fahrplan.xml

<?xml version="1.0" encoding="UTF-8"?>
<schedule>
  <conference>
    <title>28th Chaos Communication Congress</title>
    <subtitle>Behind Enemy Lines</subtitle>
    <venue>bcc</venue>
    <city>Berlin</city>
    <start>2011-12-27</start>
    <end>2011-12-30</end>
    <days>4</days>
    <release>Version 0.21a</release>
    <day_change>04:00</day_change>
    <timeslot_duration>00:15</timeslot_duration>
  </conference>
  <day date="2011-12-27" index="1">
    <room name="Saal 1">
      <event id="4721">
        <start>00:15</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>pentanews_game_show_2k11</slug>
        <title>Pentanews Game Show 2k11/3</title>
        <subtitle>42 new questions, new jokers, same concept, more fun than last year!</subtitle>
        <track>Show</track>
        <type>contest</type>
        <language>en</language>
        <abstract>The Penta News Game Show rehashes a collection of absurd, day-to-day
news items of 2011 to entertain the audience, let the Net participate,
and make it's winners heroes.</abstract>
        <description>Die coole Pentanews gameshow hat das Publikum schon auf zahlreichen (4) Chaos-Events zum lachen und mitdenken gebracht. In heiterer Runde geht es darum, details absurder News, die eh jeder schon bei fefe &amp; co gelesen hat, zu erg&#228;nzen. Das is' aber dann doch immer gar nicht so einfach und deswegen stehen den Mitspielern hierf&#252;r m&#228;chtige Joker (wie z.B. aktuelles Meinungsbild aus dem IRC) zur Seite.</description>
        <persons>
          <person id="5">Alien8</person>
          <person id="3307">_john</person>
          <person id="879">klobs</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4897">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>keynote</slug>
        <title>Keynote</title>
        <subtitle></subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract></abstract>
        <description></description>
        <persons>
          <person id="3605">Evgeny Morozov</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4876">
        <start>12:45</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>die_spinnen_die_sachsen</slug>
        <title>Die spinnen, die Sachsen</title>
        <subtitle>On- und Offline-&#220;berwachung: Weil sie es k&#246;nnen</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Die Meldungen aus Sachsen in diesem Jahr wirkten f&#252;r alle, die nicht dort wohnen, ein bisschen, als k&#228;men sie von einem sehr weit entfernten Stern. In regelm&#228;&#223;igen Abst&#228;nden werden Dinge bekannt, die jeweils einzeln fr&#252;her zum R&#252;cktritt von Ministern gef&#252;hrt h&#228;tten. Funkzellenabfrage, &#167;129-Verfahren, die Durchsuchung eines Pfarrers, Aberkennung der Immunit&#228;t eines Fraktionsvorsitzenden wegen R&#228;delf&#252;hrerschaft: umfassende Kriminalisierung von Protesten gegen Nazis, und zwar weit bis in die "Mitte der Gesellschaft". Offline-&#220;berwachung und -Drangsalierung sind in Sachsen Alltag. Der Talk gibt einen &#220;berblick &#252;ber den Stand der Dinge und warnt davor, sich (au&#223;erhalb Sachsens) gem&#252;tlich schaudernd zur&#252;ckzulehnen. Denn: Wenn Sachsen damit durchkommt, setzt das Ma&#223;st&#228;be f&#252;r andere Bundesl&#228;nder.</abstract>
        <description>Die Meldungen aus Sachsen in diesem Jahr wirkten f&#252;r alle, die nicht dort wohnen, ein bisschen, als k&#228;men sie von einem weit entfernten Stern. In regelm&#228;&#223;igen Abst&#228;nden werden Dinge bekannt, die jeweils einzeln fr&#252;her zum R&#252;cktritt von Ministern gef&#252;hrt h&#228;tten. Die Funkzellenabfrage ("Handygate"), ein oder mehrere &#167;129-Verfahren, die Durchsuchung eines Pfarrers, Aberkennung der Immunit&#228;t eines Fraktionsvorsitzenden wegen R&#228;delf&#252;hrerschaft: umfassende Kriminalisierung von Protesten gegen Nazis, und zwar weit bis in die "Mitte der Gesellschaft". Inzwischen gibt es Klagen von Betroffenen gegen die Auswertung ihrer Handy-Daten, u.a. von JournalistInnen, Rechtsanw&#228;ltInnen, Abgeordneten. 

Auf der Bundesebene wurden einzelne drastische Grundrechtseingriffe vom Verfassungsgericht korrigiert mit dem Ergebnis, dass bei vielen das beruhigende Gef&#252;hl blieb, dass irgendwie doch alles mit rechten Dingen zugeht. Ob die s&#228;chsischen Gerichte denselben Weg gehen, wird sich zeigen. Ganz offensichtlich ist jedenfalls, dass die s&#228;chsischen Beh&#246;rden sich von Kritik nicht beeindrucken lassen.
  
Der Talk gibt einen &#220;berblick &#252;ber den Stand der Dinge und warnt davor, sich (au&#223;erhalb Sachsens) gem&#252;tlich schaudernd zur&#252;ckzulehnen. Denn: Wenn Sachsen damit durchkommt, setzt das auch Ma&#223;st&#228;be f&#252;r andere Bundesl&#228;nder.</description>
        <persons>
          <person id="2218">Anne Roth</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4732">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>datamining_for_hackers</slug>
        <title>Datamining for Hackers</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>shows you how to datamine huge piles of data and how to get some clue out of it.</abstract>
        <description></description>
        <persons>
          <person id="3625">Stefan Burschka</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4848">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>the_coming_war_on_general_computation</slug>
        <title>The coming war on general computation</title>
        <subtitle>The copyright war was just the beginning</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The last 20 years of Internet policy have been dominated by the copyright war, but the war turns out only to have been a skirmish. The coming century will be dominated by war against the general purpose computer, and the stakes are the freedom, fortune and privacy of the entire human race.</abstract>
        <description>The problem is twofold: first, there is no known general-purpose computer that can execute all the programs we can think of except the naughty ones; second, general-purpose computers have replaced every other device in our world. There are no airplanes, only computers that fly. There are no cars, only computers we sit in. There are no hearing aids, only computers we put in our ears. There are no 3D printers, only computers that drive peripherals. There are no radios, only computers with fast ADCs and DACs and phased-array antennas. Consequently anything you do to "secure" anything with a computer in it ends up undermining the capabilities and security of every other corner of modern human society.

And general purpose computers *can* cause harm -- whether it's printing out AR15 components, causing mid-air collisions, or snarling traffic. So the number of parties with legitimate grievances against computers are going to continue to multiply, as will the cries to regulate PCs.

The primary regulatory impulse is to use combinations of code-signing and other "trust" mechanisms to create computers that run programs that users can't inspect or terminate, that run without users' consent or knowledge, and that run even when users don't want them to.

The upshot: a world of ubiquitous malware, where everything we do to make things better only makes it worse, where the tools of liberation become tools of oppression.

Our duty and challenge is to devise systems for mitigating the harm of general purpose computing without recourse to spyware, first to keep ourselves safe, and second to keep computers safe from the regulatory impulse.</description>
        <persons>
          <person id="3621">Cory Doctorow</person>
        </persons>
        <links>
          <link href="http://craphound.com/bio.php">Bio Cory Doctorow</link>
        </links>
      </event>
      <event id="4736">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug></slug>
        <title>Defending mobile phones</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Cell phone users face an increasing frequency and depth of privacy intruding attacks. Defense knowledge has not scaled at the same speed as attack capabilities. This talk intends to revert this imbalance.</abstract>
        <description>Most severe attack vectors on mobile phones are due to an outdated technology base that lacks strong cryptographic authentication or confidentiality. Given this discrepancy between protection need and reality, a number of countermeasures were developed for networks and phones to better protect their users.

We explain the most important measures and track their deployment. Furthermore, we will release tools to measure the level of vulnerability of networks. Sharing the results of these measurements will hopefully create problem awareness and demand for more security by phone users around the world.</description>
        <persons>
          <person id="1317">Karsten Nohl</person>
          <person id="3341">Luca Melette</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
    <room name="Saal 2">
      <event id="4777">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>r0ket</slug>
        <title>r0ket++</title>
        <subtitle>The CCC-Badge</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Now you've got that r0ket thing. What to do with it?</abstract>
        <description>Besides being a shiny electronic name tag, the r0ket is an easy to use full featured microcontroller development board. We want to encourage you to tinker with your badge. Write your own software or build a pluggable hardware m0dul. Surprise us and the congress audience with your project!
</description>
        <persons>
          <person id="2856">lilafisch</person>
          <person id="101">Stefan 'Sec' Zehl</person>
        </persons>
        <links>
          <link href="http://r0ket.badge.events.ccc.de/">r0ket wiki</link>
        </links>
      </event>
      <event id="4661">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>scade_and_plc_vulnerabilities_in_correctional_facilities</slug>
        <title>SCADA and PLC Vulnerabilities in Correctional Facilities</title>
        <subtitle>Tiffany Rad, Teague Newman, John Strauchs</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Many prisons and jails use SCADA systems with PLCs to open and close doors. Using original and publically available exploits along with evaluating vulnerabilities in electronic and physical security designs, Newman, Rad and Strauchs have discovered significant vulnerabilities in PLCs used in correctional facilities by being able to remotely flip the switches to &#8220;open&#8221; or &#8220;locked closed&#8221; on cell doors and gates. This talk will evaluate and demo SCADA systems and PLC vulnerabilities in correctional and government secured facilities while recommending solutions. </abstract>
        <description>We figured out how to remotely hack into prisons cell and gate control systems by using publically available Siemens PLC exploits as well as creating our own. Teague and Tiffany did a walk-through a jail in the southwest, USA, saw PLCs in use, took pictures and saw prison guards accessing Gmail from the Control Room computers. We will be presenting the results of this research with John Strauchs discussing electronic and physical security vulnerabilities in modern prison design. Our research was presented at Defcon 19, Las Vegas, NV.</description>
        <persons>
          <person id="3637">Teague</person>
          <person id="3458">Tiffany Rad</person>
        </persons>
        <links>
          <link href="http://www.coresecurity.com/files/attachments/PLC_White_Paper_Newman_Rad_Strauchs_July22_2011_Final.pdf">White Paper</link>
          <link href="http://www.wired.com/threatlevel/2011/07/prison-plc-vulnerabilities/">Wired Magazine article about our work</link>
          <link href="http://www.theregister.co.uk/2011/08/01/stuxnet_and_jails/">The Register article about our work</link>
          <link href="http://www.spiegel.de/netzwelt/web/0,1518,777517,00.html">Der Spiegel article about our work</link>
        </links>
      </event>
      <event id="4749">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>does_hacktivism_matter</slug>
        <title>Does Hacktivism Matter?</title>
        <subtitle>How the Btx hack changed computer law-making in Germany</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Do you remember those days when hackers were &#8220;real men?&#8221; When hacking was not yet a crime and the cyberspace an undiscovered land? Just before anti-hacking laws were introduced in Germany? Back in these days, the famous founding father of the CCC made the Bundespost (Germany's Federal Mail Service) meet its Waterloo, when they hacked Bildschirmtext (Btx)&#8212;the epitome of both technological utopias and dystopias at that time. But soon, hackers suffered a setback: new laws criminalized hacking in the name of fighting white-collar crimes. Simultaneously to the laws, things were getting rougher in the media and the public opinion. While being seen as a weird vanguard of technology before, hackers soon became pranksters and outlaws. Apparently hacktivism, the portmanteau word for hacking activism, had failed to shape the policies in the dawning information society. However, there are evidences that hacktivism had an impact on the new computer crime legislation&#8212;not in terms of having more, but less restrictions implemented in the law.</abstract>
        <description>In my talk, I take a historian's point of view. First, I will show in which atmosphere of anxiety and excitement information technology evolved in Germany in the early 1980s. Then, I will give a very short description of the Btx hack, which is usually neglected in historical science. After giving this background, I will reconstruct the debates of white-collar crime law-making in context of the &#8220;2. WiKG&#8221; (Zweites Wirtschaftskriminalit&#228;tsbek&#228;mpfungsgesetz) in 1984-86. I will show, how different stakeholders demanded a strict law that penalized virtually every aspect of hacking while the politicians&#8212;even those from the conservative party&#8212;honored the guys who unveiled security flaws in Btx. This had led to the invention of &#8220;good&#8221; and &#8220;bad&#8221; hackers in juridical discourses. This distinction has been maintained in law journals, but likewise neglected in most court decisions. My talk will conclude by arguing that hacktivism matters in shaping policies by indirectly changing mind-sets, even if it fails to win every single battle. So, the impact of hacktivism is not part of a rational debate, but of a more complex strategic situation in which rational arguments only play a minor role.</description>
        <persons>
          <person id="2878">Kai Denker</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4713">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>what_is_in_a_name</slug>
        <title>What is in a name?</title>
        <subtitle>Identity-Regimes from 1500 to the 2000s</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Starting with the history of birth-registration an overview on the historical regimes of naming and identifying people from the 15th to the 20th century is given. the talk will show examples of the different identity media through time and their standardization with the rise of the westphalian nation state and the subsequent developments after the french revolution and during the 20th century. the goal of the talk is to show the complexity of the phenomenon of personal names and their media and the need for an informed debate on who and how naming and identification in the digital age is achieved.
</abstract>
        <description>In July 2011 Google opened the social network named Google+, immediately spawning a fierce debate about its real-name policy barring users from opening accounts with pseudonyms. Just a few days later Facebooks Vice President Randi Zuckerberg echoed Google's sentiment, asserting: &#8220;(&#8230;) anonymity on the Internet has to go away.&#8221; Finally in early August Germanys minister of the interior demanded an end of anonymity on the Internet.

My proposed talk is not concerned with the relation of anonymity and pseudonymity and free speech, discrimination and empowerment that dominated the &#8216;real-name&#8217; &#8220;nymwars&#8221; on the internet. 

Instead it seeks to de-familiarize the notion of the &#8216;real name&#8217; by exposing central aspects of the media-history of names, situating personal names in relation to the development of statehood and capitalism between the 1500 and the 2000s. 

I thus will outline the history and function of birth-registration as introduced in the wake of the reformation in 1543 and its subsequent secularization during the rise of the Westaphalian nation state. 

This includes an overview of the international standardization of both identity papers and personal naming regimes during the 19th century in the context of post-1789 development of statehood and colonization. Moving to the 2oth century I will provide examples of the development and standardization of the passport-system after WWI, and conclude my talk with a synopsis of administrative digital identity vision of the early nineties. 

The goal of the talk is first de-familiarize the notion of the personal-name by showing its complex historical and material background, secondly to contextualize the current developments of digital identity regimes (Neuer Personalausweis, Google+, NSTIC etc) within the larger and longer-term developments of statehood and capitalist societies. Thirdly my talk will show that a name never was ones own but always an intersection of administrative, media-technical and personal interventions and as such is currently becoming a contested phenomenon again, requiring an informed debate about what is in a name. 

Duration 40 mins, presentation style will be slides and accompanying talk, discussion afterwards.



Bio:

Christoph Engemann studied psychology at the University of Bremen and became a Ph.D fellow of the Bremen International Graduate School of Social Sciences in 2002. Between 2003 and 2006 he was named a Non-Residential-Fellow at the Center for Internet and Society Stanford Law School. 

Christoph took part in the 2005 Doctoral Summer School of the Oxford Internet Institute and was a lecturer at the Science, Technology and Society Program at the University of Texas in 2007 and 2008. Since February 2010 he works as researcher and lecturer at the Internationales Kolleg f&#252;r Kulturtechnikforschung und Medienphilosophie at the Bauhaus University Weimar. In 2011 Christoph was a faculty member at the Weimar-Princeton Summer School for Media Studies on the topic of surveillance. 

Christoph is member of the DFG-research network "Digital Citizens and their Identity"

His main areas of research are Governmediality; Digital Identity/Media of Identification and their History; Electronic Government; Genealogy of the Transaction; Political Economy of Internet.</description>
        <persons>
          <person id="3488">Christoph Engemann</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4844">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>eu_datenschutz_internet_der_dinge</slug>
        <title>EU-Datenschutz und das Internet der Dinge</title>
        <subtitle></subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Derzeit arbeitet die EU-Kommission an der Modernisierung der Datenschutzrichtlinie. Dieser Beitrag informiert &#252;ber den Stand der Dinge.</abstract>
        <description>Derzeit arbeitet die EU-Kommission an der Aktualisierung der Datenschutzrichtlinie, um den bestehenden Rechtsrahmen nach 15 Jahren an die neuen technischen und gesellschaftlichen Gegebenheiten anzupassen. Gleichzeitig werden in einer Expertengruppe der EU-Kommission die Herausforderungen an den Datenschutz er&#246;rtert, die sich im Zusammenhang mit dem Internet der Dinge ergeben.

Dieser Beitrag informiert &#252;ber den aktuellen Stand der Dinge auf europ&#228;ischer Ebene und diskutiert mit den TeilnehmerInnen die Positionen, die European Digital Rights (EDRi) in diesen Bereichen vertritt.

(Nach Verf&#252;gbarkeit wird dieser Beitrag gemeinsam mit anderen EDRi-AktivistInnen gestaltet; Arbeitssprache Englisch ist m&#246;glich.)</description>
        <persons>
          <person id="3562">Andreas Krisch</person>
        </persons>
        <links>
          <link href="http://www.edri.org">European Digital Rights (EDRi)</link>
        </links>
      </event>
    </room>
    <room name="Saal 3">
      <event id="4711">
        <start>12:45</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>the_atari_2600_video_computer_system_the_ultimate_talk</slug>
        <title>The Atari 2600 Video Computer System: The Ultimate Talk</title>
        <subtitle>The history, the hardware and howto write programs</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Going more retro than the Commodore C-64: The Atari 2600 VCS was the breakthrough for video games in your own living room. This lecture will cover a bit of the history on how it came to live, describes the hardware used and shows how to write your own code for it.</abstract>
        <description>The Atari 2600 Video Computer System (VCS for short) was the first wide-spread gaming console. It features 128 bytes of RAM, 4k bytes of addressable ROM. This was enough to keep it in production for 10 years.

This lecture divides in three parts:

The first part will cover the history on how it came to live. Learn why the Atari 2600 is technically half a Commodore creation.
Learn why Motorola was really. Can you imagine on how the software was created, since there were no PCs or workstations available at this time? Get to view the probably first easter egg in the history of video games.

The second part will provide an intern view of the chips used in the Atari 2600: the 6507 CPU, the 6532 RIOT (RAM-I/O-Timer) and the TIA (Television Interface Adapter). It will also show why "racing the beam" is so important.

The third part will show how to write your own code. Using emulators, the Harmony cartridge and a self-designed cart that will hopefully be finished by the time of the talk.
This will most probably include an overview on how to we created our own development cartridge using a Cortex M3 micro-controller. The lecture will conclude in showing a small self-coded demo running on real Atari 2600 hardware.</description>
        <persons>
          <person id="3514">Sven Oliver ('SvOlli') Moll</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4799">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>can_trains_be_hacked</slug>
        <title>Can trains be hacked?</title>
        <subtitle>Die Technik der Eisenbahnsicherungsanlagen</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Warum sind Z&#252;ge sicher unterwegs? Wie werden Zusammenst&#246;&#223;e trotz der Gefahr eines menschlichen Fehlverhaltens vermieden? Und was hat das alles mit IT-Sicherheit zu tun?</abstract>
        <description>Der Vortrag beleuchtet die mehr als 130-j&#228;hrige Geschichte der Eisenbahn-Sicherungstechnik, diskutiert die Grundbegriffe des sicheren Eisenbahnbetriebs und erkl&#228;rt die Funktionsweise der verschiedenen Stellwerkstypen, die im Netz der Deutschen Bahn verwendet werden. Neben den &#228;ltesten (jedoch immer noch in gro&#223;er St&#252;ckzahl vorhandenen) rein mechanischen Bauformen besprechen wir sowohl die Gleisbildstellwerke, die auf Relaistechnik basieren, als auch die modernen rechnergest&#252;tzten Stellwerke, die immer gr&#246;&#223;ere Verbreitung finden. (Und wir besprechen anhand von Untersuchungsberichten des Eisenbahnbundesamts warum doch hin und wieder Unf&#228;lle passieren).

W&#228;hrend mechanische und elektrische Sicherungsanlagen in sich geschlossene Systeme sind, nutzen k&#252;nftige Anlagen zunehmend drahtlose Kommunikation. Die Sicherheit der Fahrg&#228;ste h&#228;ngt daher auch von der Sicherheit der zugrundeliegenden Kommunikationsinfrastruktur ab. Im Vortrag gehen wir daher der Frage nach, wie die k&#252;nftige Generation der Sicherungsanlagen abgesichert sein wird, welche neuen Bedrohungsszenarien entstehen und ob daher der "Zug der Zukunft" gehackt werden kann...</description>
        <persons>
          <person id="3165">Stefan Katzenbeisser</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4753">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug></slug>
        <title>The movements against state-controlled Internet in Turkey</title>
        <subtitle>A short account of its history and future challenges</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language></language>
        <abstract>We are members of Alternatif Bili&#351;im Derne&#287;i (Alternative Informatics Association)**, one of many organizations that oppose the ongoing efforts for state-controlled Internet in Turkey. We see that the problems with media control in Turkey and in Europe are increasingly becoming part of a global problem. The governments are working on their own view of a 'secure' Internet, and we have to articulate and suggest an alternative.

In our talk we want to give an account of our anti-censorship movement and the challenges we face in Turkey. We will first provide an overview of the political events; sanctions, censorship regulations and attempts of resistance in the country. Then, we will point out the main problems we face in making use of laws and technology against state control. We would also like to use our presentation as an opportunity to meet people at the CCC with similar affinities and to learn from their experience. We see a great need to create global networks and communities to articulate an alternative message; the Internet as the peoples&#8217; media. </abstract>
        <description>Ali R&#305;za Kele&#351;*
arkeles@alternatifbilisim.org

Ay&#351;e Kaymak
aysakaymak@gmail.com

I&#351;&#305;k Bar&#305;&#351; Fidaner
fidaner@gmail.com

Seda G&#252;rses
sguerses@esat.kuleuven.be 

We are members of Alternatif Bili&#351;im Derne&#287;i (Alternative Informatics Association)**, one of many organizations that oppose the ongoing efforts for state-controlled Internet in Turkey. We see that the problems with media control in Turkey and in Europe are increasingly becoming part of a global problem. The governments are working on their own view of a 'secure' Internet, and we have to articulate and suggest an alternative.

