabei vi eles: Pre-Workout-Booster sollen die Leistung beim Krafttraining erhöhen und blitzschnell zum Traumkörper verhelfen\, während Gaming-Booster Wach heit und eine Top-Performance beim Zocken versprechen. Wieder andere Kapse ln oder auch Gummibärchen sollen für eine makellose Haut oder einen ruhi gen Schlaf sorgen. Manche Präparate können angeblich sogar Krankheiten v orbeugen oder heilen.\n\nDoch was steckt tatsächlich in diesen Mitteln\, die online regelrecht gehypt werden? Rein rechtlich handelt es sich um Leb ensmittel\, was wiederum bedeutet\, dass sie ohne behördliche Zulassung a uf den Markt gebracht werden dürfen. Es genügt schon\, wenn der Unterneh mer für die Sicherheit garantiert. Die Hürden für einen Marktzutritt si nd damit denkbar niedrig\, während gleichzeitig Gewinnmargen locken\, die sogar den illegalen Drogenhandel übertreffen.\n\nDas Ergebnis zeigt sich in den Berichten der amtlichen Lebensmittelüberwachung: Bei den Proben\, die das Niedersächsische Landesamt für Verbraucherschutz und Lebensmitt elsicherheit im Jahr 2024 untersucht hat\, entsprachen rund neun von zehn Proben (89 %) nicht den rechtlichen Vorgaben. Neben Mängeln bei der Kennz eichnung und Bewerbung\, wodurch Verbraucher viel Geld für wirkungslose P ulver ausgeben\, ist die stoffliche Zusammensetzung der Produkte besonders kritisch. So kann beispielsweise die Einnahme von überdosierten Vitamin- D-Präparaten zu Störungen des Calciumstoffwechsels führen (sog. Hyperca lcämien). Vermeintlich harmlose pflanzliche Präparate\, wie Kurkuma oder Ashwaganda\, können zu Leberschäden bis hin zum Leberversagen führen. Besonders brisant ist dabei\, dass die Wahrscheinlichkeit für die Erforde rlichkeit einer Lebertransplantation oder den Tod des Patienten höher ist als bei Leberschäden durch Arzneimittel (83 vs. 66 %). Es kommen also Me nschen durch die Einnahme von Präparaten zu Schaden\, mit deren Hilfe sie ihrer Gesundheit eigentlich etwas Gutes tun wollten.\n\nDer Vortrag beleu chtet daher die aktuelle Marktsituation unter besonderer Berücksichtigung des Influencer-Marketings kritisch\, erklärt den Unterschied zwischen Na hrungsergänzungs- und Arzneimitteln und stellt die rechtlichen Rahmenbedi ngungen für das Inverkehrbringen und die Bewerbung von Nahrungsergänzung smitteln dar. Zudem wird aufgezeigt\, warum ein ausreichender Verbrauchers chutz durch die aktuellen Möglichkeiten des Lebensmittelrechts insbesonde re im Internet nicht gewährleistet werden kann\, wo Handlungsbedarf für die Politik besteht und wie man sich selbst vor fragwürdigen Produkten sc hützen kann.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/supplements-und-social-media -wenn-der-online-hype-zur-realen-gesundheitsgefahr-wird END:VEVENT BEGIN:VEVENT SUMMARY:Gegenmacht - Best of Informationsfreiheit DTSTART:20251229T150000Z DTEND:20251229T160000Z UID:755f1d78-c910-56cb-a37e-13870013bff6 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/gegenm acht-best-of-informationsfreiheit\n\nDescription:\nTransparenz braucht Rec henschaft. Ohne Konsequenzen bleibt Transparenz wirkungslos. Wie können w ir also eine wirksame Gegenmacht schaffen\, die Veränderungen durchsetzt? \n\nPhilipp Amthors Angriff aufs Informationsfreiheitsgesetz konnten wir e rst einmal abwehren - jetzt geht's in die Offensive! Mit den Highlights au s Strafanzeigen gegen Alexandeer Dobrindt\, Spahns geleaktem Maskenbericht \, der Milliardärslobby im Wirtschaftsministerium und allen Steueroasen i n Deutschland.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/gegenmacht-best-of-informati onsfreiheit END:VEVENT BEGIN:VEVENT SUMMARY:Schlechte Karten - IT-Sicherheit im Jahr null der ePA für alle DTSTART:20251229T161500Z DTEND:20251229T171500Z UID:2b5a6a8e-327e-594d-8f92-b91201d18a02 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/schlec hte-karten-it-sicherheit-im-jahr-null-der-epa-fur-alle\n\nDescription:\nZu m letzten Chaos Communication Congress konnten Martin Tschirsich und Bianc a Kastl eine Ansammlung größerer und kleiner Sicherheitsprobleme in der elektronischen Patientenakte für alle aufzuzeigen – sei es in der Ausga be von Identifikationsmitteln\, in Systemen in der Telematikinfrastruktur oder in angebundenen Systemen. All diese Probleme kumulierten in einem ver änderten und reduzierten Rollout der ePA für alle in den Modellregionen Anfang 2025\, bei dem bereits erste Maßnahmen zur Schadensminimierung unt ernommen wurden. \nEnde April 2025 wurde die ePA für alle dann auch wirkl ich für alle deutschlandweit bereitgestellt – allerdings traten am glei chen Tag die scheinbar sicher gelösten Sicherheitslücken im Zugangsmanag ement wieder zu Tage und wurden alsbald wieder nur provisorisch abgedichte t.\n\nDieser Talk will etwas zurückblicken auf die Geschichte und die Urs achen dieser Sicherheitsprobleme der ePA für alle. Als «eines der größ ten IT-Projekte der Bundesrepublik» steht die ePA sinnbildlich für den d igitalpolitischen Umgang mit Sicherheitsversprechen und interessensgetrieb enen Anforderungen über die Köpfe von Patient*innen oder Bürger*innen h inweg.\n\nDabei geht es nicht nur um technische Probleme und deren Behebun gsversuche\, sondern auch um die strukturellen Ursachen\, die große digit ale Vorhaben immer wieder in manchen Bereichen scheitern lassen. Diese tie fergehende Betrachtung kann uns dabei helfen\, die Ursachen für schlechte IT-Sicherheit auch bei zukünftigen digitalpolitischen Vorhaben in Deutsc hland besser zu verstehen. Nicht für die ePA für alle und Anwendungen im Bereich der Telematikinfrastruktur\, sondern auch weit darüber hinaus.\n \nTiefergehende Analyse und Nachwirkungen zu 38C3 „Konnte bisher noch ni e gehackt werden“: Die elektronische Patientenakte kommt - jetzt für al le!\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/schlechte-karten-it-sicherhe it-im-jahr-null-der-epa-fur-alle END:VEVENT BEGIN:VEVENT SUMMARY:AI Agent\, AI Spy DTSTART:20251229T181500Z DTEND:20251229T191500Z UID:3e87bab2-575a-53be-8101-5d8144253646 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/ai-age nt-ai-spy\n\nDescription:\nThe talk will provide a critical technical and political economy analysis of the new privacy crisis emerging from OS and application level AI agents\, aimed at the 39C3 "Ethics\, Society & Politi cs" audience.\n\n1. Defining the Threat: The OS as a Proactive Participant (5 mins)\n We will begin by defining "Agentic AI" in two contexts - imb ibed into the operating system and deployed via critical gateway applicati ons such as web browsers. Traditionally\, the operating systems and browse rs are largely neutral enforcers of user agency\, managing resources and p roviding APIs for applications to run reliably. We will argue that this ne utrality is close to being eliminated. The new paradigm shifts these appli cations into a proactive agent that actively observes\, records\, and anti cipates user actions across all applications.The prime example for this an alysis will be Microsoft’s "Recall" feature\, Google’s Magic Cue\, and OpenAI’s Atlas. Politically\, we will frame this not as a "feature" but as the implementation of pervasive\, non-consensual surveillance and remo te-control infrastructure. This "photographic memory" of and demand for no n-differentiated access to everything from private Signal messages to fina ncial data to health data creates a catastrophic single point of failure\, making a single security breach an existential threat to a user's entire digital life. Ultimately\, we hope to illustrate how putting our brains in a jar (with agentic systems) is effectively a prompt injection attack aga inst our own humanity.\n\n2. The Existential Threat to Application-Level P rivacy (10 mins)\n The core of the talk will focus on what this means fo r privacy-first applications like Signal. We will explain the "blood-brain barrier" analogy: secure apps are meticulously engineered to minimize dat a and protect communications\, relying on the OS to be a stable\, neutral foundation on which to build. This new OS trend breaks that barrier. We wi ll demonstrate how OS-level surveillance renders application-level privacy features\, including end-to-end encryption\, effectively useless. If the OS can screenshot a message before it's encrypted or after it's decrypted \, the promise of privacy is broken\, regardless of the app's design. We w ill also discuss the unsustainable "clever hacks" (like Signal using a DRM feature) that developers are forced to implement\, underscoring the need for a structural solution.