In our talk we want to give an account of our anti-censorship movement and the challenges we face in Turkey. We will first provide an overview of the political events; sanctions, censorship regulations and attempts of resistance in the country. Then, we will point out the main problems we face in making use of laws and technology against state control. We would also like to use our presentation as an opportunity to meet people at the CCC with similar affinities and to learn from their experience. We see a great need to create global networks and communities to articulate an alternative message; the Internet as the peoples&#8217; media.

A short history

Despite its growing economy, democracy and fundamental rights have always been disputed in Turkey, where the shadow of the 1980 coup and still unresolved Kurdish problem is strongly felt, with the state persistently denying Kurdish citizens&#8217; rights and repressing real political opposition to canalize the people&#8217;s consent to the authorized &#8216;official&#8217; parties in the parliament. The coup in 1980 was mainly used to implement liberal policies, and this process is near completion: most state enterprises have been privatized in the last decade, including T&#252;rk Telekom, the phone company and the single ISP that owns the ADSL infrastructure in Turkey. In the same decade, the Internet use became widespread. Yet, the increasing popularity of the Internet has been accompanied by attempts to control it through criminal sanctions.

Until 2007, tens of thousands of websites had been blocked by courts as &#8216;precaution&#8217;, including sites like Wordpress and YouTube. After the Law 5651 in 2007, even more websites were censored directly by government administration. As a response to this law, Sans&#252;re Kar&#351;&#305; Platform (Platform Against Censorship) was organized. In the first anti-censorship rally in 17 July 2010, nearly 3000 people participated, including Internet youth, political parties, trade unions, etc.

Not long after the events in Tunisia and Egypt; the state institution for telecommunication, Bilgi Teknolojileri ve &#304;leti&#351;im Kurumu (BTK) made a decision to force ISPs to provide unpaid Internet filters under the headings 'children', 'family' etc. This move created an enormous reaction, the culmination of which led to a nationwide Internet freedom rally in 15 May 2011 that took place in tens of cities. Alone in Istanbul 60 thousand people marched against the imposed censorship measures. What followed was a smearing campaign by controlled media (including state TV) against the protesters, and a pseudo-governance meeting with NGOs by BTK. After the general elections in June, the war with PKK escalated, suppressing the BTK decision out of media attention. Currently, DNS or IP blocking is used mostly for 'obscene' and in some cases for political websites.

National security has always functioned as an excuse for the Turkish state to introduce exceptions to a rule or to make the exception the rule itself. An example is 'Ulusal Kripto Y&#246;netmeli&#287;i' (National Crypto By-law) that was put in order in 2010. This by-law necessitates &#8216;official authorization&#8217; for any encrypted communication by any citizen, and also requires the citizens to give away their encryption mechanisms and private keys to BTK for &#8216;storage&#8217;.

In conclusion, we have reasons to believe that the government is currently developing infrastructure to utilize methods like deep packet inspection (DPI) as weapons in a 'cyberwar', possibly against its own people. These methods will include monitoring and labeling of Internet users as well as blocking communication. We made use of our 'right to information' to inquire about the plans for employing DPI, but were &#8216;informed&#8217; that this is 'beyond the limits our right to information'.

Problems in using laws &amp; technology against state control

The greatest problems with respect to guaranteeing fundamental rights in technology deployment and use currently are with how laws are made and how they are enforced. The lawmaking process is exclusionist, only including a few NGOs that can better be called QUANGOs (quasi-autonomous non-governmental organizations). There are several political parties and trade unions, but even their peaceful protests are occasionally declared &#8216;unauthorized&#8217; and considered illegal. People in general do not trust the judiciary system, but are simply unorganized and do not believe in their power. The regime bases its legitimacy on ideology and not on lawful justice.

T&#252;rk Telekom (TT), privatized in 2005, monopolizes the ADSL infrastructure, making Internet services expensive and prone to state control. In 2007, a workers' strike in TT had triggered debates on this monopoly being protected by the government. The company also acts as a service provider in several domains, creating questions about net neutrality.

Another problem is with the limitation of how people can relate to technology. Computers, cellphones and other gadgets are aggressively marketed and widely used throughout the country, but the marketed forms of use mostly remain superficial, e.g., these gadgets are depicted as entertainment or as status symbols. We argue that the hegemony of these consumerist cultural connotations do hamper diverse uses of these products for a variety of motivations.

A small community of Linux promoters have emerged around universities. These groups could promote alternative approaches to technology. However, under the usual political fears, they only articulate their positions professionally. Their statements usually target Microsoft or other big proprietary software companies. This position is compatible with the officially accepted national pride and national security positions in Turkey, and hence is limited to politics of technology only (see Pardus project).

Leftist and Kurdish political organizations are in a position to benefit most from digital communication technologies. However, they still lack the capacity and enthusiasm to use it effectively. Alternative political media initiatives online exist, but they are mostly limited to standard uses and their technical quality reflect the lack of developers in the political community.

In Turkey, engineering education is praised and supported by families. Families make up for the lack of a financially strong social system. The society in general also praises technical knowledge. However, a strong barrier separates the 'educated people' who are supposed to know it, from 'regular people' who are only supposed to consume it. Under economic pressure and feeling indebted to their families, most white collar workers dedicate themselves to their work in private companies. There is some space in some universities for shared work and creativity, but such spaces are getting smaller as most universities are being turned into technical schools.

* Ali R&#305;za Kele&#351;, I&#351;&#305;k Bar&#305;&#351; Fidaner are software developers, Ay&#351;e Kaymak is a lawyer from Istanbul. Seda G&#252;rses is an Internet researcher from Brussels.

** Alternatif Bili&#351;im is a social network that includes users, developers and researchers of digital technologies, studying and practicing alternative uses of technology. Ultimately, our objective is to diminish the alienation of people to technical knowledge. </description>
        <persons>
          <person id="3464">Bar&#305;&#351;</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4813">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>macro_dragnets</slug>
        <title>Macro dragnets: Why trawl the river when you can do the whole ocean</title>
        <subtitle>What happens when data collection goes awry in the 21st century</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>As governments increase their data collection capabilities software developers are stepping up to both utilize and augment surveillance capabilities. DNA databases, facial recognition, behavioral patterning, and geographic profiling are all in use today. Police are crowdsourcing identification of suspects and citizens are willingly participating. This talk will cover real technologies in place today as well as educated speculation of what is coming next.   </abstract>
        <description>Conspiracy theorists have been questioning the degree to which anyone truly has privacy for quite some time. State ID &amp; fingerprints have given way to electronic passports &amp; DNA analysis. With the increasing number of DIY BIO groups it isn't outside the realm of speculation to see clandestine collection &amp; generation of genomic information by a state actor. Police agencies are engaging in genomic data collection of suspects, witnesses, and victims with no guarantee of the information safety of those individuals. The current scope of laws in the United States limits "genetic discrimination" to "health insurance and employment decisions" with no limitations on the implication of guilt or agency in a crime at the federal level. Similarly companies are collecting photographs of individuals from online services and using them as the corpus for facial recognition techniques which are then leased to government actors.

The goal of this talk is to:
  Address the current vectors for public identification 
  Discuss potential countermeasures for identification dragnets
  Analyze the role of genomic screening
  Review case studies of individuals trying to avoid "the system" and crowdsourced attempts to identify the individuals
  Imagine one was "erased" from these databases. How can one re-establish positive identification (and would they want to)?

</description>
        <persons>
          <person id="3506">Redbeard</person>
        </persons>
        <links>
          <link href="http://math.scu.edu/~gmohler/crime_project.html">Santa Clara abstract on geographic  profiling</link>
          <link href="http://thomas.loc.gov/cgi-bin/bdquery/z?d110:h.r.00493:#">Text of the Genetic Information Nondiscrimination Act of 2008  (US Law)</link>
          <link href="http://www.identifyrioters.com/">Attempt by Vancouver BC law enforcement to identify riots in the 15/06/2011 riots.</link>
          <link href="http://www.lytro.com/cameras">Lightfield Cameras</link>
          <link href="http://www.digitalsignalcorp.com/">Long range facial recognition</link>
        </links>
      </event>
      <event id="4817">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>string_oriented_programming</slug>
        <title>String Oriented Programming</title>
        <subtitle>Circumventing ASLR, DEP, and Other Guards</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The protection landscape is changing and exploits are getting more and more
sophisticated. Exploit generation toolkits can be used to construct exploits for
specific applications using well-defined algorithms. We present such an
algorithm for leveraging format strings and introduce string oriented
programming.
</abstract>
        <description>String oriented programming takes format string exploits to the next level and
turns an intrusion vector that needs hand-crafted exploits into arbitrary code
execution. Similar to return oriented programming or jump oriented programming
sting oriented programming does not rely on existing code but concatenates
gadgets in the application using static program analysis.

This talk presents an algorithm and a technique that takes a vulnerable
application that contains a format string exploit as a parameter and constructs
a format string exploit that can be used to inject a dynamic jump oriented
programming dispatcher into the running application. String oriented programming
circumvents ASLR, DEP, and ProPolice.</description>
        <persons>
          <person id="2574">Mathias Payer</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
  </day>
  <day date="2011-12-28" index="2">
    <room name="Saal 1">
      <event id="4775">
        <start>00:15</start>
        <duration>02:00</duration>
        <room>Saal 1</room>
        <slug></slug>
        <title>Hacker Jeopardy</title>
        <subtitle>Number guessing for geeks</subtitle>
        <track>Show</track>
        <type>contest</type>
        <language>de</language>
        <abstract>The Hacker Jeopardy is a quiz show.</abstract>
        <description>The well known reversed quiz format, but of course hacker style. It once was entitled "number guessing for geeks" by a German publisher, which of course is an unfair simplification. It's also guessing of letters and special characters. ;)

Three initial rounds will be played, the winners will compete with each other in the final.
</description>
        <persons>
          <person id="933">Ray</person>
          <person id="101">Stefan 'Sec' Zehl</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4804">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>politik_hacken</slug>
        <title>Politik hacken</title>
        <subtitle>Kleine Anleitung zur Nutzung von Sicherheitsl&#252;cken gesellschaftlicher und politischer Kommunikation</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Klassischer Protest, konventionelle Demos, Online-Petitionen und B&#252;rgerinitiativen werden seit einiger Zeit durch neue Instrumente der politischen Partizipation erg&#228;nzt. Deren St&#228;rke liegt in dezentraler Organisation, Kommunikationsguerilla-Aktionen, diskursiver Intervention und kollaborativer Spontaneit&#228;t. Der Vortrag stellt anhand von Beispielen ein Toolset an M&#246;glichkeiten des regelverletzenden und gewaltfreien Mitmischens und Einmischens in Politik vor.</abstract>
        <description>Anonymous, die Hedonistische Internationale, Telecomix oder die Space Hijackers sind einige der Netzwerke, die eine neue Art des Protests und der politischen Einmischung erproben. Ihnen ist gleich, dass sie mit ihren Aktionen immer auch in den medialen Diskurs eingreifen wollen &#8211; und auf eine Richtig- bzw. Weichenstellung f&#252;r eine andere Wahrnehmung der Welt setzen. Das gilt sowohl f&#252;r die Wahrnehmung der Medien als auch f&#252;r die Wahrnehmung von Politik. Bilder und Images werden uminterpretiert, gesellschaftliche Codes geknackt, offene Flanken genutzt. Dabei setzt diese Form des Protests auf Regelverletzung und eine neue Interpretation der Zeichen.

Die Aktionen der Aktivistinnen k&#246;nnen sehr unterschiedlich aussehen. So k&#246;nnen Demos regelrecht gehackt werden, wie etwa eine Demonstration von Guttenberg-Anh&#228;ngern. In diesem Fall war es der Hedonistischen Internationale (HI) gelungen, eine Pro-Guttenberg-Demonstration bei der Versammlungsbeh&#246;rde anzumelden und die Mobilisierung der echten Guttenberg-Fans zu nutzen &#8211; und diese dann auf der Demonstration umzudeuten. Hierdurch wurde die Person Guttenberg zum Abgang noch einmal so l&#228;cherlich gemacht, dass eine R&#252;ckkehr des ehemaligen Verteidigungsministers zumindest heute unwahrscheinlich erscheint.

Um News-Hacking ging es in einer gemeinsamen Aktion der HI und "Der Partei". Hier nutzten die Aktivisten den klassischen "18 Uhr Wahlabend"-TV-Moment, um die Niederlage der Berliner FDP auf deren Wahlparty bei Freibier live im Fernsehen zu feiern.

Die Space Hijackers aus Gro&#223;britannien hingegen fahren mit einem Panzer vor der Bank of Scotland auf &#8211; und freuen sich diebisch als die Polizei diesen beschlagnahmt und dabei mehrere Geb&#228;ude besch&#228;digt.

Oft reicht es auch, zum richtigen Zeitpunkt die Identit&#228;t eines politischen oder &#246;konomischen Players zu &#252;bernehmen, um die mediale Darstellung der Welt mit der eigenen Realt&#228;t in Einklang zu bringen. Wenn nach Fukushima die deutsche Atomlobby auf einmal die zynische Wahrheit twittert oder &#220;berwachungsfirmen wie DigiTask Twitter-Dialoghotlines einrichten, sorgt dies nicht nur f&#252;r Verwirrung, Freude, medientr&#228;chtige juristische Androhungen, sondern tr&#228;gt auch zu einer ver&#228;nderten Wahrnehmung dieser Player selbst bei.

Die Politik zu hacken bedeutet die Sicherheitsl&#252;cken der gesellschaftlicher Kommunikation zu nutzen, um auch in Zukunft genussvoll frei leben zu k&#246;nnen. 

All dies kann man selber machen. Wir sagen wie.</description>
        <persons>
          <person id="3629">Alexander M&#252;ller</person>
          <person id="2737">Montserrat Graupenschl&#228;ger</person>
        </persons>
        <links>
          <link href="http://www.spacehijackers.org/">http://www.spacehijackers.org/</link>
          <link href="http://hedonist-international.org">http://hedonist-international.org</link>
        </links>
      </event>
      <event id="4738">
        <start>12:45</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>echtes_netz</slug>
        <title>Echtes Netz </title>
        <subtitle>Kampagne f&#252;r Netzneutralit&#228;t</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Im Herbst 2011 startet "Echtes Netz", die Kampagne f&#252;r Netzneutralit&#228;t, die vom Digitale Gesellschaft e.V. initiert und von der stiftung bridge gef&#246;rdert wird. Die Kampagne macht sich zur Aufgabe, das Bewusstsein f&#252;r den Wert eines echten Netzes zu steigern und mit Offline- und Onlineaktionen f&#252;r eine gesetzliche Verankerung der Netzneutralit&#228;t zu werben.

Der Vortrag gibt einen &#220;berblick &#252;ber die aktuelle Diskussion rund um die Netzneutralit&#228;t in Deutschland und der EU, zeigt die bis zum Congress erfolgten ersten Schritte der Kampagne und gibt einen Ausblick auf die Debatte und den weiteren Verlauf der Kampagne.</abstract>
        <description></description>
        <persons>
          <person id="2158">Falk L&#252;ke</person>
          <person id="1755">Markus Beckedahl</person>
        </persons>
        <links>
          <link href="http://digitalegesellschaft.de">Digitale Gesellschaft e.V.</link>
          <link href="http://www.echtesnetz.de">Echtes Netz - Kampagne f&#252;r Netzneutralit&#228;t</link>
          <link href="http://www.nichtverfuegbar.de">Aktionsseite f&#252;r Netzneutralit&#228;t</link>
        </links>
      </event>
      <event id="4680">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>effective_dos_attacks_against_web_application_platforms</slug>
        <title>Effective Denial of Service attacks against web application platforms</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>To run an effective Denial of Service attack against a web application, you do not need a botnet. Or that Gigabit uplink that you are dreaming about. Carefully crafted input data can go a long way, too.</abstract>
        <description></description>
        <persons>
          <person id="2014">Alexander &#8216;alech&#8217; Klink</person>
          <person id="2022">Julian | zeri</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4763">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>the_science_of_insecurity</slug>
        <title>The Science of Insecurity</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Why is the overwhelming majority of common networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems to be enough to fix software that must speak certain protocols?
</abstract>
        <description>The answer to these questions is that for many protocols and services currently in use on the Internet, the problem of recognizing and validating their "good", expected inputs from bad ones is either not well-posed or is undecidable (i. e., no algorithm can exist to solve it in the general case), which means that their implementations cannot even be comprehensively tested, let alone automatically checked for weaknesses or correctness. The designers' desire for more functionality
has made these protocols effectively unsecurable.

In this talk we'll draw a direct connection between this ubiquitous insecurity and basic computer science concepts of Turing completeness and theory of languages. We will show how well-meant protocol designs are doomed to their implementations becoming clusters of 0-days, and will show where to look for these 0-days. We will also discuss simple principles of how to avoid designing such protocols.

In memory of Len Sassaman</description>
        <persons>
          <person id="3541">Meredith L. Patterson</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4871">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>hacking_mfps</slug>
        <title>Hacking MFPs</title>
        <subtitle>Part2 - PostScript: Um, you've been hacked</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>We have decided to continue our research onto PostScript realms - an old, very powerful and nicely designed programming language, where (as a coincidence or not, given it's numerous security flaws) Adobe owns most PostScript interpreters instances.

This time we demonstrate that PostScript language, given it's power, elegance and Turing-completeness, can be used more than just for drawing dots, lines and circles - and to a certain extent it can be a hacker's sweet delight if fully mastered.

We will be presenting a real-life implementation of unusual PostScript APIs (along with it's dissection and reconstructed documentation) that interact with various levels of OS and HW, implementation we have found in a TOP10 printer vendor product line.

Also, we will investigate whether a PostScript-based (hence platform-independent) virus (18+ years after first proposals of such theory) can be acomplished, thus giving theoretical hints and few building blocks in this direction.

We will also present some very constructive uses of the PostScript language in the creative (i.e. non-destructive) hacking direction.

In the end, we will try to summarize our conclusions and possible solution for all parties involved (vendors, users, sysadmins, security experts).

With this research we hope we can prove that entire printer industry (devices, printing software/drivers/subsystems, publishing and managed services) have to be rethought security-wise, so that it can withstand in the long run the current security landscape and threats.
</abstract>
        <description>"Hacking MFPs (part2) - PostScript: Um, you've been hacked"

We started our research in early 2010 as a state-of-affairs investigation of the general security related to printers and printing protocols&amp;subsystem.

We have concluded and demonstrated that using malicious documents and applets, it is possible using the PJL protocol to control certain printer functionality, including malicious content upload/download on printers' storage.

As a side effect of the research, several other directions in printers' industry shown prone to malicious attacks (XSS injection and execution, auth-bypass, unauthorized functionality and content access, etc.)

Incidentally, very same period, Stuxnet abused printing subsystems to spread itself and few other printer researches emerged in various directions (PJL password and hard disk abuse, confidential/password data harvesting, Linux-based firmware rev-eng).

All these apparently separate events, just come to prove once again that printers are not forgotten, they spark revived hacking interest and their (mis)use can be harmful and have long-standing effects on one's eneterprise security.

============================================

We have decided to continue our research onto PostScript realms - an old, very powerful and nicely designed programming language, where (as a coincidence or not, given it's numerous security flaws) Adobe owns most PostScript interpreters instances.

This time we demonstrate that PostScript language, given it's power, elegance and Turing-completeness, can be used more than just for drawing dots, lines and circles - and to a certain extent it can be a hacker's sweet delight if fully mastered.

We will be presenting a real-life implementation of unusual PostScript APIs (along with it's dissection and reconstructed documentation) that interact with various levels of OS and HW, implementation we have found in a TOP10 printer vendor product line.

Also, we will investigate whether a PostScript-based (hence platform-independent) virus (18+ years after first proposals of such theory) can be acomplished, thus giving theoretical hints and few building blocks in this direction.

We will also present some very constructive uses of the PostScript language in the creative (i.e. non-destructive) hacking direction.

In the end, we will try to summarize our conclusions and possible solution for all parties involved (vendors, users, sysadmins, security experts).

With this research we hope we can prove that entire printer industry (devices, printing software/drivers/subsystems, publishing and managed services) have to be rethought security-wise, so that it can withstand in the long run the current security landscape and threats.
</description>
        <persons>
          <person id="3584">Andrei Costin</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4800">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>how_governments_have_tried_to_block_tor</slug>
        <title>How governments have tried to block Tor</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Iran blocked Tor handshakes using Deep Packet Inspection (DPI) in January
2011 and September 2011. Bluecoat tested out a Tor handshake filter in
Syria in June 2011. China has been harvesting and blocking IP addresses
for both public Tor relays and private Tor bridges for years.</abstract>
        <description>Roger Dingledine and Jacob Appelbaum will talk about how exactly these
governments are doing the blocking, both in terms of what signatures they
filter in Tor (and how we've gotten around the blocking in each case),
and what technologies they use to deploy the filters -- including the
use of Western technology to operate the surveillance and censorship
infrastructure in Tunisia (Smartfilter), Syria (Bluecoat), and other
countries. We'll cover what we've learned about the mindset of the censor
operators (who in many cases don't want to block Tor because they use
it!), and how we can measure and track the wide-scale censorship in these
countries. Last, we'll explain Tor's development plans to get ahead of
the address harvesting and handshake DPI arms races.</description>
        <persons>
          <person id="199">Roger Dingledine</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4675">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>politik_neusprech_2011</slug>
        <title>&#8222;Die Koalition setzt sich aber aktiv und ernsthaft daf&#252;r ein&#8220;</title>
        <subtitle>Sprachlicher Nebel in der Politik</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Aktuelle politische Texte (Reden, Interviews) werden auf Leerformeln, F&#252;llsel und &#220;bertreibungen untersucht, die den Text entlarven, selbst wenn der Autor versucht wird, die H&#246;rer bzw. Leser einzulullen, bestimmte sprachliche Mittel verraten, welche eigentlichen Meinungen sich im Text verstecken. Auf diese Weise wird in den Texten sichtbar, was Wilson und Shea als &#8222;Fnord&#8220; bezeichnen.</abstract>
        <description>Der Sprachwissenschaftler Victor Klemperer hat festgestellt: &#8222;Was jemand willentlich verbergen will, sei es vor anderen, sei es vor sich selber, auch was er unbewusst in sich tr&#228;gt: Die Sprache bringt es an den Tag.&#8220; Besonders deutlich wird das an Ausdrucksmitteln, die als &#8222;Nebelsprech&#8220; bezeichnet werden k&#246;nnen: Es handelt sich dabei vor allem um sprachliche F&#252;llsel (Pleonasmen), die im jeweiligen Kontext nichts zur Bedeutung eines Textes beitragen, sondern einer Aussage nur Nachdruck verleihen sollen, den die Aussage gar nicht ben&#246;tigen w&#252;rde, wenn sie ernstgemeint w&#228;re. So hei&#223;t es im Koalitionskompromiss zum Weiterbau der A100 in Berlin: &#8222;Das Projekt des 16. Bauabschnitts der BAB 100 wird nicht grunds&#228;tzlich aufgegeben. Die Koalition setzt sich aber aktiv und ernsthaft daf&#252;r ein, dass eine Umwidmung der Bundesmittel erm&#246;glicht wird." Die Adverbien &#8222;aktiv&#8220; und &#8222;ernsthaft&#8220; haben hier eine entlarvende Wirkung, denn ein passiver und scherzhafter Einsatz f&#252;r eine Forderung ist ja gar nicht vorstellbar. In der Rhetorik spricht man in diesem Zusammenhang von einer Hyperbel, die allerdings im vorliegenden Fall misslungen ist, denn die hyperbolische Steigerung legt nahe, dass mit Aktivit&#228;ten in diesem Zusammenhang m&#246;glicherweise nicht zu rechnen ist. Auch wenn &#8222;vorbehaltlos, r&#252;ckhaltlos und umfassend analysiert" wird (Merkel), sollte man hellh&#246;rig werden, denn was &#8222;v&#246;llig ungef&#228;hrlich&#8220; und &#8222;g&#228;nzlich unbedenklich&#8220; ist, hat meist einen Haken. 