\n\n3. An Actionable Framework for Remediation ( 20 mins)\n The final\, and most important\, part of the talk will move f rom critique to action. We will present an actionable four-point framework as a "tourniquet" to address these immediate dangers:\n\na. Empower Devel opers: Demand clear\, officially supported APIs for developers to designat e individual applications as "sensitive" with the default posture being fo r such applications being opted-out of access by agentic systems (either O S or application based) (default opt-out)\n\nb. Granular User Control: Mov e beyond all-or-nothing permissions. Users must have explicit\, fine-grain ed control to grant or deny AI access on an app-by-app basis.\n\nc. Mandat e Radical Transparency: OS vendors and application developers must clearly disclose what data is accessed\, how it's used\, and how it's protected —in human-readable terms\, not buried in legalese. Laws and regulations must play an essential role but we cannot just wait for them to be enforce d\, or it will be too late.\n\nd. Encourage and Protect Adversarial Resear ch: We will conclude by reinforcing the need for a pro-privacy\, pro-secur ity architecture by default\, looking at the legal frameworks that govern these processes and why they need to be enforced\, and finally asking the attendees to continue exposing vulnerabilities in such systems. It was onl y due to technically-grounded collective outrage that Recall was re-archit ected by Microsoft and we will need that energy if we are to win this war. \n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/ai-agent-ai-spy END:VEVENT BEGIN:VEVENT SUMMARY:Blackbox Palantir DTSTART:20251229T193000Z DTEND:20251229T203000Z UID:bf34e289-afe1-59a8-8c1c-018b755772e3 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/blackb ox-palantir\n\nDescription:\nSoftware von Palantir analysiert für Polizei en und Militär deren Daten – dafür lizenzieren auch deutsche Polizeibe hörden seit Jahren die Analysesoftware Gotham des US-Unternehmens. Die So ftware verarbeitet strukturierte und unstrukturierte Informationen aus Pol izeidatenbanken. Die genauen Funktionsweisen sind für die Öffentlichkeit \, Gesetzgeber und Kontrollbehörden jedoch nicht einsehbar.\n\nDas US-Unt ernehmen ist hochumstritten und auch in Deutschland seit einigen Gesetzesi nitiativen wieder umkämpft – wegen seiner intransparenten Analysemethod en\, seiner Zusammenarbeit mit autoritären Staaten und seiner Nähe zur U S-Regierung.\n\nRechtlich ist der Einsatz von Analysetools wie von Palanti r in Deutschland ohnehin komplex\, denn das Bundesverfassungsgericht hat 2 023 deutliche Grenzen für polizeiliche Datenanalysen gezogen. Dennoch hab en mehrere Bundesländer für ihre Polizeien Verträge oder streben sie an . Auch auf Bundesebene wird der Einsatz für das Bundeskriminalamt und die Bundespolizei hitzig diskutiert.\n\nWie funktioniert Gotham und welche Ge fahren gehen damit einher?\nWelche Entwicklungen sind im Bund und in den Ländern zu beobachten? Wie geht es weiter?\n\nWir wollen über den Stand der Dinge in Bund und Ländern informieren und auch zeigen\, wie wir versu chen\, rechtliche Vorgaben durchzusetzen. Denn die GFF und der CCC sind an Verfassungsbeschwerden beteiligt\, unter anderem in Hessen\, Hamburg und zuletzt in Bayern.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/blackbox-palantir END:VEVENT BEGIN:VEVENT SUMMARY:10 years of Dieselgate DTSTART:20251229T204500Z DTEND:20251229T214500Z UID:a877c904-f887-588e-9637-9b1df2f019dd CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/10-yea rs-of-dieselgate\n\nDescription:\n10 years ago\, Felix spent a lot of slee pless nights on reverse-engineering the Diesel software that implemented t he (by now) well-known "Acoustic Function" defeat device\; he presented my findings at the 32c3 and 33c3 in 2015 and 2016\, expecting this to be the last time we needed to hear about this.\n\nLittle did he know about the e xtent of the Diesel emissions cheating. Since then he has analyzed many mo re vehicles\, learned a bit or two about mechanical engineering problems o f cars.