Analysiert werden Texte zum &#8222;Atomausstieg&#8220;, zur Vorratsdatenspeicherung und zu weiteren aktuellen Themen, vor allem aus der Netzpolitik.</description>
        <persons>
          <person id="47">maha/Martin Haase</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4676">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>apple_vs_google_client_platforms</slug>
        <title>Apple vs. Google Client Platforms</title>
        <subtitle>How you end up being the Victim.</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>We will discuss the two different approaches Apple and Google take for the
client platforms iPad and Chromebook, how they are similar and how they 
are not. </abstract>
        <description>From the security architecture and integrity protection details
to your account and identity that links you firmly back to the respective
vendor, we will provide the big picture with occasional close-up shots. 
Here is what powers the vendor has over you, or what powers he gives to
arbitrary unwashed attackers at conferences through fails in logic, binary
or HTML.</description>
        <persons>
          <person id="3609">Bruhns</person>
          <person id="134">FX of Phenoelit</person>
          <person id="3479">greg</person>
        </persons>
        <links>
          <link href="http://www.recurity-labs.com">Recurity Labs</link>
        </links>
      </event>
      <event id="4766">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>802_11_packets_in_packets</slug>
        <title>802.11 Packets in Packets</title>
        <subtitle>A Standard-Compliant Exploit of Layer 1</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>New to 2011, Packet-in-Packet exploits allow for injection of raw radio frames into remote wireless networks. In these exploits, an attacker crafts a string that when transmitted over the air creates the symbols of a complete and valid radio packet. When radio interference damages the beginning of the outer packet, the receiver is tricked into seeing only the inner packet, allowing a frame to be remotely injected. The attacker requires no radio, and injection occurs without a software or hardware bug.</abstract>
        <description>This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers.

Unlike the simpler implementations for 802.15.4 and 2FSK, 802.11B presents a number of unique challenges to the PIP implementer. A single packet can use up to three symbol sets and three data-rates, switching rates once within the header and a second time for the beginning of the body. Additionally, a 7-bit scrambler randomizes the encoding of each packet, so the same string of text can be represented 128 different ways at the exact same rate and encoding.

This lecture presents the first implementation of Packet-in-Packet injection for 802.11B, allowing malicious PHY-Layer frames to be remotely injected. The attack is standards-compliant and compatible with all vendors and drivers.

As a demo, we intend to present a malicious string which can be embedded in any file with lots of slack space, such as an ISO image. When this image is downloaded over HTTP on 802.11B, beacon frames will be injected. For the demo, we will be injecting the SSID stack buffer overflow frames from Uninformed Volume 6.</description>
        <persons>
          <person id="1978">Travis Goodspeed</person>
        </persons>
        <links>
          <link href="http://travisgoodspeed.blogspot.com/2011/09/remotely-exploiting-phy-layer.html">Introduction to PIP</link>
          <link href="http://www.usenix.org/events/woot11/tech/final_files/Goodspeed.pdf">PIP for 802.15.4 and 2FSK</link>
        </links>
      </event>
    </room>
    <room name="Saal 2">
      <event id="4722">
        <start>00:15</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>dick_size_war_for_nerds</slug>
        <title>NPC - Nerds&#8217; Pissing Contest</title>
        <subtitle>Mein Ruby ist besser als dein urxvt!</subtitle>
        <track>Show</track>
        <type>contest</type>
        <language></language>
        <abstract>Hier geht es um die Gretchenfrage: &#8222;Welches Tool ist das beste?&#8220; Dabei treten 2 Teams gegeneinander an und m&#252;ssen live verschiedene $RANDOM_NERD_TASK auf ihren eigenen Rechnern l&#246;sen. Wer dabei zeigt, dass sein Tool das schnellere, schlankere, m&#228;chtigere, l&#228;ngere, gr&#246;&#223;ere^w^w^w^wist, gewinnt. Durch das Programm f&#252;hren Jan &#8222;git-zsh-keynote-firefox&#8220; Wulfes und Benjamin &#8222;bzr-fish-latexbeamer-chrome&#8220; Kellermann.
</abstract>
        <description>In der heutigen Ausgabe von DSW4nerds geht es darum herauszufinden, welcher Editor der beste ist. Zwei Teams (&#224; 1-4 Teilnehmer) treten mit dem Editor ihrer Wahl gegeneinander an, um diese religi&#246;se Frage zu beantworten.

Nach einer dreimin&#252;tigen Laudatio zum Editor ihrer Wahl m&#252;ssen sie in der Pflicht vorgegebene Aufgaben vor den Augen des Publikums m&#246;glichst schnell und elegant l&#246;sen. Hierzu d&#252;rfen die Teams ihre Konfigurationsdateien verwenden.

In der K&#252;r muss jedes Team von der Default-Konfiguration aus startend die St&#228;rken seines Editors durch einen kleinen Stunt pr&#228;sentieren, welcher dann vom jeweils anderen Team ebenfalls gestanden, oder sogar getoppt werden muss.</description>
        <persons>
          <person id="1725">Benjamin Kellermann</person>
          <person id="879">klobs</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4768">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>eating_in_the_anthropocene</slug>
        <title>Eating in the Anthropocene</title>
        <subtitle>Transgenic Fish, Mutagenic Grapefruits and Space Potatoes</subtitle>
        <track>Culture</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Over the last few years hackers have begun to take a larger interest in food, gastronomy and agriculture.  For many in the community the ability to create DIY molecular gastronomy hardware and recipes is an obvious entry point.  This talk extends some of these early investigations beyond the kitchen and the chemical properties of food by looking at specific cultivars, food technology organizations, and connections between food systems, ecosystems and planetary change.

Part 1 of the talk explores some of the more bizarre and interesting biotechnologies and genomes that make up the human food system on planet earth, including Chinese Space Potatoes, Mutagenic Grapefruits and Glowing Sushi.  

Pat 2 of the talk presents ideas of food system redesign particularly relevant to hackers and food explorers: utopian cuisines, resilient biotechnologies and eaters as agents of selection.

In Part 3 we provide access to resources and propose interesting projects for black hat food hackers, DIY BIO foodies, and prospective food security researchers, such as mining the IAEA's database of radiation breeding, eating things that weren't meant to be eaten and defending agricultural biodiversity.

By introducing less known stories from the history of food and technology, and providing access to resources we hope to get more hackers curious about exploring, questioning and redesigning our human food systems.

BIO: Zack Denfeld &amp; Cathrine Kramer run the Center for Genomic Gastronomy an independent research institute that studies the genomes and biotechnologies that make up the human food systems on the planet.  They are currently in residence at Art Science Bangalore and a curating a show on the future of food at the Science Gallery in Dublin Ireland.  </abstract>
        <description></description>
        <persons>
          <person id="3623">Cathrine Kramer</person>
          <person id="3494">Zack Denfeld</person>
        </persons>
        <links>
          <link href="http://www.genomicgastronomy.com/">Our research group</link>
          <link href="http://www.glowingsushi.com/">Our cooking show</link>
        </links>
      </event>
      <event id="4652">
        <start>12:45</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>data_mining_the_israeli_census</slug>
        <title>Data Mining the Israeli Census</title>
        <subtitle>Insights into a publicly available registry</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The entire Israeli civil registry database has been leaked to the internet several times over the past decade.
In this talk, we examine interesting data that can be mined and extracted from such database.
Additionally, we will review the implications of such data being publicly available in light of the upcoming biometric database.
</abstract>
        <description>The Israeli census database has been freely available on the Internet since 2001. The database has been illegally leaked due to incompetent data security policies in the Ministry of Interior of Israel, which is responsible for the management of the Israeli census.

The data available includes all personal data of every Israeli citizen: name, ID number, date and location of birth, address, phone number and marital status, as well as linkage to parents and spouses.

In this talk we discuss various statistics, trends and anomalies that such data provides us with insight to.
Personal details will obviously be left out of the talk, though it is important to note that any person who wishes to retrieve such details can easily do so.

We will end the talk with a discussion about upcoming and relevant privacy issues in light of Israel's soon-to-be biometric database.</description>
        <persons>
          <person id="3428">Yuval Adam</person>
        </persons>
        <links>
          <link href="http://y3xz.com">Yuval's Homepage</link>
        </links>
      </event>
      <event id="4770">
        <start>13:15</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>dont_scan_just_ask</slug>
        <title>Don't scan, just ask</title>
        <subtitle>A new approach of identifying vulnerable web applications</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>For years, we tried to identify vulnerable systems in company networks by getting all the companies netblocks / ip addresses and scanning them for vulnerable services. Then with the growing importance of web applications and of course search engines, a new way of identifying vulnerable systems was introduced: "Google hacking". 

However this approach of identifying and scanning companies ip addresses as well as doing some Google hacking for the (known) URLs of the company doesn't take all aspects into account and has some limitations. At first we just check the systems which are obvious, the ones that are in the companies netblocks, the ip addresses that were provided by the company and the URLs that are known or can be resolved using reverse DNS. However how about URLs and systems that aren't obvious? Systems maybe even the company in focus forgot? Second, the current techniques are pretty technical. They don't take the business view into account at any point.

Therefore we developed a new technique as well as framework to identify companies&#8217; web pages based on a scored keyword list. In other words: From zero to owning all of a company&#8217;s existing web pages, even the pages not hosted by the company itself, with just a scored keyword list as input.</abstract>
        <description>For years, we tried to identify vulnerable systems in company networks by getting all the companies netblocks / ip addresses and scanning them in order to identify vulnerable services that could be exploited by an malicious attacker. Then with the growing importance of web applications and of course search engines, a new way of identifying vulnerable systems was introduced: "Google hacking". Thereby we just googled for vulnerable applications using version banners or directories and files without proper access rights set.

However this approach of identifying and scanning companies ip addresses as well as doing some Google hacking for the (known) URLs of the company doesn't take all aspects into account and has some limitations. At first we just check the systems which are obvious, the ones that are in the companies netblocks, the ip addresses that were provided by the company and the URLs that are known or can be resolved using reverse DNS. However how about URLs and systems that aren't obvious? Systems that are hosted by third parties, web pages that were just released for a marketing campaign, maybe even by a third party marketing company but within the name of the company we want to check? Possibly not even the company does remember all the web applications and domains that are running under his name. These systems/applications won&#8217;t be detected using traditional techniques and thus impose a potential security risk for the company. Second, the current techniques are pretty technical. They don't take the business view into account. That means, we try to identify certain applications using technical information like version banner or the comapnies ip addresses in order to identify his systems. But how about the other way around, trying to identify applications and systems by using the company&#8217;s business data (e.g. product names, company names, tax identification numbers, contact persons, &#8230;) and then test the identified systems and applications for vulnerabilities?

That is what we did. The idea is to build up a scored keyword list for the company in focus. This list contains general keywords like the company name, product names, more detailed keywords like an address contained in imprints and very specific keywords like the companies tax number. Every keyword in that list is then rated by human intelligence. Which means specific keywords do have a higher scoring than general keywords. In the next step a spider uses these keywords to query search engines like bing, google, etc. for the keywords and stores all the web sites URLs identified in a database with their scoring. If a web site that already is in the database is found for another keyword, just the score of that entry is increased. At the end, we get a list of websites that contained one or more of the keywords, along with a scoring for each web site. Then the URL is taken and checked whether it contains one of the keywords (e.g. company name). If this is the case, the scoring of the page is increased again. Then for each entry the FQDN as well as the ip is resolved and a whois query is executed. If that whois record does contain the company name, the scoring is increased again. Furthermore the country codes are used to remove results which are not in the target country.

At the end of that process, we do have a list of URLs and FQDNs that could be found using company specific key words. Furthermore that list is scored. Since during that process you get (based on your keyword list) hundred thousands of unique hits, you have to minimize that list. Therefore we did some research on the results generated and found a decent way to minimize the results to an amount that can be checked manually by a human. Then those identified company web pages are passed to a crawler that just extracts external links from those pages, with the idea that correct company pages might link to other company pages, and integrates them to the results list. Using these technique in practice it is possible to identify a lot of web sites hosted (even by third parties) for one company.

During the crawling process not just external links are extracted but all forms, HTTP parameters as well as certain parts of the web content are stored. Thus besides a list, we do have a "mirror" of the web page as well as the forms and dynamic functions that pose an attack surface.

The information collected can then be used as input to special analysis modules. For some of our projects we integrated WAFP (Web Application Finger Printer), SQLMap and other well known tools as well as some other self written fuzzers and fingerprinters into that process. This way the whole process, from identifying web pages belonging to a certain company up to analyzing those for vulnerabilities can be totally automated.

In other words: From zero to owning all of a company&#8217;s existing web pages, even the pages not hosted by the company itself, with just a scored keyword list as input.

During our talk we will present our idea as well as our approach of identifying vulnerable web applications that belong to a certain company, based on business data. Furthermore we will explain how our framework is structured and how it does the searching as well as the vulnerability assessment in an automated way. So everybody who is interested will be able to implement his own version or adapt certain ideas for his projects. Besides just telling you how it could work, we will also present our framework that performs all of the steps described above automatically in a demo.


Fabian &amp; Richard</description>
        <persons>
          <person id="3530">Fabian Mihailowitsch</person>
          <person id="3619">Richard Sammet</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4847">
        <start>14:00</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>reverse_engineering_usb_devices</slug>
        <title>Reverse Engineering USB Devices</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>While USB devices often use standard device classes, some do not. This talk is about reverse engineering the protocols some of these devices use, how the underlying USB protocol gives us some help, and some interesting patterns to look for. I'll also detail the thought processes that went into reverse engineering the Kinect's audio protocol.</abstract>
        <description>This talk will narrate the process of reverse engineering the Kinect audio protocol &#8211; analyzing a set of USB logs, finding patterns, building understanding, developing hypotheses of message structure, and eventually implementing a userspace driver.

I'll also cover how the USB standard can help a reverse engineer out, some common design ideas that I've seen, and ideas for the sorts of tools that could assist in completing this kind of task more efficiently.</description>
        <persons>
          <person id="3499">Drew Fisher</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4826">
        <start>14:30</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>a_brief_history_of_plutocracy</slug>
        <title>A Brief History of Plutocracy</title>
        <subtitle></subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language></language>
        <abstract>This whistlestop re-telling of world economic history squeezes 12,000 years of history into 18 slides. Its focus is the changing nature of money and the rise of the monied class in US and Europe.</abstract>
        <description>It outlines how the modern system of banking was instituted, how international organising allowed the power of the rich to gradually eclipse that of national governments, how war was managed for profit, and how the super-rich set about using the organs of the state in an effort to secure their position of control.</description>
        <persons>
          <person id="3543">Robin Upton</person>
        </persons>
        <links>
          <link href="http://www.altruists.org/">Altruist International</link>
        </links>
      </event>
      <event id="4706">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>power_gadgets_with_your_own_electricity</slug>
        <title>Power gadgets with your own electricity</title>
        <subtitle>escape the basement and make the sun work for you</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>This talk, consisting of five distinct parts, is intended to show the audience how to get electricity without needing a grid connection.
It will give information on
* Which energy sources to use
* What to power with them
* What equipment to get
* How to wire it up
* And some wishful thinking
Participants should be able to assemble their own small-scale energy-generating systems after listening.</abstract>
        <description>Renewable energy isn't for wealthy investors only. You can have it, too.

In this talk we'll show you how to power your own stuff from the sun, wind and other sources of energy.

The talk is divided into 5 different parts:

1. A really short introduction into the available power sources like sun, wind etc. We'll show some pipe-dreams where more hacking is needed to make it work like salt-gradient energy or damming the mediterranean sea.

2. We'll show you how much power you can expect from which source. We'll also show you what affects power output for various technologies (example: Sun needs to be shining for solar power. We'll show you how much sunshine you can expect at your place.)

3. As a follow-up to part 2 we'll show you the amount of power various things need. You can do the math yourself afterwards to see what you can power from your balcony.

4. Building the system, the easy and fully-legal way: Build your own independent grid with optional storage. We'll show what you need for a small-scale solar system independent of the power network. Works well for caravans, camping, gardens and allotments. There will be real solar panels on stage. You will see schematics, parts lists and instructions. We'll give some hints where to aquire the necessary stuff without paying too much.

5. The difficult way: Put your own power into the public grid. We'll show you what you need to do this. This can either make your purse fill up automatically (big installations earning feed-in tariffs) or it can (in theory) make your electricity meter go backwards - but that's not actually allowed. Once the electrical company recognizes what you are doing (and German law requires you to tell them) unfortunately they will install a digial meter. Digital meters will not count backwards like the Ferraris counters do now...


The speakers have built and are operating various small-scale power systems and come from an engineering and commercial background.
</description>
        <persons>
          <person id="3511">Gunnar Th&#246;le</person>
          <person id="3630">Joerg Duerre</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4669">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>bionic_ears</slug>
        <title>Bionic Ears</title>
        <subtitle>Introduction into State-of-the-Art Hearing Aid Technology</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>In many social situations being hearing impaired is a serious handicap, not only for elderly people. Today's hearing aids are tiny computers that do a decent job in signal processing. During the last years, the progress in this technology was significant, amongst other things by switching from analog to digital devices. Since this field becomes more and more related to computer technology, there is even more improvement to be expected. In particular, it turns into a more and more interesting playground for hackers.</abstract>
        <description>Unfortunately, we are still quite far away from what was promised as the future in that 70es TV series "The Bionic Woman" [1]. Starting with a brief introduction about audiology, I will present current technical solutions (and political non-solutions) for hearing aids. Besides the hearing aids themselves, there exist a couple of interesting peripheral solutions for specific situations such as using the phone, listening to concerts and talks, or just consuming music with an mp3 player. All these not only enhance the user's life, they also open the door for creative hacks. Although the hearing-aid hacking community is still rather small, I will present some current projects and ideas for future ones.

[1] http://en.wikipedia.org/wiki/The_Bionic_Woman </description>
        <persons>
          <person id="2343">Helga Velroyen </person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4640">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>time_is_on_my_side</slug>
        <title>Time is on my Side</title>
        <subtitle>Exploiting Timing Side Channel Vulnerabilities on the Web</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Timing side channel attacks are non-intrusive attacks that are still widely ignored in day-to-day penetration testing, although they allow attackers to breach the confidentiality of sensitive information. The reason for this is, that timing attacks are still widely considered to be theoretical. In this talk, I present a toolkit for performing practical timing side channel attacks and showcase several timing attacks against real-world systems.
</abstract>
        <description>Timing side channels are vulnerabilities in software applications that leak sensitive information about secret values such as cryptographic keys. They differ from common intrusive vulnerabilities such as Buffer Overflows or SQL-Injection because the attacker sends normally looking requests to the server and infers secret information just from the time it took to process the request. 

In academia, timing side channel attacks are well researched, especially against cryptographic hardware, but in day-to-day penetration testing, they are still widely ignored. One reason for this is that the timing differences are often small compared to the jitter introduced in networked environments. This makes practical timing side channel attacks challenging, because the actual timing differences blend with the jitter.

In this talk, I will present methods and tools to accurately measure response times despite the jitter in networked environments. I will introduce a programming library that enables penetration testers to measure accurate response times of requests send over networks.

Furthermore, I will describe algorithms and statistical filters to reduce the jitter from measurements. For this, I will introduce a reporting tool that takes a dataset with network measurements as input, automatically applies the algorithms and filters, and produces a report with the results. This report enables even novice penetration testers to analyze a response time dataset for timing side channel vulnerabilities.

In the end, I will show that timing side channels are practical by showing several attacks. First, I show how to determine if a given user name is an administrative user in a productive installation of the popular CMS Typo3. Second, I show how to determine how many pictures are hidden in a private album of an online gallery. Third, I show how to perform an adaptive chosen cipher text attack against implementations of the XML Encryption standard. This attack allows to decrypt any Web Service message whose body was encrypted using XML Encryption only by measuring the response time of the Web Service.</description>
        <persons>
          <person id="3349">Sebastian Schinzel</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4811">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>rootkits_in_your_web_application</slug>
        <title>Rootkits in your Web application</title>
        <subtitle>Achieving a permanent stealthy compromise of user accounts with XSS and JS injection attacks.</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>XSS bugs are the most widely known and commonly occurring Web vulnerability,
but their impact has often been limited to cookie theft and/or simple actions,
such as setting malicious email filters, stealing some data, or
self-propagation via an XSS worm. In this work, I discuss practical approaches
for exploiting XSS and other client-side script injection attacks, and introduce
novel techniques for maintaining and escalating access within the victim's
browser. In particular, I introduce the concept of _resident XSS_ where
attacker-supplied code is running in the context of an affected user's main
application window and describe its consequences. I also draw analogies between
such persistent Web threats and the traditional rootkit model, including
similarities in the areas of embedding malicious code, maintaining access,
stealthy communication with a C&amp;C server, and the difficulty of detecting and
removing attacker-supplied code.
</abstract>
        <description>Despite a few high profile cases of XSS worms, most XSS exploitation attempts
have so far been limited to cookie-stealing and executing simple malicious
actions. However, as a consequence of the same-origin policy and a combination
of other browser mechanisms, a single XSS vulnerability can often lead to a
long-term compromise all of a user's interactions with an affected webapp in
the same browser profile, long after the original bug has been fixed. In
particular, an attacker can maintain access across window/browser closures,
survive cookie and cache deletions, and compromise other user accounts accessed
from the same browser. Yet more troubling is the fact that Web application
authors currently have no means to detect or mitigate such threats once an
attack has taken place.

In the talk I provide an overview of techniques to escalate an XSS into
long-term account compromise, and explore the similarities between such
persistent Web bugs and traditional rootkits. In particular, I:

1) Introduce the concept of _resident XSS_, where malicious JavaScript is
executed in the context of the victim's main application window/tab. Contrary
to the traditional methods of exploiting XSS via a hidden frame or malicious
link which are opened in a separate, usually short-lived window, resident
XSS gives an attacker full freedom to monitor and alter the user's interaction
with the affected application.

2) Describe several techniques to convert various Web bugs into a resident
XSS. Such techniques include backdooring client-side persistent storage
mechanisms (WebSQL, localStorage, Flash LSOs), opening poisoned application
windows with injected malicious scripts, exploiting persistent (self-)XSS and
others.

3) Discuss the consequences of resident XSS, which usually allow the attacker
to get permanent access to an affected user's account and/or obtain the user's
application login credentials. On sensitive domains for which users have
enabled access to additional browser or plugin features (geolocation,
camera/microphone), it can enable persistent snooping on the exploited user. In
a large number of cases it can also enable full compromise of the user's
machine by exploiting the application-user trust relationship (e.g. by
requiring the user to install attacker-supplied plugins to use the affected
webapp, or by hijacking file download links within the vulnerable domain).


4) Analyze the techniques for maintaining access to a once-compromised origin.
In addition to backdooring persistent storage APIs, this can be achieved by
exploiting self-XSS bugs, spawning same-origin pop-unders with references to
the original window, and hiding in frames created by advertising networks on
popular websites. In most cases, a combination of those techniques suffices to
bypass a variety of the most common "cleanup" actions taken by users, and
allows an on-going compromise of the affected origin.

5) Present the difficulties faced by Web application authors when trying to
clean up a compromised origin. Short of wiping/re-creating a browser profile,
there are currently no fully reliable methods to restore a browser's state to a
secure configuration once a malicious script has run in the context of an
affected domain.

I will present the above with concrete examples of vulnerable applications and
a demo.</description>
        <persons>
          <person id="2605">Artur Janc</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4699">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>building_a_distributed_satellite_ground_station_network</slug>
        <title>Building a Distributed Satellite Ground Station Network - A Call To Arms</title>
        <subtitle>Hackers need satellites.  Hackers need internet over satellites.  Satellites require ground stations.  Let's build them!</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>As proposed by Nick Farr et al at CCCamp11, we - the hacker community - are in desperate need for our own communication infrastructure.  So here we are, answering the call for the Hacker Space Program with our proposal of a distributed satellite communications ground station network.  An affordable way to bring satellite communications to a hackerspace near you.
We're proposing a multi-step approach to work towards this goal by setting up a distributed network of ground stations which will ensure a 24/7 communication window - first tracking, then communicating with satellites.
The current state of a proof of concept implementation will be presented.</abstract>
        <description>This is a project closely related to the academic femto-satellite movement, ham radio, Constellation@Home.



The area of small satellites (femto-satellite &lt;0.1 kg up to mini-satellite 100-500 kg) is currently pressed forward by Universities and enables scientific research at a small budget.  Gathered data, both scientific and operational, requires communication between satellites and ground stations as well as to the final recipients of the data.  One either has to establish own transmission stations or rent already existing stations.
The project &#8220;distributed ground station&#8221; is an extension to the project which will offer, at its final expansion state, the ability to receive data from satellites and relay them to the final recepients. It is therefore proposed that a world-wide distributed network of antennas is to be set up which will be connected via the internet allowing the forwarding of received signals to a central server which will in turn forward signals to further recepients.
Individual antennas will be set up by volunteers (Citizen Scientists) and partner institutions (Universities, institutes, companies).
The core objective of the project is to develop an affordable hardware platform (antenna and receiver) to be connected to home computers as well as the required software.  This platform should enable everyone to receive signals from femto-satellites at a budget and in doing so, eradicating black patches where there is currently no ground station to receive signals of satellites passing over-head.
Emphasise is put on contributions by volunteers and ham radio operators who can contribute both passively by setting up a receiver station or actively by shaping the project making it a community driven effort powered by open-source hardware and applications.

Purposes
The distributed ground stations will enable many different uses.
Using distributed ground stations one could receive beacon signals of satellites and triangulate their position and trajectory.  It would therefore be possible  to determine the kepler elements right after launching of a new satellite without having to rely on official reports made at low frequency.
Beacon tracking is also not limited to just satellites but can be used to track other objects like weather balloons and areal drones and record their flight paths.
Additionally, beacon signals (sender ID, time, transmission power) could be augmented with house-keeping data to allow troubleshooting in cases where a main data feed is interrupted.  Details regarding the protocol and maximum data packet length are to be defined during the feasibility study phase.
Furthermore, distributed ground stations can be used as "data dumping" receivers.  This can be used to reduce load on the main ground station as well as to more quickly distribute data to final recipients.  The FunCube project, an out-reach project to schools, is already using a similar approach.
Another expansion stage would be increasing the bandwidth of the individual receivers.
As a side-effect, distributed ground station could also be used to analyse meteorite scattering and study effects in the ionosphere by having a ground-based sender with a known beacon signal to be reflected off meteorites and/or the iononosphere and in turn received by the distributed ground stations.
Depending on the frequency used further applications in the field of atmospheric research, eg. local and regional properties of the air and storm clouds, can be imagined.
Depending on local laws and guidelines, antennas could also be used to transmit signals.
The concept suggests the following expansion stages:
0. Feasibility study for the individual expansion stages  
1. Beacon-Tracking and sender triangulation  
2. Low-bandwidth satellite-data receiver (up to 10 Kbit/s)
3. High-bandwidth satellite-data receiver (up to 10 Mbit/s)  
4. Support for data transmission
Each stage is again split up into sub-projects to deal with hardware and software design and develoment, prototyping, testing and batch/mass production,
Network
The networking concept demands that all distributed ground stations are to be connected via the internet.  This can be achieved using the Constellation platform.  Constellation is a distributed computing project used already for various simulations related to aerospace applications.  The system is based on computation power donated by volunteers which is combined to effectively build a world-wide distributed super-computer.  The software used to do this is BOINC (Berkeley Open Infrastructure for Network Computing) which also offers support for additional hardware to eg.  establish a sensor network.
Another BOINC-project is the Quake Quatcher Network which is using accelleration sensors  built into laptops or custom USB-dongles to detected earthquakes.
Constellation could be enhanced to allow use of the distributed ground station hardware.
Constellation is an academic student group of the DGLR (german aerospace society) at Stuttgart University and is supported by Rechenkraft.net e.V and Selfnet e.V..
Ham radio and volunteers
Special consideration is given to the ham radio community.  Femto-satellites make use of the ham radio bands in the UHF, VHF, and S-Band range.
As a part of the ham radio community ham radio operators should be treated as part of the network.  Ham radio operators hold all required knowledge about the technology required to operate radio equipment and are also well distributed world-wide.
To also make the system attractive to volunteers, hardware should be designed in a way that allows manufacturing and distribution on a budget.  All designs should also be made public to allow own and improved builds of the system by the community.  The hardware should be designed to be simple to use correctly and hard to be used wrong.
Supporters  
[1] Constellation Plattform, aerospaceresearch.net/constellation
[2] shackspace Stuttgart, www.shackspace.de
References
[1] IRS Kleinsatelliten, Universit&#228;t Stuttgart, kleinsatelliten.de
[2] Constellation Plattform, aerospaceresearch.net/constellation
[3] BOINC, Berkely University, boinc.edu
[4] Quake Catcher Network, qcn.stanford.eu
[5] DGLR Bezirksgruppe Stuttgart, stuttgart.dglr.de
[6] Rechenkraft.net e.V., rechenkraft.net
[7] Selfnet e.V., selfnet.de
</description>
        <persons>
          <person id="3620">Andreas Hornig</person>
          <person id="3087">hadez</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4756">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>quantified_self_and_neurofeedback_mind_hacking</slug>
        <title>Quantified-Self and OpenBCI Neurofeedback Mind-Hacking</title>
        <subtitle>Transhumanism, Self-Optimization and Neurofeedback for post-modern hackers</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Hacking Mind and Body &#8211; self knowledge &lt;br&gt;
through numbers and mental reprogramming

Since ancient times humans were trying to improve themselves. Today we have open-source computer technology that helps us.

</abstract>
        <description>Can we use Neurofeedback to increase your intelligence? How do we go about answering the question?
Trust the experts... Outsource responsibility ?! Maybe not:
We create beliefs ourselves without relying on authorities.
We gather empiric evidence about changes of our intelligence.

In this talk we will speak about our own experience on going that way.  We will also speak about the results of other people in the growing Quantified Self movement.

As hackers we look beyond the obvious and directly apparent, behind the curtain of the rabbit hole we find power to change reality.

Let's turn the hacking mindset onto ourselves or shall we say our "Optimized Self". Get an overview of the latest trends in "Quantified Self" Self-Optimization, and mental techniques to level-up the projection of your digital self in the matrix.

Using automated modern computer systems and electronic sensors, we can track the functions and changes of our mind and body and look into the "Mirror of the Digital Self".

Analyzing, and finally optimizing, the patterns we find, a new and optimized self can be envisioned, and gradually metamorphed into, using scientific method and data mining statistics.

- - - -

Join us in this talk about:

&gt; IQ training games &lt;br&gt;
&gt; Bio-Feedback &lt;br&gt;
&gt; Neurofeedback MindHacking &lt;br&gt;

Record work, sleep, exercise, diet, mood, mind, iq, brainwave states and changes, 
and find out when and how you can function best and achieve your goals in post-modern times.

Event image is based on GNU and OpenEEG GPL images, and under CC BY-NC-SA 3.0 license.</description>
        <persons>
          <person id="3447">Christian Kleineidam</person>
          <person id="3513">MetaMind Evolution</person>
        </persons>
        <links>
          <link href="http://www.meta-mind.de">http://www.meta-mind.de</link>
          <link href="http://www.meetup.com/Quantified-Self-Berlin">http://www.meetup.com/Quantified-Self-Berlin</link>
          <link href="http://quantifiedself.com/about">http://quantifiedself.com/about</link>
          <link href="http://events.ccc.de/congress/2011/wiki/QuantifiedSelf_OpenBCI_Talk-Event">http://events.ccc.de/congress/2011/wiki/QuantifiedSelf_OpenBCI_Talk-Event</link>
        </links>
      </event>
    </room>
    <room name="Saal 3">
      <event id="4698">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>making_giving_keeping</slug>
        <title>Making, giving and keeping</title>
        <subtitle></subtitle>
        <track>Community</track>
        <type>lecture</type>
        <language></language>
        <abstract>To be identified and named as the owner of an object makes people understand the world. The object might be a book, a sacred drum or sourcecode, but it is the property of, it is owned by, someone. Ownership is on the other hand not a simple and straight forward manifestation of property relations. Being the owner of a thing and what rights this entitless one to, has to be explored.</abstract>
        <description>As J.K. Rowling explains with the voices of the figures from the Harry Potter universe:

Bill: "You don't understand, Harry, nobody could understand unless they have lived with goblins. To a goblin, the rightful and true master of any object is the maker, not the purchaser. All goblin-made objects are, in goblin eyes, rightfully theirs."
Harry: "But if it was bought --"
Bill: "-- then they would consider it rented by the one who had paid the money." (Harry Potter and the deadly Hallows).

While goblin goods are material ones, this talk will explore the meaning and paradox of owning free software in its immaterial form. The presentation will focus on three terms underpinning the free circulation of sourcecode; making, giving and keeping. An individual might decide to write (make) a piece of software, license it under the GPL (give it away) but still keep it. Sourcecode is never lost by its maker. The whole process becomes a paradox, then how is this possible in a world based on the alienation (selling) of things. Inspiration is derived from five years of anthropological fieldwork and an analytical foray into the cultural importance of inalienable possessions.

The discussion will become a tour de force of connections and similarities between canoes, shellnecklaces and sourcecode &#8211; as well as real-world continuity between people of the Raj Coast of Papua New Guinea, the Baining of Melanesia, hackers who assemble in Berlin and Linux kernel submitters.

Finally; ownership is power. Free software is not apart from relations of power and ownership, though they are seldom addressed directly. Using the Linux kernel as example, the talk will end with a look at how free software property relations continue across time. Hackers are not goblins, but is is not wrong to state that hackers have a different understanding of ownership.</description>
        <persons>
          <person id="3498">Gregers Petersen</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4905">
        <start>12:45</start>
        <duration>02:15</duration>
        <room>Saal 3</room>
        <slug>lightning_talks_day_2</slug>
        <title>Lightning Talks Day 2</title>
        <subtitle></subtitle>
        <track>Community</track>
        <type>other</type>
        <language>en</language>
        <abstract></abstract>
        <description></description>
        <persons>
          <person id="1476">Nick Farr</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4712">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>mining_your_geotags</slug>
        <title>Mining your geotags: am I violating your privacy?</title>
        <subtitle>An application of machine learning to your geo-tags, plus a discussion of privacy issues</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>With every day that passes, users of social media websites are providing scientists with ever-richer, larger datasets on human behavior. At the same time, machine-learning techniques allow us to exploit this data to accurately predict who these users are and how they will behave in the future.  I begin this talk by summarizing some of the recent work that exploits this data and these techniques.  In the second half, I discuss some of the morally ambiguous decisions regarding user privacy that researchers in this field face.</abstract>
        <description>The talk will be broken into two sections.

First I will present the results of my current research. This involves clustering people based on their public geo-tag data. In particular, I classify tourists of Europe into different groups using non-negative matrix factorization.  I have attached a paper which summarizes this work.  I will also summarize some interesting recent work that others have performed which uses machine learning techniques on large social media datasets.

The second half of the talk will discuss the ethical aspects of further research that I would like to conduct to extend my results.  In particular, I would like to figure out more about the users in my dataset--I would like to annotate users with their age, gender, nationality, etc. I will describe how it is possible for me to use Amazon's Mechanical Turk to crowd-source this task for a few thousand users, and then use supervised machine learning classifiers to infer these attributes for the rest of the users.  In the second half of this talk, I want to raise the question of whether this annotation of user profiles is ethically wrong in the case of academic research.

The talk will include a couple of technical slides, but should be understandable by anyone.  I would like around 30-35 minutes for the talk and another 10-15 to hear the opinions of the audience.</description>
        <persons>
          <person id="3517">Conrad Lee</person>
        </persons>
        <links>
          <link href="http://sociograph.blogspot.com/">My blog</link>
        </links>
      </event>
      <event id="4755">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug></slug>
        <title>Counterlobbying the European Parliament</title>
        <subtitle>How European citizens can empower themselves to change the course of Internet Policy Making</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language></language>
        <abstract>After more than one and a half year of discussions the European Parliament will have voted on EU-wide Access Blocking (&#8250;Internetsperren&#8249;) on October 26th.</abstract>
        <description>Using the Child Protection Directive, also know as the Malmstr&#246;m-Proposal (which tried to introduce compulsory blocking for all member states of the EU) as an example, J&#233;r&#233;mie and Christian will try to explain how to involve yourself with hacking the democratic process on a European level.

Also they will try to show what you can do in your home country now that the political process around Access Blocking is switching to the national Governments for the implementation of the Directive.</description>
        <persons>
          <person id="3321">Christian Bahls - MOGiS e.V.</person>
          <person id="1505">J&#233;r&#233;mie Zimmermann</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4758">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>ein_mittelsmannangriff_auf_ein_digitales_signiergeraet</slug>
        <title>Ein Mittelsmannangriff auf ein digitales Signierger&#228;t</title>
        <subtitle>Bachelorarbeit Informatik Uni Kiel SS 2011</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>In dieser Arbeit wird gezeigt, wie unter Ausnutzung einer ungesicherten Verbindung
zwischen einer sicheren Signaturerstellungseinheit und einem Anwender-PC
eine qualifizierte elektronische Signatur gef&#228;lscht werden kann.</abstract>
        <description>In der zum Vortrag geh&#246;renden Bachelorarbeit habe habe ich ein Signaturset der Deutschen Post bestehend aus Chipkartenterminal, Chipkarte und Anwendungssoftware analysiert - und angegriffen. Dazu wurde ein Ger&#228;t gebaut, dass sich in die USB-Leitung einschleifen l&#228;sst und sich dort so lange transparent verh&#228;lt, wie ein Angreifer keine Daten signieren will. Der Angreifer kann per Funk auf das eingeschleuste Ger&#228;t zugreifen, Daten zum Signieren ablegen und signierte Daten abholen. Das ganze nutzt eine ungesicherte USB-Verbindung zwischen Anwender-PC und Chipkartenterminal. Da der Signaturprozess mit einer PIN-Eingabe gesichert ist, muss dem Angreifer bei Verwendung der einfachsten Karte der Post leider einmal eine Fehlermeldung angezeigt werden, um ihn dazu zu bewegen, die PIN erneut einzugeben. Wie genau das ganze umgesetzt ist erfahrt ihr hier.</description>
        <persons>
          <person id="3536">Alexander Koch</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4735">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>reverse_engineering_a_qualcomm_baseband</slug>
        <title>Reverse-engineering a Qualcomm baseband</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Despite their wide presence in our lives, baseband chips are still nowadays
poorly known and understood from a system point of view. Some presentations
have hilighted vulnerabilities in GSM stacks across various models of
basebands (cf. 27c3: _All your baseband are belong to us_ by R-P.  Weinmann).
However none of them actually focused on the details of how a baseband
operating system really works. This is the focus of our presentation.  From
the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will
discuss how to dump the volatile memory, reverse-engineer the proprietary
RTOS, and ultimately execute and debug code while trying to preserve the
real-time system constraints.</abstract>
        <description># Introduction #

The following work has resulted from a straightforward observation: security
in the baseband world is something hard to reach. Anyone trying to get into it
is confronted with two obstacles. At the network level, one has to
apprehend the extremely massive 3GPP specifications. At the system
level, basebands are just undocumented and closed-source pieces of code
running in embedded chips. Consequently, a baseband is mostly seen as a
blackbox running code for a terrifyingly complex network stack. 
 
Given the complexity of the involved network protocols, and the fact that
telephony stacks are historically old pieces of code, it is fairly acceptable
to think that vulnerabilities can be found inside basebands. Ralf-Philipp
Weinmann has already demonstrated this claim during the 27C3 event in 2010.
Finding and triggering vulnerabilities in basebands sound very appealing, but
we have to remember that these are only preliminary steps before the final
exploitation. And for any exploitation to succeed, one has to know the
environment into which the code is currently running. What is the
architecture? What is the operating system? What does the memory look like?
How is structured the heap? Can I safely return to some point and resume the
execution? 
 
For those reasons and out of curiosity, I started exploring the core of a
Qualcomm baseband. The targeted device is the Icon 225 3G USB stick.  It
embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus
two proprietary DSPs. No application processor is present on those USB sticks.
Qualcomm basebands are also notably present on HTC phones.

# Dumping the device memory #

The first step for understanding the baseband code is to manage to get a look
at it. Plugging the USB stick fires up three serial ports over the USB link.
The first one is used to handle Hayes commands to control the modem. The two
other ones are unknown at first glance. However I remarked that a little tool
for SIM-unlocking a device made use of one of those serial ports. After
dumping the USB packets, it appeared this serial link actually handles
diagnostic commands for Qualcomm. The protocol used is very simple and allows
at least writing and executing code into a small region of the memory. 

Injecting a custom payload allowed me to quickly dump the entire contents of
the memory (32MB). On the ARM architecture, the first piece of code to be
executed is a ROM located at 0xffff0000. Reverse-engineering this primary
bootloader (PBL) gives us the entry point to the secondary bootloader (SBL).
Then disassembling the RAM dump from this address clearly indicates we have
one-to-one physical to virtual memory mapping.

# Reverse engineering the RTOS #

The embedded code inside the baseband is a proprietary operating system from
Qualcomm. The real-time microkernel seems to be called REX, while the
operating system itself is named AMSS. 

I have reverse-engineered most part of the microkernel primitives including:
 * the scheduler
 * the inter-tasks communication mechanism 
 * the asynchronous/deferred procedure calls mechanism 
 * the timers 
 * the heap memory structure and allocation routines

The kernel implements lightweight processes called tasks. All tasks share the
same virtual address space. MMU is set up at boot time with a virtual to
physical mapping and the first 12MB of memory are marked read-only. NX is not
enabled (thus everything is executable).

Three tasks are created automatically at boot time:
 * the idle task
 * the DPC task, responsible for dispatching deferred procedure calls
 * the main task, responsible for running all the other tasks

When fully started, AMSS is made up of approximatively 70 running tasks. They
are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network
stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and
miscellaneous features (in particular the diagnostic task). Although the USB
stick is only intended to be used for data over 3G, the operating system is a
full-blown baseband supporting all kinds of telephony stacks and features.

The tasks communicate with each other by the mean of signals and buffer
queues. A command buffer is pushed on a FIFO queue and a signal is sent to the
task for processing.

Regarding the memory allocation management, the operating system mainly uses
two kinds of heaps. The first heap has a classical _free blocks-tracking_
structure where tasks can allocate arbitrary memory blocks using the
malloc/free functions. Another kind of heap is also used on top of the former
to represent the memory as a contiguous stream of data that tasks can produce
and consume (suited for network data flow).

# Code execution and debugging #

Static analysis of the whole operating system is possible, but the code is
pretty massive and a lot of interactions between different tasks are involved at
run-time. Since code execution is possible on the device, I investigated
how to dynamically debug system code. I present here the architecture of the
debugger I am currently writing (this is still a work in progress).