\n\nKarsten\, working as a court-appraised expert\, will add his un ique view on the challenges in documenting software that was never meant t o be understood by the public.\n\nThis talk will discuss methodologies of independent analysis of highly dynamic systems that many people see as bla ck boxes (but that\, of course\, are not: they are just machines running s oftware).\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/10-years-of-dieselgate END:VEVENT BEGIN:VEVENT SUMMARY:Rowhammer in the Wild: Large-Scale Insights from FlippyR.AM DTSTART:20251229T220000Z DTEND:20251229T224000Z UID:1627c5c1-db61-5117-aa41-991850cc20a8 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/rowham mer-in-the-wild-large-scale-insights-from-flippyr-am\n\nDescription:\nThis will be a followup talk after our talk "Ten Years of Rowhammer: A Retrosp ect (and Path to the Future)" at 38C3.\nIn the talk last year we gave an o verview of the current state of Rowhammer and highlighted that there are n o large-scale prevalence studies.\nWe wanted to change that and asked the audience to participate in our large-scale study on Rowhammer prevalence. \n\nWe performed the large-scale study on Rowhammer prevalence thanks to m any volunteers supporting our study by measuring their systems.\nIn total \, we collected 1006 datasets on 822 different systems (some systems were measured multiple times).\nWe show that 126 of them (12.5%) are affected b y Rowhammer with our fully-automated setup.\nThis should be seen as a lowe r bound\, since the preconditions required for effective tools failed on ~ 50% of the systems.\nAmong many other insights\, we learned that the fully -automated reverse-engineering of DRAM addressing functions is still an op en problem and we assume the actual number of affected systems to be highe r as the 12.5% we measured in our study.\n\nNow\, one year after our talk at the 38C3\, we want to give an update on the current state of Rowhammer \, since multiple new insights were published in the last year:\nThe first reliable Rowhammer exploit on DDR5\, a JavaScript implementation of Rowha mmer that works on current DDR4 systems\, and an ECC bypass on DDR4\, just to name a few.\nAdditionally\, we want to present the results of our larg e-scale study on Rowhammer prevalence which was supported by the audience from last year's talk.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/rowhammer-in-the-wild-large- scale-insights-from-flippyr-am END:VEVENT BEGIN:VEVENT SUMMARY:PRÜF DTSTART:20251229T231500Z DTEND:20251229T235500Z UID:35e68e53-852a-56a2-8b3c-1bc27ce7fbb0 CATEGORIES:official,Ethics\, Society & Politics DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/pruf\n \nDescription:\nWir haben eine Forderung: „Alle Parteien\, die vom Verfa ssungsschutz als rechtsextremer Verdachtsfall oder gesichert rechtsextrem eingestuft werden\, sollen durch das Bundesverfassungsgericht überprüft werden.“ Wir demonstrieren so lange\, bis der Bundesrat die Prüfung for mal beantragt hat. PRÜF-Demos. Bald in allen Landeshauptstädten. Am 2. S amstag. Jeden Monat.\n\nWarum beim Schutz der Demokratie nicht mal einen A nsatz wählen\, der so noch nicht probiert wurde? Nicht auf die anderen gu cken\, sondern auf uns? Auf das gemeinsame? Auf Spaß? Das nutzen\, was wi r haben und was wir können? Wir haben das Grundgesetz\, dessen Stärken e ingesetzt werden müssen. Wir haben uns\, Millionen Menschen\, die wir uns organisieren können. Wir haben Ideen\, wir haben Geld\, wir haben Macht \, wir haben Wissen. Bisher haben wir nicht einmal ansatzweise unsere Mög lichkeiten ausgeschöpft und es wäre absurd\, wenn wir das nicht schaffen würden\, die Freiheitliche Demokratische Grundordnung zu schützen.\n\nV ortrag kann Spuren von Prüfen enthalten.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/pruf END:VEVENT BEGIN:VEVENT SUMMARY:Die große Datenschutz-\, Datenpannen- und DS-GVO-Show DTSTART:20251230T000000Z DTEND:20251230T013000Z UID:6396165e-0c44-58d3-a345-a63966473508 CATEGORIES:official,Entertainment DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/die-gr oe-datenschutz-datenpannen-und-ds-gvo-show\n\nDescription:\nDatenschutz wi rd oftmals als lästige Pflicht wahrgenommen – aber was will und macht D atenschutz\, für was ist er sinnvoll und was ist zu beachten? In welche S tolperfallen können auch Nerds hineinfallen? **Die Datenschutz- und DSGVO -Show vermittelt spielerisch Datenschutzgrundlagen\,** bietet einen Einbli ck in die Praxis der Datenschutz-Aufsichtsbehörden und zeigt typische tec hnische wie rechtliche Fehler im Umgang mit personenbezogenen Daten. Aber auch für Datenschutz-Profis und Superhirne sind einige harte Nüsse dabei .