The main point is to be able to debug the operating system with the fewest
possible side-effects. In a nutshell, the debugger has to be real-time
compliant as much as possible. For the communication with the debugger, I
decided to reuse the diagnostic task channel over USB by implementing custom
command handlers. The debugger then relies on the GDB server protocol
implemented over the diagnostic channel protocol, itself being over USB.

We have access to the interrupt vectors, and we can put BKPT instructions
anywhere as well (everything is running in ARM supervisor mode and we can
disable the MMU if necessary). If the exception address is a watchpoint, we
dump the state of registers and stack, and set up a DPC to acknowledge the
debugger of the event. Then execution is immediately resumed. If the exception
address is a breakpoint, then we set up a DPC for the debugger and put the
task into a wait state allowing other tasks to be immediately scheduled. The
execution for the waiting task can be resumed by the debugger by sending it a
special signal.

The debugger is making use of its own separated heap and queue at a high
address, not to interfere with other operating system tasks while processing
debug events.

Of course some tasks will need to process code at timely events, especially
those at the lowest layers, so specific care has to be taken not to put
breakpoints that would possibly break the RF processing.

ARMv5 has no native support for single-stepping the code. Single-step is
implemented by predicting the next PC address and putting a breakpoint at it.

# Notes and further thoughts #

Information about the code execution environment on basebands is clearly
lacking in the literature. On the contrary of previous presentations on the
same topic, this presentation focuses on the details of a proprietary baseband
operating system, in this case Qualcomm's. I intend to do a demonstration of
the debugger for the presentation, and to release the source code later on.

Future areas of work may include a study of the proprietary DSPs and the
possibility to locally _fuzz_ the baseband without using a base station.
</description>
        <persons>
          <person id="3526">Guillaume Delugr&#233;</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4660">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>post_memory_corruption_memory_analysis</slug>
        <title>Post Memory Corruption Memory Analysis</title>
        <subtitle>Automating exploitation of invalid memory writes</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Pmcma is a tool aimed at automating the most time consuming taskes of
exploitation. It for instance determine why an application is triggering
a segmentention fault, evaluate if the faulting instruction can be used
to write to memory or execute arbitrary code, and list all the function
pointers potentially called from a given point in time by an application.

Pmcma is a totally new kind of debugger, which allows for easy
experimentation with a process in memory by forcing it to fork. The
exact replicas of the process created in memory can then be intrumented
while keeping the properties (eg: state of variables, ASLR,
permissions...) of the original process.

Pmcma is an easily extensible framework available under the Apache 2.0
license from http://www.pmcma.org/ .
</abstract>
        <description>In this presentation, we introduce a new exploitation methodology of
invalid memory reads and writes, based on dataflow analysis after a
memory corruption bug has occured inside a running process.

We will expose a methodology which shall help writting a reliable
exploit out of a PoC triggering an invalid memory write, in presence of
security defense mechanisme such as compiler enchancements (full RELRO,
SSP...), or kernel anti exploitation features (ASLR, NX...).

We will demonstrate how to:find all the function pointers inside a
running process, how to determine which ones would have been
dereferenced after the crash, which ones are truncable (in particular
with 0x00000000). In case all of the above fail, how to test for
specific locations overwrites in order to indirectly trigger a second
vulnerability allowing greater control and eventually control flow
hijacking. All of the above without source code, indeed ;)

In the case of invalid memory reads, we will exemplify how indirectly
influence the control flow of execution by reading arbitary values, how
to trace all the unaligned memory access and how to test if an invalid
read can be turned into an invalid write or used to infere the mapping
of the binary.

We will also introduce a new debugging technique which allows for very
effective testing of all of the above by forcing the debugged process to
fork(). Automatically. And with a rating of the best read/write location
based on probabilities of mapping addresses (because of ASLR).

Finally, since overwriting function pointers doesn't allow direct
shellcode execution because of W^X mappings, we introduce a new
exploitation technique which works even in the most hardcore kernels
such as grsecurity. IT is called "stack desynchronization" and allows
frame faking inside the stack itself.

Those techniques are implemented in the form of a proof of concept tool
available under the Apache 2.0 license at : http://www.pmcma.org/ .
</description>
        <persons>
          <person id="1245">endrazine</person>
        </persons>
        <links>
          <link href="http://www.pmcma.org">Pmcma's address</link>
        </links>
      </event>
      <event id="4730">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>crowdsourcing_genome_wide_association_studies</slug>
        <title>Crowdsourcing Genome Wide Association Studies</title>
        <subtitle>Freeing Genetic Data from Corporate Vaults</subtitle>
        <track>Science</track>
        <type>lecture</type>
        <language></language>
        <abstract>It was only a couple of years ago that generating genetic information about individuals was expensive and laborious work. Modern techniques have drastically cut cost and time needed to get an insight into one's genome and have ultimately led to the formation of personal genetics companies &#8211; like 23andMe, deCODEme and others &#8211; that now offer direct-to-customer genetic testing. With a price tag of those tests starting at about 100 &#8364;, the number of people that do such tests is on the rise. By now, 23andMe alone has over 100.000 paying customers, with over 60.000 of them willing to donate their genetic data and to actively participate in research projects by filling out surveys, e.g. on their medical histories. This has resulted in a high-quality dataset with genetic information of 60.000 individuals. The best part: The data has already been paid for by the participants in the research. 

Who would not love to get their hands on data like this? Unfortunately, the data sits locked away in corporate vaults, inaccessible to interested (citizen) scientists. But what if we could change this? 

We've created openSNP, a central, open source, free-to-use repository which lets customers of genotyping companies upload their genotyping data and annotate them with phenotypes. OpenSNP provides its users with the latest scientific research on their genotypes and lets scientists download annotated genotypes to make science more open.</abstract>
        <description>Companies that perform Direct-To-Customer (DTC) genetic tests have now been around for about six years, with 23andMe &#8211; founded in 2006 &#8211; and deCODEme being two of the oldest companies on the market. Their customers receive a test tube via mail, spit into this tube and send it back to their DTC company to get their genetic information analyzed. The tests performed by DTC companies do not utilize the more famous DNA sequencing, but rely on faster and cheaper DNA microarrays instead.

Microarrays screen for around 1 million genetic markers, called Single Nucleotide Polymorphisms (SNPs). A SNP is a genomic variation, where a single base is changed at one site between members of a population. Usually a SNP has only two alleles (variants) and occurs with a frequency of at least 1% in the population. Spread over the whole human genome, each of us carries around 10 million variable sites, where 10% are covered by DTC-companies. Because of their uniqueness, SNPs can be used as markers associated with certain conditions. For example, there are variations of SNPs that are associated with elevated risks of developing breast cancer or Alzheimer&#8217;s. Other SNPs can be used to predict how a person metabolizes chemicals or drugs.

23andMe uses the results of consenting customers to perform their own genome wide association studies (GWAS). Those studies check for statistical differences between different groups. In a simple example one could have a group that is known to have Alzheimer&#8217;s and a control-group that does not have Alzheimer&#8217;s. Given enough participants, one can then look for genetical variants that are over- or underrepresented in one of the groups. The variants that are found by this method can then be used as predictors for Alzheimer&#8217;s.

We feel that research projects all over the world and science in general would benefit from a rich, freely available source of linked, genetic data. And although genome wide association studies need a minimum number of participants to be able to find significant variations, it is not necessary to have 30.000 participants in your study. There are many publications with significant results with a total number of participants of less than 5000 individuals. Given the current number of 23andMe customers, one only needs 5 % of them to participate in freely sharing their genetic information together with basic information on some medical conditions or other variations to reach the critical mass to be able to perform simple association studies! While many people have already started to publish their results on GitHub et al. and movements like DIYBio are starting to take off, there are no real efforts to create a repository to centrally collect this kind of data.

But what if one could create an open platform to collect this kind of linked data? Is it possible to perform crowd-sourced association studies to create new knowledge about our genes? With the creation of openSNP we have tried (and are still trying) to find out.</description>
        <persons>
          <person id="3503">Bastian Greshake</person>
          <person id="3613">Philipp Bayer</person>
        </persons>
        <links>
          <link href="http://opensnp.org">openSNP project website</link>
          <link href="http://opensnp.wordpress.com">openSNP blog</link>
          <link href="http://www.delicious.com/gedankenstuecke/personalgenomics">Delicious link dump on personal genomics</link>
        </links>
      </event>
    </room>
  </day>
  <day date="2011-12-29" index="3">
    <room name="Saal 1">
      <event id="4746">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>bitcoin_an_analysis</slug>
        <title>Bitcoin - An Analysis</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Bitcoin is the first distributed, digital currency.
It received a lot of attention recently as it questions
the state monopoly to issue legal tender. It relies
on distributed proof-of-work concepts to ensure 
money-like characteristics.</abstract>
        <description>The existence and potential widespread use of such
a distributed, non-centralized, non-regulated currency
questions the ability of governments to control money supply,
issue debt, and tax its populace.

Transactions in bitcoin form a publicly accessible network of 
economic relations, which can be extracted from the transaction
history available to all users in the P2P-network of bitcoin.

Using re-identification algorithms it is possible to attack
the proposed anonymity of users. While this is already an
interesting security issue, the insight into a real-world
economic experiment allows for the first time the empirical
test of community structures in such social networks, which
is definitely more substantial than the "I-like"-network
in facebook and the like.

In this presentation, we show results on network analysis
of the money flow, the behavior of individuals, and the overall
scalability of P2P-currencies. At the same time we will
discuss advanced "financial instruments" that one might
find in the transactions.
</description>
        <persons>
          <person id="2626">Kay Hamacher</person>
          <person id="3165">Stefan Katzenbeisser</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4816">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>7_years_400_podcasts_and_lots_of_frequent_flyer_miles</slug>
        <title>7 years, 400+ podcasts, and a whole lot of Frequent Flyer Miles</title>
        <subtitle>Lessons learned from producing a weekly independent podcast on international conflicts and concerns.</subtitle>
        <track>Community</track>
        <type>lecture</type>
        <language></language>
        <abstract>In 2004 I started a weekly podcast on international under-reported news based on a feeling that this was something I enjoy doing and I could be good at. </abstract>
        <description> More than 7 years and 400 episodes later, with the help of listeners and friends, I have travelled almost nonstop to some of the most interesting and unexpected corners of the world. These travels have led me to some unconventional guests, topics, and life choices.  Through it all, week after week, I have kept the program going. The lessons I've learned and continue to learn going forward, tell a story that answers alot of today's most popular questions about the future of the internet and independent journalism. From crowd source funding to the streets of New Orleans, from itunes politics to the mountains of Afghanistan, I will share these stories and whatever wisdom they have brought me.</description>
        <persons>
          <person id="910">Bicyclemark</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4663">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>cellular_protocol_stacks_for_internet</slug>
        <title>Cellular protocol stacks for Internet</title>
        <subtitle>GPRS, EDGE, UMTS, HSPA demystified</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Almost everyone uses the packet oriented transmission modes of cellular networks. However, unlike TCP/IP, Ethernet and Wifi, not many members of the hacker commnunity are familiar with the actual protocol stack for those services.

</abstract>
        <description>This talk is aimed to give an in-depth explanation how the lower layer protocols on the air and wired interfaces
for packet data services in cellular networks are structured.

For 2.5/2.75G, this includes RLC/MAC, NS, BSSGP, LLC, SNDCP, GTP
For 3G/3.5G, this includes RRC, RLC, PDCP, NBAP, RANAP
</description>
        <persons>
          <person id="62">Harald Welte</person>
        </persons>
        <links>
          <link href="http://openbsc.osmocom.org/">OpenBSC project (includes OsmoSGSN)</link>
          <link href="http://">http://</link>
        </links>
      </event>
      <event id="4686">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>implementation_of_mitm_attack_on_hdcp_secured_links</slug>
        <title>Implementation of MITM Attack on HDCP-Secured Links</title>
        <subtitle>A non-copyright circumventing application of the HDCP master key</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>A man-in-the-middle attack on HDCP-secured video links is demonstrated. The attack is implemented on an embedded Linux platform, with the help of a Spartan-6 FPGA, and is capable of operating real-time on HD video links. It utilizes the HDCP master key to derive the corresponding private keys of the video source and sink through observation and computation upon the exchanged public keys. The man-in-the-middle then genlocks its raster and cipher state to the incoming video stream, enabling it to do pixel by pixel swapping of encrypted data. Since the link does no CRC or hash verification of the data, one is able to forge video using this method.</abstract>
        <description>Significantly, the attack enables forging of video data without decrypting original video data, so executing the attack does not constitute copyright circumvention. Therefore, this novel and commercially useful application of the HDCP master key impairs equating, in a legal sense, the master key with circumvention. Finally, the embodiment of the exploit is entirely open-source, including the hardware and the Verilog implementation of the FPGA.

BACKGROUND &amp; CONTEXT

In September 2010, the HDCP master key was circulated via Pastebin. Speculation ensued around the application of the master key to create HDCP strippers, which would enable the circumvention of certain copyright control mechanisms put in place around video links. Unfortunately, this is a legally risky application, for a number of reasons, including potential conflicts with DMCA legislation that criminalizes the circumvention of copyright control mechanisms.

This talk discloses a new use for the HDCP master key that side-steps some of the potential legal issues. This hack never decrypts video; without decryption, there is no circumvention, and as a result the DMCA cannot apply to this hack. Significantly, by demonstrating a bona-fide commercially significant purpose for the HDCP master key that does not circumvent an access control measure, this hack impairs the equating of trafficking or possession of the HDCP master key to circumvention and/or circumvention-related crimes. 

The main purpose of this hack is to enable the overlay of video content onto an HDCP encrypted stream. The simple fact that a trivial video overlay becomes an interesting topic is illustrative of the distortion of traditional rights and freedoms brought about by the DMCA. While the creation of derivative works of video through dynamic compositing and overlay (such as picture in picture) seems intuitively legal and natural in a pre-HDCP world, the introduction of HDCP made it difficult to build such in-line equipment. The putative purpose role of HDCP in the digital video ecosystem is to patch the plaintext-hole in the transmission of otherwise encrypted video from shiny disks (DVDs, BDs) to the glass (LCD, CRT). Since the implementation of video overlay would typically require manipulation of plaintext by intermediate processing elements, or at least the buffering of a plaintext frame where it can be vulnerable to readout, the creation of such devices has generally been very difficult to get past the body that controls the granting of HDCP keys, for fear that they can be hacked and/or repurposed to build an HDCP stripper. Also, while a manufacturer could implement such a feature without the controlling body's blessing, they would have to live in constant fear that their device keys would be revoked.

While the applications of video overlay are numerous, the basic scenario is that while you may be enjoying content X, you would also like to be aware of content Y. To combine the two together would require a video overlay mechanism. Since video overlay mechanisms are effectively banned by the HDCP controlling organization, consumers are slaves to the video producers and distribution networks, because consumers have not been empowered to remix video at the consumption point. 

The specific implementation of this hack enables the overlay of a WebKit browser over any video feed; a concrete example of the capability enabled by this technology is the overlay of twitter feeds as "news crawlers" across a TV program, so that one may watch community commentary in real-time on the same screen. While some TV programs have attempted to incorporate twitter feeds into the show, the incorporation has always been on the source side, and as such users are unable to pick their hashtags. Now, with this hack, the same broadcast program (say, a political debate) can have a very different viewing experience based on which hashtag is keyed into the viewer's twitter crawler.

TECHNICAL IMPLEMENTATION

A Spartan-6 FPGA was used to implement a TMDS-compatible source and sink. TMDS is the signaling standard used by HDMI and DVI. The basic pipeline within the FPGA deserializes incoming video and reserializes it to the output. In this trivial mode, it is simply a signal amplifier for the video.

In order to enable the overlay of a WebKit browser, an 800 MHz ARM-based Linux computer is connected to the FPGA. The Linux computer is based upon the PXA168 by Marvell, and it features 128 MB of DDR2 and a microSD card for firmware. The distribution is based upon Angstrom and it is built using OpenEmbedded with the help of buildbot. The entire build system for the Linux computer is available through a public EC2 cloud image that anyone can copy and rent from Amazon.

From the Linux computer's standpoint, the FPGA emulates a parallel RGB LCD, and thus from the programming standpoint looks simply like a framebuffer at /dev/fb0. There is also a device management interface revealed through I2C that is managed using the standard Linux I2C driver. The I2C management interface handles routine status requests, such as reading the video timing and PLL state, and also handles reading out sections of snooping buffers, the significance of which will be discussed later. The FPGA also has a chroma-key feature where a magic color (240,0,240) is remapped to "transparent".

The FPGA itself is bootstrapped through a programming interface where the device&#8217;s compiled bitstream is sent to the FPGA by writing to /dev/fpga. There are also IOCTLs available on /dev/fpga that enable other meta-level functions such as resetting the FPGA or querying its configuration state. 

In addition to passing through the TMDS signal, the FPGA also has the ability to listen to *and* manipulate the DDC. The DDC is an I2C link found on HDMI cables that enables the reporting of monitor capability records (EDIDs) and also is the medium upon which the key exchange happens. Therefore, being able to listen to this passively is of great importance to the hack. The FPGA implements a "shadow-RAM" which records all reads and writes to specific addresses that fall within the expected address ranges for EDID and HDCP transactions.

The FPGA also implements a "squash-RAM" which is used to override bits on the I2C bus. Since I2C is an open collector standard, overriding a 1 to a 0 is trivial; but, overriding a 0 to a 1 requires an active pull-up. The hardware implements a beefy FET on the DDC to enable overriding 0's to 1's. The DDC implementation uses a highly oversampled I2C state machine. I2C itself only runs at 100 kHz, but the state machine implementation runs at 26 MHz. This allows the state machine to determine the next state of the I2C bus and decide to override or allow the transaction on-the-fly. The "squash-RAM" feature is used to override the EDID negotiation such that the video source is only informed of modes that the FPGA implementation can handle. For example, this implementation cannot handle 3D TV resolutions, so the reporting of such capabilities from the TV is squashed before it can get to the video source. This causes the source to automatically limit its content to be within the hardware capabilities of the FPGA, and to be within the resolutions that are supported by the WebKit UI.

The key exchange on HDCP consists of three pieces of data being passed back and forth: the source public key (Aksv), the sink public key (Bksv), and a piece of shared state (An). The order in which these are written is well-defined. The completion of the transfer of the final byte of Aksv serves as a trigger to initialize the cipher states of the source and the sink. During this time period, each device computes the dot-product of the other device's KSV with their internal private key (which is a table of forty 56-bit numbers) and derives a shared secret, known as Km. This is basically an implementation of Blom's Scheme.

In order to implement the man-in-the-middle attack, the three pieces of data are recorded, and the authentication trigger is passed from the FPGA to the Linux computer through an udev event. udev triggers a program that reads the KSVs from the snoop memory, and performs a computation upon the HDCP master key and the KSVs to derive the private keys that mirrors those found in each of the source and sink devices. In a nutshell, the computation loops through the 40x40 matrix of the HDCP master key, and based upon the KSV having a 1 at a particular bit position it sums in the corresponding 40-entry row or column of the master key to the 40-entry private key vector. The use of a row or columns depends upon if the KSV belongs to a source or a sink.

Once the private keys vectors have been derived, they can be multiplied in exactly the same fashion as would be found in the source or sink to derive the shared secret, Km. 

This shared secret, Km, is then written into the FPGA's HDCP engine, and the cipher state is ready to go. In practice, the entire computation can happen in real-time, but some devices go faster or slower than others, so it is hard to guarantee it always completes in time, particularly with the variable interrupt latency of the udev handler. As a result, the actual link negotiation caches the value of Km from previous authentications, and the udev event primarily verifies that Km hasn't changed (note that for each given source and sink pair, Km is static and never changes, so unless users are pulling cables out and swapping them between devices, Km is essentially static). If the Km has changed, it updates the Km in the FPGA and forces a 150ms hot plug event, which re-initiates the authentication, thereby making the transaction fairly reliable yet effectively real-time.

Significantly, this system as implemented is incapable of operating without having the public keys provided by both the source and the sink. This means that it cannot "create" an HDCP link: this implementation is not an operational HDCP engine on its own. Rather, it requires the user of this overlay hack to "prove" it has previously purchased a full HDCP link through evidence of valid public keys. This &#8220;proof of purchase&#8221; exhausts the proprietary rights to the link associated with first sale doctrine.

Once the FPGA's HDCP cipher state is matched to the video source's cipher state, one can now selectively encrypt different pixels to replace original pixels, and the receiver will decrypt all without any error condition. This is because encryption is done on a pixel by pixel basis and the receiver does little in the way of verification. The lack of link verification is in fact quite intentional and necessary. The natural bit error rate of HD video links is atrocious; but this is acceptable, because the human eye probably won't detect bit errors even on the level of 1 in every 10,000 bits (at high error rates, users see a &#8220;sparkle&#8221; or &#8220;snow&#8221; on the screen, but largely the image is intact). Therefore, this latitude in allowing pixel-level corruption is necessary to keep consumer costs low; otherwise, much higher quality cables would be required along with FEC techniques to achieve a bit error rate that is compatible with strict cryptographic verification techniques such as full-frame hashing. 

The selection of which pixel to swap is done by observing the color of the overlay's video. The overlay video is not encrypted and is generated by the user, so there is no legal violation to look at the color of the overlay video. Note that other pixel-combining methods, such as alpha blending, would necessitate the decryption of video. If the overlay video matches a certain chroma key color, the incoming video is selected; otherwise, the overlay video is selected. This allows for the creation of transparent "holes" in the UI. Since the UI is rendered by a WebKit browser, chroma-key is implemented by simply setting the background color in the CSS of the UI pages to magic-pink. This makes the default state of a web page transparent, with all items rendered on top of it opaque.

Note that pixel-by-pixel manipulation of the incoming video feed is done without any real buffering of the video. A TMDS pixel "lives" inside the FPGA for less than a couple dozen clock cycles: the lifetime of a pixel is simply the latency of the pipelines and the elastic buffers required to deskew wire length differences between differential pairs. This means that the overlay video from the Linux computer must be strictly available at exactly the right time, or else the user will see the overlay jitter and shake. In order to avoid such artifacts, the time resolution requirement of the pixel synchronization is stricter than the width of a pixclock period, which can be as short as dozen nanoseconds. 