\n\nDer Moderator arbeitet beim Landesbeauftragten für den Datenschutz u nd die Informationsfreiheit Baden-Württemberg und berichtet aus der prakt ischen Arbeit einer Aufsichtsbehörde\, nennt rechtliche Grundlagen\, gibt Hinweise zu notwendigen technischen Maßnahmen nach Artikel 32 DS-GVO und die oftmals schwierige Risikoabschätzung nach „wir wurden gecybert“- Sicherheitsvorfällen.\n\nIm Quiz selbst müssen die Kandidat:innen in ihr en Antworten praktische Lösungsvorschläge für häufige technische und r echtliche Probleme vorschlagen\, zum Beispiel welche technischen Maßnahme n bei bestimmten Datenpannen nach dem „Stand der Technik“ angebracht s ind\, ob man als Website-Betreiber denn nun Google Analytics nutzen darf o der wie man sich gegen (rechtswidrige) Datensammler wehrt. Dadurch können Teilnehmer wie Zuschauer die praktische Anwendung der DS-GVO spielerisch lernen.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/die-groe-datenschutz-datenpa nnen-und-ds-gvo-show END:VEVENT BEGIN:VEVENT SUMMARY:Asahi Linux - Porting Linux to Apple Silicon DTSTART:20251230T100000Z DTEND:20251230T104000Z UID:e0739bd6-f804-5fde-8cf6-fc940567bf45 CATEGORIES:official,Hardware DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/asahi- linux-porting-linux-to-apple-silicon\n\nDescription:\nIn this talk\, you w ill learn how Apple Silicon hardware differs from regular laptops or deskt ops.\nWe'll cover how we reverse engineered the hardware without staring a t disassembly but by using a thin hypervisor that traces all MMIO access a nd then wrote Linux drivers.\nWe'll also talk about how upstreaming to the Linux kernel works and how we've significantly decreased our downstream p atches in the past year.\n\nAs an example\, we will use support for the Ty pe-C ports and go into details why these are so complex and required chang es across multi subsystems.\n\nIn the end\, we'll briefly talk about M3/M4 /M5 and what challenges we will have to overcome to get these supported.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/asahi-linux-porting-linux-to -apple-silicon END:VEVENT BEGIN:VEVENT SUMMARY:CCC&T - Cosmic ray\, the Climate Catastrophe and Trains. DTSTART:20251230T105500Z DTEND:20251230T113500Z UID:471f65aa-7729-5e51-b849-4603cfac762f CATEGORIES:official,Science DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/ccc-t- cosmic-ray-the-climate-catastrophe-and-trains\n\nDescription:\nThe Dürrem onitor is a programme that is often mentioned in the German news when some regions experience drought. Alongside the Dürremonitor and the underlyin g Mesoscale Hydrological Model (MHM)\, there is ongoing research at the UF Z concerning soil moisture. Some of these studies involve measuring soil m oisture using a technique called cosmic ray neutron sensing (CRNS). Rather than taking measurements\, the MHM uses a physics-based model incorporati ng precipitation forecasts to predict drought or flood. These two strategi es for quantifying soil moisture are therefore in opposition: the measurem ent-based approach (CRNS) and the modelling-based approach (MHM/Dürremoni tor). CRNS is a relatively new method of measuring soil moisture based on the proportion of neutrons reflected by the soil (the principles were disc overed in the 1980s\, but it has only recently become commercially applica ble). This method has several advantages over previous soil moisture measu rement methods: it is non-invasive\, easy to set up\, portable and can the refore be used on trains.\n\nIn the talk I will give an overview of the D ürremonitor and MHM and then focus on CRNS. I will explain the physical p rinciples behind the method\, how it is implemented in practice by making serveys using trains.