In order to accomplish this fine-grain synchronization, a genlock mechanism was implemented where vertical retrace signals (which are unencrypted) trigger an interrupt that initiates the readout of /dev/fb0 to the FPGA. However, the interrupt jitter of a non-realtime Linux is *much* larger than a single pixel time, so in order to absorb this uncertainty, a dynamic genlock engine was implemented in the FPGA. An 8-line overlay video FIFO is used to provide the timing elasticity between the Linux computer and the primary video feed; and the vertical sync interrupt-to-pixel-out latency of the Linux computer is dynamically measured by the FPGA and pre-compensated. In effect, the FPGA measures how slow the Linux box's reflexes are, and requests for the frame to start coming in advance of when the data is needed. These measures, along with a few lines of FIFO, ensure pixel availability at the precise time when the pixel is needed.

SUMMARY

A system has been described that enables a man-in-the-middle attack upon HDCP secured links. The attack enables the overlay of video upon existing streams; an example of an application of the attack is the overlay of a personalized twitter feed over video programs. The attack relies upon the HDCP master key and a snooping mechanism implemented using an FPGA. The implementation of the attack never decrypts previously encrypted video, and it is incapable of operating without an existing, valid HDCP link. It is thus an embodiment of a bona-fide, non-infringing and commercially useful application of the HDCP master key. This embodiment impairs the equating of the HDCP master key with copyright circumvention purposes.
</description>
        <persons>
          <person id="3485">bunnie</person>
        </persons>
        <links>
          <link href="http://wiki.chumby.com/index.php/NeTV_developer_info">link to developer info on the product that embodies the attack</link>
          <link href="http://git.chumby.com.sg/netv_hardware/">link to hardware sources</link>
          <link href="http://www.theregister.co.uk/2011/09/16/chumby_nettv_hack/">an article on the hack</link>
          <link href="http://rdist.root.org/2011/09/13/the-magic-inside-bunnies-new-netv/">another good article</link>
        </links>
      </event>
      <event id="4761">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>new_ways_im_going_to_hack_your_web_app</slug>
        <title>New Ways I'm Going to Hack Your Web App</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Writing secure code is hard.&#160; Even when people do it basically right there are sometimes edge cases that can be exploited. Most the time writing code that works isn&#8217;t even the hard part,&#160; it&#8217;s keeping up with the changing attack techniques while still keeping an eye on all the old issues that can come back to bite you, straddling the ancient world of the 90&#8217;s RFCs and 2010&#8217;s HTML5 compatible browsers.&#160; A lot like how Indiana Jones bridges the ancient and the modern...&#160; Except for Indiana Jones 4. Let&#8217;s never talk about that again. Ever.
&#160;
Take Facebook, Office 365, Wordpress, Exchange, and Live. These are applications that had decent mitigations to standard threats, but they all had edge cases. Using a mix of old and new ingredients, we&#8217;ll provide a sampler plate of clickjacking protection bypasses, CSRF mitigation bypasses, "non-exploitable" XSS attacks that are suddenly exploitable and XML attacks where you can actually get a shell; and we'll talk about how to defend against these attacks.</abstract>
        <description>The best description is probably via the slides linked below. We've put a lot of effort into these, and they have video clips making the slide deck pretty big (why we're linking to it and not attaching it).</description>
        <persons>
          <person id="3631">Jesse Ou</person>
          <person id="3540">Rich</person>
        </persons>
        <links>
          <link href="http://ab.m6.net/bh/blackhat2011_AD.zip">Slides (with video clips). Pass: LwNoouY2DYomv </link>
        </links>
      </event>
      <event id="4866">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>fnord_jahresrueckblick</slug>
        <title>Fnord-Jahresr&#252;ckblick</title>
        <subtitle>von Atomendlager bis Zensus</subtitle>
        <track>Community</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Auch dieses Jahr werden wir euch wieder mit den Fnords des Jahres zu unterhalten suchen.</abstract>
        <description>Im Format einer lockeren Abendshow werden wir die Highlights des Jahres pr&#228;sentieren, die Meldungen zwischen den Meldungen, die subtilen Sensationen hinter den Schlagzeilen. Kommen Sie, h&#246;ren Sie, sehen Sie! Lassen Sie sich mitrei&#223;en!</description>
        <persons>
          <person id="1046">Felix von Leitner</person>
          <person id="9">Frank Rieger</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
    <room name="Saal 2">
      <event id="4767">
        <start>13:15</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>security_log_visualization_with_a_correlation_engine</slug>
        <title>Security Log Visualization with a Correlation Engine</title>
        <subtitle>What's inside your network?</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>This brief session focuses on the visualization of actual security incidents, network forensics and counter surveillance of covert criminal communications utilizing large data sets from various security logs and a very brief introduction to correlation engine logic. Visually displaying security or network issues can express the risk or urgency in a way a set of dry logs or other methods might not be able to. Additionally, many organizations rely on a more singular approach and react to security events, many times from a high false positive rate source such as isolated intrusion prevention or firewall alerts, or relying only on anti-virus alerts. Utilizing a correlation engine (especially open source) or similar applications could offer a method of discovering or in some cases proactively detecting issues.  The research discussed involves analysis and interrogation of firewall, intrusion detection and prevention systems, web proxy logs and available security research. What does a compromised server infected with spam malware look like or cyber warfare?  </abstract>
        <description>A 20 minute presentation of data visualization and investigation scenarios of five actual issues discovered using various security logs and a correlation engine.  The lecturer will take you on a visual journey from seemingly mundane entries in firewall logs through to detecting covert communications between a corporate web server and a cyber-criminal drop zone. Additional visualizations presented: a United Kingdom based portion of the South Korean DNS Distributed Denial of Service attacks of July/August 2008, what bypassing deep packet inspection using HTTPS/SSL/TLS looks like, detecting a rouge corporate email server, malicious DNS usage and more.  Although the presenter used a commercial correlation engine, the presentation will conclude with the discussion of an open source correlation engine.</description>
        <persons>
          <person id="3524">Chris Kubecka</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4740">
        <start>14:00</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>frag_den_staat</slug>
        <title>Frag den Staat</title>
        <subtitle>Praktische Informationsfreiheit</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>FragDenStaat.de startete am 1. August 2011 als Plattform zum Stellen von Anfragen nach dem Informationsfreiheitsgesetz und ver&#246;ffentlicht dort die Korrespondenz mit den Beh&#246;rden nach dem Vorbild von whatdotheyknow.com and befreite-dokumente.de. Der Vortrag wird die Plattform vorstellen, zeigen wie die Seite Antragssteller bei ihrem Recht auf Akteneinsicht unterst&#252;tzt und die interessantesten Vorf&#228;lle genauer beleuchten.</abstract>
        <description>FragDenStaat.de ging als Projekt der Open Knowledge Foundation Deutschland mit Unterst&#252;tzung von u.a. Transparency International, Mehr Demokratie und der Access Info am 1. August 2011 online. Ein halbes Jahr sp&#228;ter gibt es viel ver&#246;ffentlichte Korrespondenz mit Beh&#246;rden zu begutachten, die einige spannende Geschichten enthalten und interessante Fragen aufwerfen. Hat man Recht auf Akteneinsicht in die Gutachten des Wissenschaftlichen Dienstes des Bundestags? Sind Datenshops mit dem IFG vereinbar? Und wie muss man das Informationsfreiheitsgesetz verbessern, damit es auch in Zeiten von Open Data funktioniert? Im Vortrag m&#246;chte ich unter anderem auf diese Fragen eingehen, Statistiken der Plattform pr&#228;sentieren (welche Beh&#246;rde antwortet am schnellsten etc.), erkl&#228;ren welche Mittel und Wege es gibt, um Informationen von staatlicher Stelle zu erlangen und dazu aufrufen, diese Mittel auch aktiv zu nutzen.</description>
        <persons>
          <person id="2618">Stefan Wehrmeyer</person>
        </persons>
        <links>
          <link href="https://fragdenstaat.de">FragDenStaat.de</link>
        </links>
      </event>
      <event id="4869">
        <start>14:30</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>tresor</slug>
        <title>TRESOR: Festplatten sicher verschl&#252;sseln</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Herk&#246;mmliche Festplattenverschl&#252;sselungen legen notwendige Schl&#252;ssel im RAM ab. Dadurch sind sie schutzlos Angriffen wie Cold-Boot Attacken ausgeliefert, die auf den Arbeitsspeicher abzielen. TRESOR bietet Schutz gegen solche Angriffe.</abstract>
        <description>Herk&#246;mmliche Festplattenverschl&#252;sselungen legen notwendige Schl&#252;ssel im RAM ab. Dadurch sind sie schutzlos Angriffen wie Cold-Boot Attacken ausgeliefert, die auf den Arbeitsspeicher abzielen. TRESOR bietet Schutz gegen solche Angriffe, indem es den Verschl&#252;sselungsalgorithmus AES ausschlie&#223;lich auf dem Prozessor ausf&#252;hrt. Die Sicherheit wird also dadurch erh&#246;ht, dass TRESOR den Schl&#252;ssel (sowie alle Rundenschl&#252;ssel und Zwischenzust&#228;nde von AES) niemals im RAM hinterlegt, sondern nur in Registern der CPU. W&#228;hrend der gesamten Betriebszeit gelangen somit keine kritischen Daten der Verschl&#252;sselung in den Arbeitsspeicher.

TRESOR ist als Patch f&#252;r den Linux Kernel umgesetzt und nutzt Intel's AES-NI Instruktionen um die AES-Verschl&#252;sselung zu beschleunigen. Zur Speicherung des Schl&#252;ssels werden die Debugging-Register der x86-64 Architektur "zweckentfremdet". TRESOR ist kompatibel mit allen Linux-Distributionen und etwaige Performance-Einbu&#223;en sind vernachl&#228;ssigbar.</description>
        <persons>
          <person id="3607">tilo</person>
        </persons>
        <links>
          <link href="http://www1.informatik.uni-erlangen.de/tresor">TRESOR Runs Encryption Securely Outside RAM</link>
        </links>
      </event>
      <event id="4759">
        <start>16:30</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>open_source_music_tracking_2_0</slug>
        <title>Open source music: Tracking 2.0</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Tracking is so 1990s.  Nowadays MP3 and other similar formats are
overwhelmingly more popular.  But is this really a step forward?  A
(very) brief history of computer music, where we are at now, and why I
think people are headed in the wrong direction.  And what we can do
about it. </abstract>
        <description>Distributing music as recordings is terribly limiting to hackers and
tinkerers.  Music as *source code* makes dissection, modification and
reuse easier.  I will introduce a prototype next-generation tracker
for the web, with the ultimate aim of being a way to not just create
but also distribute music, and to collaborate on music creation:
Github for music, if you will.

As a music creation tool, trackers have been displaced in popularity because they are:
  * Balky (arcane command+parameter syntax, steep learning curve, have
    slowly grown by accretion without regard to comprehensibility)
  * Underpowered (many useful DSP effects are unavailable)

As a music distribution tool, tracked formats have been displaced in popularity because they are:
  * Not ubiquitous (people may not have playback software)
  * Underspecified (hence behaviour differs across implementations)

I believe all of these problems are soluble, and I'm going to talk
about how.  "modplayjs" (a working title which may well change by
December) is a tracker written in javascript.  While capable of
playing existing module formats, it is primarily a playground for
experimenting with shedding two decades of accumulated baggage, and is
currently under heavy development.</description>
        <persons>
          <person id="3383">Tom Hargreaves</person>
        </persons>
        <links>
          <link href="http://sphere.chronosempire.org.uk/~HEx/modplayjs/">current bleeding-edge demo</link>
          <link href="https://gitorious.org/html5toys/modplayjs">source repository</link>
        </links>
      </event>
      <event id="4748">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>the_best_of_the_oxcars</slug>
        <title>The best of The oXcars</title>
        <subtitle>the greatest free/Libre culture show of all times</subtitle>
        <track>Culture</track>
        <type>movie</type>
        <language></language>
        <abstract>The Best of the oXcars!

OXcars is fun. oXcars is empowering the people.

Presentation and screening of the best of the oXcars 2011, 2010, 2009, 2008.

Because their business is not our business.
Every year, in Barcelona 1500 people gather for the biggest free/libre culture Show of all times ;-).
Artists and performers from all areas of Spanish and international culture take part in a "Gala";-) in which artists say "Not in my name" to the commercialisation of culture, "Not in my name" to limiting the potential of digital media and to criminalization of the Internet. Civil society demands the 'lost profits' of all the knowledge that is being withheld and stolen from public use in the name of private profits.

http://oxcars11.whois--x.net/en/
http://oxcars10.whois--x.net/en/
http://oxcars09.whois--x.net/en/
http://whois--x.net/proyectos/oxcars-08
</abstract>
        <description> X.net (since 2008) - http://whois--x.net/ 
X.net (previously Exgae) aims to provide citizens with creative and legal skills that they can use to put an end to the monopoly and activities of the cultural industries groups and their private goals.
X.net fights alongside the great majority of society for the growth of new forms of circulation of culture. It's the first Spanish legal advisory service specialised in protecting citizens from the abuses of cultural industries lobbies and royalty management and collecting societies.
X.net developments and drafts proposals for intervention on legislation, organises cultural events that aim to &#8220;normalise&#8221; free culture production and diffusion practices and make them known to the general public; creates viral campaigns and lobby groups  from the civil society like the FCForum (http://fcforum.net).

One of X.net&#8217;s public activities is the annual oXcars event, the world&#8217;s biggest free culture show ;-). The oXcars is a showcase for artists and creators who have pioneered the changes in knowledge and cultural production thanks to the potential of new technologies, and seeks to defend society&#8217;s right to use them. The oXcars are also a way to make the free culture movement mainstream, a bridge between free culture works and artists and the general public. 
The oXcars inform, make free culture visible and magnify it, and thus empower citizens.

Each number that is presented in the show it is an excuse to explain a topic: the right to quote, the right to share, net neutrality, P2P networks, online free art, free beer :-) etc etc.
We have prepared a screening session to show you this amusing Show.

http://oxcars11.whois--x.net/en/
http://oxcars10.whois--x.net/en/
http://oxcars09.whois--x.net/en/
http://whois--x.net/proyectos/oxcars-08
http://whois--x.net/english/the-oxcars/oxcars08 
</description>
        <persons>
          <person id="3532">Simona Xnet</person>
        </persons>
        <links>
          <link href="http://whois--x.net/">http://whois--x.net/</link>
          <link href="http://oxcars11.whois--x.net/en/">http://oxcars11.whois--x.net/en/</link>
          <link href="http://oxcars10.whois--x.net/en/">http://oxcars10.whois--x.net/en/</link>
          <link href="http://oxcars09.whois--x.net/en/">http://oxcars09.whois--x.net/en/</link>
          <link href="http://whois--x.net/proyectos/oxcars-08">http://whois--x.net/proyectos/oxcars-08</link>
          <link href="http://fcforum.net">http://fcforum.net</link>
          <link href="http://2011.fcforum.net">http://2011.fcforum.net</link>
        </links>
      </event>
      <event id="4780">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>print_me_if_you_dare</slug>
        <title>Print Me If You Dare</title>
        <subtitle>Firmware Modification Attacks and the Rise of Printer Malware</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Network printers are ubiquitous fixtures within the modern IT infrastructure. Residing within sensitive networks and lacking in security, these devices represent high-value targets that can theoretically be used not only to manipulate and exfiltrate the sensitive information such as network credentials and sensitive documents, but also as fully functional general-purpose bot-nodes which give attackers a stealthy, persistent foothold inside the victim network for further recognizance, exploitation and exfiltration. </abstract>
        <description>We first present several generic firmware modification attacks against HP printers. Weaknesses within the firmware update process allows the attacker to make arbitrary modifications to the NVRAM contents of the device. The attacks we present exploit a functional vulnerability common to all HP printers, and do not depend on any specific code vulnerability. These attacks cannot be prevented by any authentication mechanism on the printer, and can be delivered over the network, either directly or through a print server (active attack) and as hidden payloads within documents (reflexive attack). 

In order to demonstrate these firmware modification attacks, we present a detailed description of several common HP firmware RFU (remote firmware update) formats, including the general file format, along with the compression and checksum algorithms used. Furthermore, we will release a tool (HPacker), which can unpack existing RFUs and create/pack arbitrary RFUs. This information was obtained by analysis of publicly available RFUs as well as reverse engineering the SPI BootRom contents of several printers.

Next, we describe the design and operation a sophisticated piece of malware for HP (P2050) printers. Essentially a VxWorks rootkit, this malware is equipped with: port scanner, covert reverse-IP proxy, print-job snooper that can monitor, intercept, manipulate and exfiltrate incoming print-jobs, a live code update mechanism, and more (see presentation outline below). Lastly, we will demonstrate a self-propagation mechanism, turning this malware into a full-blown printer worm.

Using HPacker, we demonstrate the injection of our malware into arbitrary P2050 RFUs, and show how similar malware can be created for other popular HP printer types. Next, we demonstrate the delivery of this modified firmware update over the network to a fully locked-down printer.

Lastly, we present an accurate distribution of all HP printers vulnerable to our attack, as determined by our global embedded device vulnerability scanner (see [1]). Our scan is still incomplete, but extrapolating from available data, we estimate that there exist at least 100,000 HP printers that can be compromised through an active attack, and several million devices that can be compromised through reflexive attacks. We will present a detailed breakdown of the geographical and organizational distribution of observable vulnerable printers in the world.

*We have also unpacked several engine-control processor firmwares (different from the main SoC) and are currently attempting to locate code related to tracking dots. Perhaps we will have some results by December. In any case, HPacker will help the community to do further research in this direction, possibly allowing us to spoof / disable these yellow dots of burden.
</description>
        <persons>
          <person id="3454">Ang Cui</person>
          <person id="3641">Jonathan Voris</person>
        </persons>
        <links>
          <link href="http://ids.cs.columbia.edu/users/ang.html">Past publications</link>
          <link href="http://ids.cs.columbia.edu/sites/default/files/paper-acsac.pdf">"A Quantitative Analysis of the Insecurity of Embedded Network Devices: Results of a Wide-Area Scan" Paper</link>
        </links>
      </event>
      <event id="4710">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>the_future_of_cryptology</slug>
        <title>The future of cryptology: which 3 letters algorithm(s) could be our Titanic?</title>
        <subtitle>RMS Olympic, RMS Titanic, HMHS Britannic  vs Discrete Logarithm, Integer factorization, Conjectured hard problems</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The lessons and best practices of the titanic will be extracted. Are we ready?

This will be a co-presentation (Jean-Jacques Quisquater / David Samyde) and occasional friendly exchange, with point and counter-point of different contrasting views on the impact of solving integer factorization and some other difficult problem in cryptography.

The idea is to perform a provocative comparison between the 'unbreakable' RSA algorithm and the unsinkable Titanic.

Receiving his RSA Conference Lifetime Achievement Award, Rivest said that it has not been demonstrated mathematically that factorization into primes is difficult. So &#8220;Factoring could turn out to be easy,&#8221; and according to him &#8220;maybe someone here will find the method&#8221;.

Since 1994 and Shor's algorithm, the danger of quantum computer is known: breaking RSA in polynomial time. Factoring large numbers is conjectured to be computationally infeasible on classic non quantum computers. No efficient algorithm is known and the research in the last 30 years did not show enormous progress.

Iceberg existence is predicted but not shown yet.

According to Rivest a variety of alternative schemes have been developed in the decades since RSA was published, and a new system could probably be adopted quickly.

This relies on solving factorization only, but several other cases can be considered, in some of them the action to replace RSA with a new algorithm could require more work than initially planned (solution to discrete logarithm).

Managing the risk and the threat of the resolution of any major problem used in cryptography is crucial. This presentation challenges the conventional thinking using lessons learned from history.

RSA users are everywhere so what could be the consequences of a break in the real world? What were the errors made on the Titanic? Can the best practices used be improved or just translated into a new scheme? What would be the impact of solving the RSA assumption on cryptography?

The outline is:
History of factorization
Titanic primes and RSA keys
Complexity, classes of algorithms and practical costs
Risk analysis and Threat management
Probability estimation and proactive monitoring
From best to worst case
Best methods and lessons learned
Multiple scenari
(Im)possibility of accurate prediction
What to expect and how to be ready
Conclusion

Andrew Grove, former CEO of Intel said "Only the paranoid survive". Forecasting the presence of a strategic inflection point is hard. What to expect at the time of the next major cryptanalysis breakthrough? What history teaches? What remains to be done? Are we ready?</abstract>
        <description>The format will be a co-presentation (Jean-Jacques Quisquater/David Samyde) and occasional friendly debate or exchange, with point and counter-point of different contrasting views on the
impact of solving integer factorization in Information Security.

At the last RSA conference, Ronald Rivest, Adi Shamir and Leonard Adleman received the RSA Conference Lifetime Achievement Award. They were rewarded for the creation of the RSA cryptosystem and their magnificient contribution to the field of cryptography. Rivest during his speech said that
it has not been demonstrated mathematically that factorization into primes is difficult. So "Factoring could turn out to be easy," and according to him "maybe someone here will find the method".

Since 1994 and Shor's algorithm, the cryptographic community is aware of the danger of quantum computer for the the integer factorization problem. With a sufficient number of qubits, Shor's algorithm can be used to break RSA in polynomial time. Since last year RSA conference the first commercially available quantum computer with 128-qubit chip has been sold to an american company. But some criticism and a controversy are present around the real potential of this solution.

A well accepted assumption is that factoring large numbers is computationally infeasible on classic non quantum computers. No classical algorithm is known and the research in the last 30 years did not show enormous progress even if the improvements to the field of integer factorization are important since the existence of RSA.

The consequences of solving integer factorization in polynomial time would be to render the RSA scheme vulnerable. According to Ron Rivest a variety of alternative schemes have been developed in the decades since RSA was published, and a new system could probably be adopted quickly.

Some new encryption/signature schemes are available but they do not all rely on some problems that can be proven to be very hard in all cases and instances. The difference between a solid proof and a conjecture is important but it is not because a problem is proven hard that it is enough and
 sufficient to use it to build a secure cryptosystem. The knapsack problem is NP-complete to solve exactly but it can be difficult to create a secure cryptosystem from it. Leonard Adleman broke the Ron Graham and Adi Shamir enhancement of the Merkle-Hellman scheme and so did Serge Vaudenay who broke the Chor-Rivest knapsack cryptosystem.

Discrete logarithm, graph isomorphism and integer factorization are NP-intermediate problems and they are not known to be to be P or NP-complete. Solving the discrete logarithm problem brings a solution to the integer factorization problem in a trivial manner. The lack of recent progress on the resolution of the discrete logarithm helps and supports integer factorization. But in general an advance in one of them can be translated into the other one. This is not automatic, however it can be expected.