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/ccc-t-cosmic-ray-the-climate -catastrophe-and-trains END:VEVENT BEGIN:VEVENT SUMMARY:Security of Cardiac Implantable Electronic Devices DTSTART:20251230T115000Z DTEND:20251230T123000Z UID:0cd9234b-1abb-5fa2-85a9-af1ec76569bb CATEGORIES:not recorded,official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/securi ty-of-cardiac-implantable-electronic-devices\n\nDescription:\nCIEDs may ad versely affect patients implanted with such devices should their security be compromised. Although some efforts to secure these devices can be noted \, it has quite often been lacking and may thus enable patient harm or dat a confidentiality compromise by malicious actors. Given the vast consequen ces of security vulnerabilities within this industry\, the author aims to provide insight into the challenges associated with designing security arc hitectures for such platforms\, as well as possible methodology of researc hing these devices safely even when lacking manufacturer cooperation and a ccess to device programmers.\n\nData collected by CIEDs and transmitted th rough remote monitoring is an additional concern for patients. Whilst rese arch has shown that most manufacturers do respond in a timely and comprehe nsive fashion to GDPR requests\, immediate data access is not yet possible and requires the patient to reach out to their doctors to obtain the requ isite (event) data. A proposed solution is presented on how a patient comm unicator may be designed to allow patients interested in their autonomy to perform limited device interrogation in a safe and secure manner.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/security-of-cardiac-implanta ble-electronic-devices END:VEVENT BEGIN:VEVENT SUMMARY:Breaking BOTS: Cheating at Blue Team CTFs with AI Speed-Runs DTSTART:20251230T125000Z DTEND:20251230T133000Z UID:3d82c56b-fb2f-545f-b8f1-264c220c8f09 CATEGORIES:official,Security DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/breaki ng-bots-cheating-at-blue-team-ctfs-with-ai-speed-runs\n\nDescription:\nTHE PLAN\n\nLive demonstrations of AI agents speed-running blue team challeng es\, including the failure modes that break investigations. We'll show bot h what happens when we try the trivial approaches like “just have claude do it”\, “AI workflows”\, and what ultimately worked\, like managed self-planning\, semantic SIEM layers\, and log agents. Most can be done w ith free and open tools and techniques on the cheap\, so we will walk thro ugh that as well.\n\nTHE DEEP DIVE\n\n* Why normal prompts and static AI w orkflows fail\n* Self-planning investigation agents that evolve task lists dynamically\n* What we mean by semantic layers for calling databases and APIs\n* How to handle millions of log events without bankrupting yourself \n* Why "no AI" rules are misguided technically and conceptually\n\nGOING BEYOND CTFS\n\nThe same patterns that trivialize training exercises work o n real SOC investigations. We're watching blue team work fundamentally tra nsform - from humans investigating to humans managing AI investigators. Tr aining programs teaching skills AI already automates. Hiring practices tha t can't verify who's doing the work. Certifications losing meaning. More f undamentally\, when we talk about who watches the watchers\, a lot is abou t to shift again.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/breaking-bots-cheating-at-bl ue-team-ctfs-with-ai-speed-runs END:VEVENT BEGIN:VEVENT SUMMARY:Security Nightmares DTSTART:20251230T134500Z DTEND:20251230T144500Z UID:a481eb2e-8b78-5f97-bfee-a47d1a271010 CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/securi ty-nightmares\n\nDescription:\nWir wagen auch den IT-Security-Ausblick auf das Jahr 2026. Der ist wie immer mit Vorsicht zu genießen.\n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/security-nightmares END:VEVENT BEGIN:VEVENT SUMMARY:Closing Ceremony DTSTART:20251230T150000Z DTEND:20251230T160000Z UID:319c31a2-af90-5db9-89f0-fe9ac582726e CATEGORIES:official,CCC & Community DESCRIPTION:Full details: https://hub.test.c3voc.de/en/event/detail/closin g-ceremony\n\nDescription:\n \n LOCATION:One URL:https://hub.test.c3voc.de/en/event/detail/closing-ceremony END:VEVENT END:VCALENDAR