Cryptographic problems rely massively on the integer factorization and discrete logarithm problems. Few other systems exist and amongst this group some algorithms suffer from cryptanalysis methods, reducing their usage to specific cases. The worldwide presence, acceptance and usage, of RSA
are huge therefore if the algorithm would be compromised then a lot of companies would have no choice and would be forced to switch to another encryption system.

The quick and rapid adoption of a new system would play an important part in maintaining a high level of trust in security. Because public key cryptography secures Internet and ecommerce, banking and financial transactions, governments communications and much more, the new system(s) should be
proven to be secure and quickly deployed.

The assumption of Ron Rivest about the difficulty of integer factorization relies on the fact that the solution to factorization would not create more perturbations in the field of encryption algorithms and would not enable new cryptanalytic methods on potential replacement solutions. In such a case his statement about replacing RSA with a new method is correct. However several
other cases can be considered, and in some of them the action to replace RSA with a new algorithm could require more work than initially planned. In the same manner big companies can not really afford (and not only on the financial side) to replace one encryption algorithm by another one and to experience a failure of the new system just after its deployment.

This presentation challenges the conventional thinking, indeed factorization is at the core of number theory and a limited number of top researchers do really work and understand it. But a tremendous amount of money and business is secured relying on the resistance of this problem to years of attack by talented minds. The entire world use the RSA algorithm and trusts its security. This is so true that some scheme do not even plan a replacement plan and some certificates never expire.

In the greek mythology Cassandra received from Apollo the ability to predict the future, but she could not provide any evidence data of her predictions. She foresaw the destruction of Troy using the Trojan Horse, the death of Agamemnon, and her own troubles but she could not forestall these
tragedies. Ron Rivest did not provide any new method to solve factorization but he clarified the possible existence of a solution. When the inventor of the system starts to consider that a solution can exits it seems to be time to be open minded. If a solution can be reached, so what?

Andrew Grove, former CEO of a silicon manufacturer highlighted in his book "Only the paranoid survive." the importance of Cassandras in an organization. According to Grove, they can help to predict a strategic inflection point.

Factorization in a practical manner would be a strategic inflection point but could also not be limited to integer factorization only and extend to other fields. A much more elegant method to the problem of the decomposition of a composite in primes even inspired movie makers and Hollywood (Sneakers by Phil Alden Robinson) or book writers (Tetraktys by Ari Juels). What is the reality of such an assumption, is this pure science or pure fiction. Are these people Cassandras or is it simply impossible ? Through the usage of comparisons and metaphors the authors deal with what would be the lessons to learn from the resolution of factorization in different cases.

It is difficult to make accurate predictions and cryptographers learned with time that even the most brilliant of them and/or the giants amongst the community can make bad predictions. The inventors of RSA stated in Martin Gardner's column (August 1977) of Scientific American that it
would require 40 quadrillion years to factorize RSA-129 (426 bits). Derek Atkins lead the work that proved them wrong few years later.

The recent history of cryptanalysis teaches us that some schemes are weaker than expected and the general perception of the cryptologic community can be modified very quickly. A good example is the lack of collision resistance of the MD5 hash function designed by Ron Rivest.

The co authors believe that any prediction about the time separating us from the existence of an elegant solution to the integer factorization problems makes no sense. The art of prediction is much more difficult than doing simple comparisons.

The existence of a practical solution to factorize would have the effect of an earthquake to the world of cryptography and computer security. Predicting earthquake is not really possible and the recent past brings to our mind all the colateral effects that can be related to an earthquake. In real life seismologists monitor many phenomena that are considered to be possible precursors of earthquakes. This presentation will develop a simple model based on common sense to explain what could be the consequences of an improvement of integer factorization according to the probability of its apparition.

If the perception of the cryptologic community would be drastically modified about factorization, what could be the consequences on cryptography and security in the real world?  Can the best practises used with RSA be improved or even translated into a new scheme? What would be the impact of solving the RSA assumption on numerous other algorithm ?

In the case of a resolution of the integer factorization problem, several scenari are possible. They all have different implications and conclusions. This presentation consider each main scenario according to a level of relevance and details the impact and the consequences of the new discovery
on different fields including computer security, governance, cloud security, cyberwar and cyber weapons and other fields.

Managing the risk of the creation of a solution to any major problem used in cryptography is important for the whole industry. In general cryptographers consider that non linear improvements in their field take time and that all algorithm are deprecated before to be absolutely broken. This presentation will challenge some of these statements.</description>
        <persons>
          <person id="3507">David Samyde</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4802">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>towards_a_single_secure_european_cyberspace</slug>
        <title>Towards a Single Secure European Cyberspace?</title>
        <subtitle>What the European Union wants. What the hackerdom can do..</subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language></language>
        <abstract>The "European Great Firewall" was the way that European civil rights organizations has addressed the proposal to create a "single European cyberspace". Surely other lectures will describe the technicalities of the proposal. This lecture will go beyond that, describing a vulnerability that the proposal reveals in the power structures of the European and world governance, that could be exploited by the hackerdom if the war is understood as a value to be avoided.</abstract>
        <description>The proposal registered by the body of the Council of the European Union to create &#171;a single secure European cyberspace&#187; marks a pivotal moment in the development of the Union. Three reasons grounds that statement. First, because after decades omitting the use of the term, the semantics of &#171;cyberspace&#187; is officially adopted by the Union's policy. Second, because that adoption enacts a new field of community policy making. Third, because the new field is formulated by binding, under a &#171;single European&#187; frame, the home affairs with the security and defense areas &#8211; the building blocks of sovereignty since the Peace of Westphalia.

The notion of cyberspace as a global wide computer mediated domain of human agency is not new. Furthermore, the saliency of that domain in the contemporary society can hardly be refuted: Beyond the contributions from the Literature and the Academia, the most reliable source of empirical evidence can be found in the production of the concerned polities to address the deployment and the effects of informatics and telecommunications &#8211; the constituent technologies of cyberspace.

The legal developments on the protection of personal data and on the enforcement of intellectual property rights, or the budgetary assignments to the field of information society are meaningful proofs of that saliency. However, the idea of an &#171;European cyberspace&#187; (a) impugns the aforementioned &#171;global wide&#187; range by assuming the possibility to constrain the agency to the boundaries of a political body &#8211; the EU &#8211; which then becomes the holder of the sovereignty in that domain, what (b) defies the traditional monopoly of the State regarding the exercise of power over their own territory.

As Kymlicka has pointed out, the existence of a common identity is a requirement of statality, at leas in the political configuration designed under the liberal democracy paradigm. Provided that cyberspace favours the establishment of social interactions not limited by the constrains that provides statality, it is possible to conform alternative identities that can enact a conflict with the identitary demarcations of the State and, therefore, following Foucault, to challenge the discoursive hegemony of the State. </description>
        <persons>
          <person id="3446">Suso Baleato</person>
        </persons>
        <links>
          <link href="http://www.edri.org/files/virtual_schengen.pdf">the virtual schengen leaked document</link>
          <link href="http://www.telegraph.co.uk/technology/news/8481330/Alarm-over-EU-Great-Firewall-proposal.html">Telegraph article</link>
        </links>
      </event>
    </room>
    <room name="Saal 3">
      <event id="4581">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>taking_control_over_the_tor_network</slug>
        <title>Taking control over the Tor network</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>This talk deals with weaknesses identified in the TOR network protocol and cryptography implementation. We manage to take control over users using this network and to access all your information and data exchanged despite cryptography.</abstract>
        <description>The TOR network is one of the most famous way to use Internet in a anonymous and secure way at least supposedly. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from someone conducting network surveillance or traffic analysis. Aside protocol-oriented aspects, TOR security relies heavily on cryptography. 
The aim of this talk is to explain how it is possible to take over a significant part of the TOR network not to say over the whole network. We have identified two classes of weaknesses in the way Onion routers (Ors) are managed:
a first class of weaknesses relates to the way the routes among Ors. It is possible to influence and to force users to use arbitrary Ors and hence control which route they take.
A second class of weaknesses relates to the way cryptography is implemented. Bu using malware-based attacks and the concept of dynamic cryptographic backdoors we have succeeded to circumvent the cryptography in place without removing it.
We present different possible attack scenarii which are malware-based or not (depending on the scenario considered) that have been experimented and validated on a TOR simulation network of 50 nodes and partially on the real TOR network (as far as it was possible regarding existing laws). 
We show that it is indeed possible to gain a lot of sensitive information thus bypassing and managing existing cryptographic mechanisms in a very efficient way and to take the effective control over a significant part of the TOR network. The attack is fully dynamic and can be replayed on request. We present an open source library that enable to automate the identification of hidden relay bridges.

We propose some modification in the TOR source and protocol in order to prevent those attacks.
Demos will be presented to expose the two class of vulnerabilities we exploit. An Internet access is required to make part of the demos on the real TOR network.</description>
        <persons>
          <person id="3366">Eric Filiol</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4906">
        <start>12:45</start>
        <duration>02:15</duration>
        <room>Saal 3</room>
        <slug>lightning_talks_day_3_pecha_kucha</slug>
        <title>Lightning Talks Day 3</title>
        <subtitle>Pecha Kucha Round!</subtitle>
        <track>Community</track>
        <type>other</type>
        <language></language>
        <abstract></abstract>
        <description></description>
        <persons>
          <person id="1476">Nick Farr</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4781">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>deceiving_authorship_detection</slug>
        <title>Deceiving Authorship Detection</title>
        <subtitle>Tools to Maintain Anonymity Through Writing Style &amp; Current Trends in Adversarial Stylometry</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Stylometry is the art of detecting authorship of a document based on the linguistic style present in the text. As authorship recognition methods based on machine learning have improved, they have also presented a threat to privacy and anonymity. We have developed two open-source tools, Stylo and Anonymouth, which we will release at 28C3 and introduce in this talk. Anonymouth aids individuals in obfuscating documents to protect identity from authorship analysis. Stylo is a machine-learning based authorship detection research tool that provides the basis for Anonymouth's decision making. We will also review the problem of stylometry and the privacy implications and present new research related to detecting writing style deception, threats to anonymity in short message services like Twitter, examine the implications for languages other than English, and release a large adversarial stylometry corpus for linguistic and privacy research purposes.</abstract>
        <description>Stylometry is the study of authorship recognition based on linguistic style (word choice, punctuation, syntax, etc). Adversarial stylometry examines authorship recognition in the context of privacy and anonymity though attempts to circumvent stylometry with passages intended to obfuscate or imitate identity.

This talk will introduce the open source authorship recognition and obfuscation projects Anonymouth and Stylo. Anonymouth aids individuals in obfuscating their writing style in order to maintain anonymity against multiple forms of machine learning based authorship recognition techniques. The basis for this tool is Stylo, an authorship recognition research tool that implements multiple forms of state-of-the-art stylometry methods. Anonymouth uses Stylo to attempt authorship recognition and suggest changes to a document that will obfuscate the identity of the author to the known set of authorship recognition techniques.

We will also cover our recent work in the field of adversarial authorship recognition in the two years since our 26C3 talk, "Privacy &amp; Stylometry: Practical Attacks Against Authorship Recognition Techniques." Our lab has new research on detecting deception in writing style that may indicate a modified document, demonstrating up to 86% accuracy in detecting the presence of deceptive writing styles. Short messages have been difficult to assign authorship to but recent work from our lab demonstrates the threat to anonymity present in short message services like Twitter. We have found that while difficult, it is possible to identify authors of tweets with success rates significantly higher than random chance. We also have new results that examine the ability of authorship recognition to succeed across languages and the use of translation to thwart detection.

This talk will also mark the release of an adversarial stylometry data set that is many times larger than our previous release. This data set, provided by volunteers, includes at least 6500 words per author of unmodified writing as well as sample adversarial passages intended to preserve the anonymity of the author and demographic information for each author.

The content of this talk will be relevant to those with interest in novel issues in privacy and anonymity, forensics and anti-forensics, and machine learning. All of the work presented here is from the Privacy, Security and Automation Lab at Drexel University. Founded in 2008, our lab focuses on the use of machine learning to augment privacy and security decision making.</description>
        <persons>
          <person id="2588">Michael Brennan</person>
          <person id="2019">Rachel Greenstadt</person>
        </persons>
        <links>
          <link href="https://psal.cs.drexel.edu">Privacy, Security and Automation Lab at Drexel</link>
          <link href="http://mbrennan.net">Michael Brennan</link>
          <link href="https://www.cs.drexel.edu/~greenie">Rachel Greenstadt</link>
        </links>
      </event>
      <event id="4668">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>electronic_money</slug>
        <title>Electronic money: The road to Bitcoin and a glimpse forward</title>
        <subtitle>How the e-money systems can be made better</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The proposed talk provides a definition of the problem of creating e-money and after a review of the state of the art points out possible solutions and proposes questions for discussion for the properties of electronic money system.</abstract>
        <description>Electronic money: The road to Bitcoin and a glimpse ahead
---------------------------------------------------------

**Abstract**: *The proposed talk provides a definition of the problem of creating e-money and after a review of the state of the art points out possible solutions and proposes questions for discussion for the properties of electronic money system.*

## 1. What is electronic money and different means of currency
Definition of electronic money and distinction from similar means of exchange.

Electronic money is defined as monetary value which is:  

- stored on an electronic device;
- issued on receipt of funds; and
- accepted as a means of payment by persons other than the issuer.

Working e-money examples: PayPal and MoneyBookers

Other means of exchange, similar to e-money: Alternative/Social/Timeshare/Community currencies; Loyalty and Voucher systems.  
Working examples: WIR and Ven currencies (Bitcoin)

What makes them different from e-money? (convertible only one-way, not a legal tender, mostly backed by trust only, etc) 

*Optional*: Pros and cons of the abovementioned means of exchange.

## 2. Defining the e-money problem: What electronic money should do? 
Risks and requirements to the solution for electronic money from technical, legal and business standpoint. The basic human problem of reaching a consensus and trust in a group.

###General system risks:
- Credit Liability
- Credit Abuse
- Counterfeiting
- Unauthorized Withdrawal
- Purchase Order Modification
- Double Spending
- Failure to Credit Payment
- Denial of Service
- Repudiation
- Failure to deliver
- Framing 
- Secrecy

###Legal and accounting:    	
- Dispute resolution
- Money laundering and finance of terrorism
- Tax evasion prevention
- Consumer protection requirements
- Ways to negotiate and conclude a contract	
- Auditability
- Reverse and chargeback transactions
- **How the burden of proof is distributed**

###Business:

Costs for:

- Registration 
- Operation
- Support	
- Marketing
- Customer and merchant negotiation

###Accent on the most important human problems:  
- Identification and authorization (which is the required minimum?)
- Achieving consensus and easy dispute resolution in a group.  
- Determine the state of the system at any given moment
- Trust (between the peer users or trust in the central authority)


##3. How the risks and requirements have been traditionally addressed?
Review of the cryptographic, legal and procedural methods from the existing e-money protocols. &#1045;mphasis on anonymity and privacy problems. 

The review of the existing systems will be a distinction between: 

- Online and offline systems  
    Example: PayPal and Blind signature/PayWord based systems
- Centralized and decentralized systems   
    Example: Liberty Reserve and Ripple/BitCoin
- Hard and Soft systems  
    Example: BitCoin and Credit card based money and payment protocols

How do they solve the problems of trust and consensus in a certain group?

How they provide anonymous transactions and keep user privacy? Are independent jurisdictions a (contribution to) the solution?

Calculated risk, insurance and responsibility/role delegation as patches to the existing problems. 

Which of the above systems may be deemed "legal"? (what do the central banks think)

*Optional*: Few words for Blind signature and PayWord techniques and the protocols around them 

##4. The great step forward. The contribution of Bitcoin 
Emphasis on decentralization and (relative) anonymity features of Bitcoin. How the combination of a way to create(mint) coins and to timestamp the state of their distribtion created the first working non-centralised currency. What, in my opinion, contributed for the Bitcoin popularity. 

##5. The problems of Bitcoin 
What Bitcoin doesn't provide or doesn't provide in an effective manner:

- Cost of creating money
- Method of reaching a consensus, based on computing power
- No "real value" to back it
- Settlement risk not covered
- Scalability issues
- All the lacking features of a "soft" currency

Is it decentralized or distributed system? (having in mind the introduction of "trust points")

##6. A Glimpse forward 
How can anonymous e-money be made better (more effective and accessible). Proposal (and discussion) of the possible enchancements.

###How to issue e-money in more effective manner?  
Possible solutions are to issue money based on: 

- Exchange for FIAT money or back by any other valuable stock (gold, land, silver); 
- IOU credit/debit principle from the community currencies;
- Some fair distribution as an alternative to:
- Solving a math problem (as Bitcoin does)

How do these solution relate to the speed the new money are accepted and used?

###How to reach a consensus in a group in a more effective manner? 
- Is practical byzantine tolerance more effective than distributed timestamping?
- Can and should we consider any centralized authority?
- Should we consider decentralized money impossible and settle for distributed money?
- Can a Webtrust (OpenPGP alike) scheme of trust be applied? What social identification (friend of a friend) can contribute?
- Can we use/rely on public/official timestamping services and how this can be used as a better proof?
- How triple accounting techniques may help?

###How to achieve anonimity and preserve privacy?
- Is complete anonymity possible? What are the achievable levels of anonymity?
- Can the user set a "mode" of a transaction, sacrificing some protection?
- To what extend the existing bank secrecy will suffice?
- Jurisdictional independence as a possible solution / significant contributor.
- What anonymizing technical methods are possible?

More general question: Should a good e-money currency be made according to the legal requirements of the EU directive and made legal tender?

If not are features like: consumer protection (reverse and refund transactions), auditability and settlement risk coverage need to be implemented and at what cost? 

</description>
        <persons>
          <person id="3472">peio</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4788">
        <start>18:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>datenvieh_oder_daten_fee</slug>
        <title>Datenvieh oder Daten-Fee</title>
        <subtitle>Welchen Wert haben Trackingdaten?</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Eine n&#252;chterne Untersuchung der Verfahren zum Nutzertracking und des wirtschaftlichen Wertes von Tracking- und Userdaten.</abstract>
        <description>Das Tracking von Nutzerinteraktionen ist heute das R&#252;ckrad eines gro&#223;en Teils der Online-Wirtschaft. F&#252;r Nutzer und Aussenstehende findet diese Wertsch&#246;pfung im Verborgenen statt. Aus quantitativen Daten werden mittels Datamining qualitative Daten aggregiert. Und die Wirtschaft erdenkt st&#228;ndig neue Methoden, die Erhebung zu verbessern und Methoden, die Erhebung zu verschleiern. 

Der Vortrag fasst kurz die verschiedenen M&#246;glichkeiten der Erhebung zusammen und widmet sich dann ausf&#252;hrlich der Frage, welchen Wert die einzelnen Interaktionen tats&#228;chlich haben. Die beteiligten Branchen werden dargestellt und es wird beschrieben, welchen Weg die Daten von ihrem Ursprung zu welchen Abnehmern nehmen. </description>
        <persons>
          <person id="3528">Rene Meissner</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4688">
        <start>20:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>introducing_osmo_gmr</slug>
        <title>Introducing Osmo-GMR</title>
        <subtitle>Building a sniffer for the GMR satphones</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>The latest member of the Osmocom-family projects, osmo-gmr focuses on the GMR-1 (GEO Mobile Radio) air interface used in some satellite Phones. This talk will shortly present the GMR protocol, the Thuraya network that uses this protocol in the Eurasian/African and Australian continents and finally details how you can capture samples and process them for analysis using osmo-gmr.
</abstract>
        <description></description>
        <persons>
          <person id="3401">Sylvain Munaut</person>
        </persons>
        <links>
          <link href="http://gmr.osmocom.org">Project home-page</link>
        </links>
      </event>
      <event id="4814">
        <start>21:45</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>behind_the_scenes_of_a_c64_demo</slug>
        <title>Behind the scenes of a C64 demo</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>C64 "demos" were the root of the whole demo-scene-thing and they are still the main force keeping the C64 alive today. Audiovisual pleasure, still pushing hardware limits, still exploring different ways of expression. But what is typically happening inside the machine when you watch a demo? What effort is needed to entertain the audience? This talk will give you an inside look at the steps taken for the award winning demo "Error 23" given first hand by one of its main programmers.</abstract>
        <description>This talk extends previous talks and documentation about the Commodore 64 and its demo effects by adding real-life challenges and experiences to it. What were the basic ideas? What obstacles were on the way? How did they get solved? 6502 assembly knowledge is really not required, some general understanding about assembly and low-level computing will be useful, though (think of stack, timer, cycles...). This isn't about theory, this is for real ;)

Topics include (but not limited to):

- Explaining design choices
- Basic ideas behind the effects
- Data compression techniques
- Load stuff while displaying effects
- Dirty tricks which make your computer science professor run away
- Synchronization and linking
- how to keep it all in 64KB RAM</description>
        <persons>
          <person id="3548">Ninja / The Dreams</person>
        </persons>
        <links>
          <link href="http://pouet.net/prod.php?which=24466&amp;howmanycomments=25&amp;page=0">Error23 at pouet.net</link>
          <link href="http://www.youtube.com/watch?v=LH6_1dEVWds">Error23 on youtube</link>
        </links>
      </event>
      <event id="4798">
        <start>23:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>sovereign_keys</slug>
        <title>Sovereign Keys</title>
        <subtitle>A proposal for fixing attacks on CAs and DNSSEC</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>This talk will describe the Sovereign Key system, an EFF proposal for improving the security of SSL/TLS connections against attacks that involve Certificate Authorities (CAs) or portions of the DNSSEC hierarchy.</abstract>
        <description>The design stores persistent name-to-key mappings in a semi-centralised, append-only data structure.  It allows domain owners to deploy operational TLS keys without trusting any third parties whatsoever, and gives clients a reliable way to verify those keys. The design can also be used to automatically circumvent a large portion of server impersonation and man-in-the-middle attacks, avoiding the need for confusing certificate warnings, which users will often click through even when they are under attack.

The Sovereign Key design bootstraps from and reinforces either CA-signed certificates or DANE/DNSSEC as a method of publishing and verifying TLS servers' public keys.  Conceptually, it provides functionality similar to what could be obtained if HTTPS servers could publish special headers saying "in the future, all new public keys for this domain will be cross-signed by this key: XXX", but the design includes a number of necessary additional features, including a secure revocation mechanism, protection against false headers that an attacker could publish after compromising an HTTPS server, and support for protocols other than HTTPS (SMTPS, POP3S, IMAPS, XMPPS, etc).

Sovereign Keys allow clients to detect server impersonation and man-in-the-middle attacks even if the attack involves compromise or malice by a CA or DNSSEC registry.  But Sovereign Keys also allow for automatic circumvention of these attacks via proxies, VPNs, or Tor hidden services.</description>
        <persons>
          <person id="1701">Peter Eckersley</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
  </day>
  <day date="2011-12-30" index="4">
    <room name="Saal 1">
      <event id="4751">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>the_hack_will_not_be_televised</slug>
        <title>The Hack will not be televised?</title>
        <subtitle>Hacker in Movies</subtitle>
        <track>Culture</track>
        <type>movie</type>
        <language></language>
        <abstract>Though hackers prefer being indivualists, a strong relationship towards Culture industry makes hacker culture a source and product at the same time. While you can laugh about most Hollywood movies presenting stereotypical hackers, you shouldn't ignore the influence they have. 'And with the 1983 release of the hacker-thriller movie *War Games,* the scene exploded. It seemed that every kid in America had demanded and gotten a modem for Christmas' Bruce Sterling wrote in "The Hacker Crackdown". 




</abstract>
        <description>Let's lean back for an hour, watching hackers in movies from the last four decades at work. Some movies you might know, others you don't. Promised. </description>
        <persons>
          <person id="2621">Caspar Clemens Mierau</person>
        </persons>
        <links>
          <link href="http://www.leitmedium.de/2007/11/03/hacker-filme/">List of Hacker Movies</link>
        </links>
      </event>
      <event id="4742">
        <start>12:45</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>from_press_freedom_to_the_freedom_of_information</slug>
        <title>From Press Freedom to the Freedom of information</title>
        <subtitle>Why every citizen should be concerned</subtitle>
        <track>Society and Politics</track>
        <type>meeting</type>
        <language></language>
        <abstract>This talk is about:
- Information freedom and the issues for the citizens
- RWB ressources: a &#8220;human network&#8221; 
- RWB needs: Get involved!</abstract>
        <description>** Freedom of information and citizen issues
  - Why defend media freedom, journalists and bloggers? Because without a free press, no cause can make its voice heard, no human rights violation can be reported. 
 
Specific examples of information vital to the public (links below): 
     - the tainted baby formula scandal in China exposed by the netizen Zhao Lianhai, who was arrested as a result
     - Organized crime denounced by netizens, some of whom have been killed. Rascatripas, the moderator of the Nuevo Laredo en Vivo website, murdered on 9 November 2011
     - RWB sees how the media and methods of spreading news and information are evolving, and is adapting to the changes
     - RWB helps all kinds of &#8220;information producers&#8221; including professional journalists and bloggers and takes positions on the problems specific to new media WikiLeaks hounded
     - Capacity building and e-advocacy: RWB provides bloggers, cyber-dissidents and journalists with the means to continue reporting and circulating information. Provision of censorship circumvention tools (including VPN) and online security training, circulation of viral campaigns, awareness campaigns, information about online risks.

** RWB&#8217;s resources: a &#8220;human network&#8221;
  - A human network: 150 correspondents worldwide + informal contacts
  - Strong lobbying capacity (European Parliament and Washington)
  - A legal committee
  - Handbook for Bloggers and Handbook for Journalists during Elections 
  - Training (in Thailand, in Paris in February, in China and elsewhere in the future)
  - Virtual Shelter project: Creation of electronic safe and website for hosting censored content

** RWB&#8217;s needs: Get involved!
  - Need for people whose technical skills can help us to evaluate a country&#8217;s Internet, by carrying out tests to determine the filters used, the presence of Deep Packet Inspection and so on.
  - Need for technicians who can tell us about the safety of the various communications methods used. Which governments monitor Skype, IRC, BBM, and Google Talk? Which email service or  VoIP to use?
  - Need for the help of experts in viral marketing, search engine marketing and information monitoring.
  - Need for contacts in companies that cooperate with Internet censorship (or former employees)
  - Need for the help of jurists in different countries to analyze the growing number of laws that regulate the Internet</description>
        <persons>
          <person id="3505">Reporters Without Borders</person>
        </persons>
        <links>
          <link href="http://en.rsf.org/china-authorities-refuse-to-register-26-10-2010,38663.html">Tainted baby formula scandal in China</link>
          <link href="http://en.rsf.org/mexique-fourth-netizen-murdered-in-two-14-11-2011,41385.html">Rascatripas, the moderator of the Nuevo Laredo en Vivo website, murdered on 9 November 2011</link>
          <link href="http://en.rsf.org/egypt-jailed-blogger-resumes-hunger-17-09-2011,41015.html">RWB helps bloggers in Egypt</link>
          <link href="http://en.rsf.org/wikileaks-hounded-04-12-2010,38958.html">Problems specific to new media WikiLeaks hounded</link>
        </links>
      </event>
      <event id="4856">
        <start>14:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug></slug>
        <title>The engineering part of social engineering</title>
        <subtitle>Why just lying your way in won't get you anywhere</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>All the talks i saw about SE so far just showed which good SE's the speakers are. I try to do another approach, what if i get in and don't know what to do then. The talk is about the reconn. before the assessment, the different approaches of SE. Which techniques can one use, how to do a proper intel. and what is useful. How things work and more important why. Which skill set should one have before entering a engagement. And last but not least how do one counter a SE attack.
</abstract>
        <description>Preface: 

Needed Skillset:

-physical (ie.NLP)

-logical Customer Preparation:

-theoretical models of attack

-check customer needs by his business

-Contract

Preparation &amp; Reconnaissance:

-threat modeling

-physical

-logical

Project Planing:

-Storyboard

-the target

-infiltration

-fetching data/reaching the target

-exfiltrate

-backup plans

Infiltration:

Find &amp; fetch the data:

Exfiltrate the data:

Writing report:

Business impact analyses:

customer meeting:</description>
        <persons>
          <person id="3576">Aluc</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4648">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>quantum_of_science</slug>
        <title>Quantum of Science</title>
        <subtitle>How quantum information differs from classical</subtitle>
        <track>Science</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Quantum systems can have very different properties from their classical analogues which allows them to have states that are not only correlated but entangled. This allows for quantum computers running algorithms more powerful than those on classical computers (represented by Turing machines) and for quantum cryptography whose safety is (in principle) guaranteed by the laws of nature. </abstract>
        <description>I will explain key facts of quantum information theory from a physics perspective. In particular, I will focus on the fundamental difference between the quantum world and the classical world of everyday experience that in particular makes it provable impossible to simulate a quantum world by a classical world. This will then be applied to information processing tasks like quantum computing, quantum cryptography and possibly the human brain.

No background in theoretical physics is necessary but some familiarity with basic complexity theory and linear algebra (what is a vector? what is a matrix?) could be helpful.</description>
        <persons>
          <person id="2451">Robert Helling</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4898">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 1</room>
        <slug>security_nightmares</slug>
        <title>Security Nightmares</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>de</language>
        <abstract></abstract>
        <description></description>
        <persons>
          <person id="9">Frank Rieger</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4899">
        <start>18:30</start>
        <duration>00:30</duration>
        <room>Saal 1</room>
        <slug>closing_event</slug>
        <title>Closing Event</title>
        <subtitle></subtitle>
        <track>Community</track>
        <type>other</type>
        <language>en</language>
        <abstract></abstract>
        <description></description>
        <persons>
        </persons>
        <links>
        </links>
      </event>
    </room>
    <room name="Saal 2">
      <event id="4741">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>neo_feudalism_or_why_julian_assange_might_be_wrong_after_all</slug>
        <title>Neo-Feudalism or Why Julian Assange Might Be Wrong After All</title>
        <subtitle></subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>"Intellectual property is the oil of the 21 century."
Mark Getty, "Blood and Oil," The Economist (March 4, 2000), p. 68

</abstract>
        <description>The rise of the neo-feudalistic economy is linked as closely to the paradigm of "intellectual property" as it is to the security-financial-political complex. The players have effectively created a closed network or a "conspiracy".

In his now (in)famous pamphlet "Conspiracy as Governance" Julian Assange (JA) argues about the need for leaking as an efficient way to destroy "unjust" groups as the neo-feudalistic one from above - luring the conspiracy theory leaning hacker community into 
his belief system. Eventually, JA used a biologistic argument on the benefits and drawbacks that uncontrolled leaking might pose for "just" and "unjust" systems, arriving at the conclusion that "unjust" systems are hurt more and thus will be less viable, essentially being destroyed by  more "just" systems.

While an innovative proposal, the underlying assumptions on complexity, network theory, and especially the evolutionary perspectives were never critically assessed. Some blogs and media raised questions on details and potential threats to innocent bystanders. The fundamental problems with the philosophy were never addressed.

In this talk, I will present some arguments against the general validity of such theories. In particular, I will refute some of the biologistic arguments. Theoretical biology has long ago pointed out the hidden complexity in evolutionary processes and as such the envisioned "leaking revolution" might be a limited artefact: there might even arise situations where the leaking envisioned and encouraged by Wikileaks and the like can actually strengthen some "conspiracies".

I will conclude with an alternative to that proposal; in particular, a way to deal with the 'conspiracy' that might be coined the rise of the neo-feudalistic society (which in itself is a self-sustainable, self-amplifying feedback loop, not necessarily a conscious conspiracy).</description>
        <persons>
          <person id="2626">Kay Hamacher</person>
        </persons>
        <links>
          <link href="http://www.kay-hamacher.de">Author's Homepage</link>
        </links>
      </event>
      <event id="4828">
        <start>12:45</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>antiforensik</slug>
        <title>Antiforensik</title>
        <subtitle>Einf&#252;hrung in das Thema Antiforensik am Beispiel eines neuen Angriffsvektors</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>de</language>
        <abstract>Antiforensik ist ein noch eher neues Thema und bekommt zunehmend mehr Bedeutung. IT-Forensik als Mittel zur Aufkl&#228;rung von Sachverhalten kann vor Gericht aber auch in internen Ermittlungen ma&#223;geblich f&#252;r Freispr&#252;che oder Schuldspr&#252;che sorgen. Daher ist es besonders schlimm, wenn die dazu verwendeten Programme nicht korrekt arbeiten und sogar mit pr&#228;parierten antiforensischen Aktionen angegriffen werden k&#246;nnen. Der Vortrag zeigt eine bisher unbekannte und dennoch technisch einfache Sicherheitsl&#252;cke in mindestens einer weltweit verwendeten Forensik-Suite und wie diese ausgenutzt werden kann: Hinzuf&#252;gen von Ermittlungsergebnissen, L&#246;schen/Ver&#228;ndern von Ermittlungsergebnissen, Infektion des Auswertesystems mit Malware.</abstract>
        <description>Antiforensik ist ein noch eher neues Thema und bekommt mehr Bedeutung in dem Ma&#223;e, wie IT-Forensik an Bedeutung gewinnt. IT-Forensik als Mittel zur Aufkl&#228;rung von Sachverhalten kann vor Gericht aber auch in internen Ermittlungen ma&#223;geblich f&#252;r Freispr&#252;che oder Schuldspr&#252;che sorgen. Die Anforderungen an die Korrektheit der verwendeten Programme und der eigenen Arbeitsweise sind daher besonders hoch. Personen, die eine IT-forensische Auswertung ihrer Computer und IT-Systeme bef&#252;rchten, verwenden Ma&#223;nahmen der Antiforensik, um zuk&#252;nftige Ermittlungen zu sabotieren oder wenigstens zu erschweren.

Antiforensik kann z.B. bedeuten, Spuren wie Zeitstempel zu vernichten, damit eine sp&#228;tere Auswertung nicht mehr m&#246;glich ist. Besonders schwerwiegend sind Aktionen, wenn sie die Auswertesysteme eines IT-Forensikers so angreifen, dass unbemerkt Ermittlungsergebnisse manipuliert werden. Der Vortrag soll eine Sicherheitsl&#252;cke in einer weltweit verwendeten Forensik-Suite zeigen und diese ausnutzen, um nachtr&#228;glich Informationen in forensische Berichte einzuf&#252;gen, Informationen zu entfernen und den Auswerte-PC unbemerkt mit Malware zu infizieren. Der dazu n&#246;tige Angriff ist technisch sogar sehr einfach. Eine vergleichbare L&#252;cke gibt es auch in einem beh&#246;rdenintern verwendeten Programm, welche nach M&#246;glichkeit auch vorgestellt werden soll. Zwei Forensik-Suites aus dem US-Markt m&#252;ssen noch auf L&#252;cken untersucht werden.

Der Vortrag soll die neu gefundene L&#252;cke in den beiden Programmen vorstellen und ausnutzen und vorab kurz in das Thema Antiforensik einf&#252;hren, inkl. kurzer Vorstellung des aktuellen Stand der Technik. Falls auch die US-Programme anf&#228;llig sind, sollen die entsprechenden Funde vorgestellt werden.

</description>
        <persons>
          <person id="3523">Martin Wundram</person>
        </persons>
        <links>
          <link href="http://www.tronicguard.com/index.php?page_id=64">Artikel die ich geschrieben habe</link>
          <link href="http://computer-forensik.org/2007/07/31/diskussion-um-fehler-in-encase/#more-122">Antiforensikartikel aus 2007 von Alexander Geschonneck</link>
        </links>
      </event>
      <event id="4587">
        <start>13:15</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>bup_git_for_backups</slug>
        <title>bup: Git for backups</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>bup is short for "backup". bup uses the file format of the distributed version control system Git. It solves Git's problems with big files. Deduplication is used to make backups space efficent (about five times smaller than rsnapshot's backups). Data is deduplicated globally across files and backups. If a small part of a big file is changed only little additional space is needed.</abstract>
        <description>The major part of this talk will describe Git's concepts, the structure of a repository, file format, and go into detail about the resulting implications on backups.

After a demonstration of bup I'll describe the implemented algorithms and data structures and their resulting perfomance gains over other backup solutions.

The talk will end with an overview of the recent development and a bait for new developers.</description>
        <persons>
          <person id="3370">Zoran Zaric</person>
        </persons>
        <links>
          <link href="http://github.com/apenwarr/bup">bup</link>
        </links>
      </event>
      <event id="4760">
        <start>14:00</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>chokepointproject</slug>
        <title>ChokePointProject - Quis custodiet ipsos custodes?</title>
        <subtitle>Aggregating and Visualizing (lack of) Transparancy Data in near-realtime</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>The object of the lecture is to present and discuss the chokepointproject. How it (will) attempt(s) to aggregate and visualize near-realtime global internetwork data and augment this visualisation with legislative, commercial(ownership) and circumvention information.</abstract>
        <description>The goals of the project are as follows:

1. Provide a global early warning system against governmental or commercial abuse of internetworking systems in regards to civil and human rights.
2. Enforce transparency by aggregating commercial ownership information.
3. Enforce transparency by aggregating legislative information, including voting histories.
4. Enable lobbyist to influence legislators by providing reliable, verifiable data.
5. Provide a public database with near real-time network monitoring data for general use.
6. Provide up to date circumvention methodologies, their relative legal status and their potential risks. 

The chokepointproject currently consists of two elements : 

1. A frontend and public database,
2. An intended globally distributed network monitoring data collection system.

The frontend intends to provide an easily understandable visualisation of aggregated and processed data-sources. The data-sources intend to provide the following information:

1. A per country detailed description of: 
1a. Network ownership (by IP block and route)
1b. Legislative information such as 
    Which relevant laws are currently active. Who has voted for them (supposing voting was a part of the process).
    Which relevant laws are currently under review or being proposed. Who are proposing/drafting these laws.
1c. What circumvention methods are currently available for specific problems.

2. Near real-time network status vitalisations such as, but not restricted to 
2a. Connectivity of geographic clusters,  
2b. Manipulation of connectivity such as:
2b.1. Traffic shaping,
2b.2. Content filtering,
2b.3. Blackouts.

The intended globally distributed network monitoring data collection system would provide an independent and publicly available dataset. I do not intend to discuss this in depth. The focus of this lecture is supposed to be the front-end and the aggregation of already publicly available data sources, and the supposed benefit to improving civil rights everywhere and protecting them in those places where their functional effectiveness is under threat.</description>
        <persons>
          <person id="3539">Ruben Bloemgarten</person>
        </persons>
        <links>
          <link href="http://chokepointproject.net/">http://chokepointproject.net/</link>
        </links>
      </event>
      <event id="4927">
        <start>14:30</start>
        <duration>00:30</duration>
        <room>Saal 2</room>
        <slug>noc_review_28c3_camp</slug>
        <title>NOC Review</title>
        <subtitle>NOC Review about the Camp 2011 and the 28C3</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>A review about the camp and the congress network. Network layout, planning, setup, operation and finally the teardown.</abstract>
        <description>This talk will review both the 28C3 and, due to popular demand, the Camp network.

First we would like to give you a review about our network at the camp, where we built a mid-sized carrier network in a few weeks at a camp ground with no infrastructure:
Starting at the 4km fibre uplink and the roll out of fibre over the whole campground, you will learn how to build proper datenklos, deploy access switches and WLAN access points in them and also how to convert a shipping container into a sophisticated outdoor data center, in order to build a network that can deliver pictures of cute little cats to over 3000 users.
We had some issues and challenging tasks, which we wish to report; we also have some graphs, diagrams, photos and graphics which we want to share with you.

The second part will be about the network of the 28C3, which is more or less the usual stuff like every year. You will see some graphs, infrastructure, and hopefully no reports about big issues. ;)
</description>
        <persons>
          <person id="1613">Kay</person>
          <person id="3646">Will Hargrave</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4754">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug></slug>
        <title>SMART HACKING FOR PRIVACY</title>
        <subtitle></subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Advanced metering devices (aka smart meters) are nowadays being installed throughout electric networks in Germany, in other parts of Europe and in the United States. Due to a recent amendment especially in Germany they become more and more popular and are obligatory for new and refurbished buildings.
Unfortunately, smart meters are able to become surveillance devices that monitor the behavior of the customers leading to unprecedented invasions of consumer privacy. High-resolution energy consumption data is transmitted to the utility company in principle allowing intrusive identification and monitoring of equipment within consumers' homes (e.g., TV set, refrigerator, toaster, and oven) as was already shown in different reports.
This talk is about the Discovergy / EasyMeter smart meter used for electricity metering in private homes in Germany. During our analysis we found several security bugs that range from problems with the certificate management of the website to missing security features for the metering data in transit. For example (un)fortunately the metering data is unsigned and unencrypted, although otherwise stated explicitly on the manufacturer's homepage. It has to be pointed out that all tests were performed on a sealed, fully functionally device.
IN OUR PRESENTATION WE WILL MAINLY FOCUS ON TWO ASPECTS WHICH WE REVEALED DURING OUR ANALYSIS: FIRST THE PRIVACY ISSUES RESULTING IN EVEN ALLOWING TO IDENTIFY THE TV PROGRAM OUT OF THE METERING DATA AND SECOND THE "PROBLEM" THAT ONE CAN EASILY ALTER DATA TRANSMITTED EVEN FOR A THIRD PARTY AND THEREBY POTENTIALLY FAKE THE AMOUNT OF CONSUMED POWER BEING BILLED.
In the first part of the talk we show that the analysis of the household&#8217;s electricity usage profile can reveal what channel the TV set in the household is displaying. We will also give some test-based assessments whether it is possible to scan for copyright-protected material in the data collected by the smart meter.
In the second part we focus on the data being transmitted by the smart meter via the Internet. We show to what extent the consumption data can be altered and transmitted to the server and visualize this by transmitting some kind of picture data to Discovergy&#8217;s consumption data server in a way that the picture content will become visible in the electricity profile. Moreover, we show what happens if the faked power consumption data reflects unrealistic extreme high or negative power consumptions and how that might influence the database and service robustness.
</abstract>
        <description></description>
        <persons>
          <person id="3495">Dario Carluccio</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4903">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 2</room>
        <slug>changing_techno_optimists_by_shaking_up_the_bureaucrats</slug>
        <title>Changing techno-optimists by shaking up the bureaucrats</title>
        <subtitle></subtitle>
        <track>Society and Politics</track>
        <type>lecture</type>
        <language>en</language>
        <abstract></abstract>
        <description>Meet the Netherlands: a nation filled with techno-optimists protecting
our freedom by puting in place restrictions on what you can do, reducing
our privacy and have technology as a solution for anything and
everything. When you make a trip we store your details for two years,
your airplane meal selection from two years earlier is good data to test
with and when migrating the government website we keep the old website
running in an unmaintained state. If you have nothing to hide nothing
can go wrong and there is nothing you can do.

Well not quite. What would happen if you play the system? If you would
take the train and hack the card? What if you were to pick up the
resistance you face and use it in your advantage. No matter what the
costs would carry on? If you would take some data and show the failures?
Not just once but a full month long and call that month Leaktober. What
if you would publicly call the failures with our personal data?
Ultimately you make a difference. You change the law, you changes the
rules of the game and you really can raise the question if storing all
that data is really needed. Ultimately people really start to doubt if
this is the right way to go.

This is a strategic and tactical story on how you can regain some
privacy and data protection. Even though for a journalist this should be
normal work, thanks to some people these things become very personal. It
ends in criminal prosecution, legal threats, insults, a successful
counter hack and ultimately a lot of benefits. But standing up for a
cause does work as long as you focus on the stories you want to bring.
My story is about hacking the system from the inside, overcoming fear
and showing bureaucrats that hackers are people too. The talk is a
lessons learnt how a few people can change a nation with hacker beliefs
if they really want to. A guideline on how to make a difference by
hacking the system you want to change. Where you can even make huge
mistakes, but with some luck you can win a world. How you can make your
critical voice be heard. Zillions of lessons learnt.</description>
        <persons>
          <person id="2227">Brenno de Winter</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
    <room name="Saal 3">
      <event id="4707">
        <start>11:30</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>your_disaster_crisis_revolution_just_got_pwned</slug>
        <title>Your Disaster/Crisis/Revolution just got Pwned</title>
        <subtitle>Telecomix and Geeks without Bounds on Security and Crisis Response</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language>en</language>
        <abstract>Software is becoming more and more important in organizing response to all kinds of crises, whether that means activists responding to an unjust government or aid workers helping with the aftermath of a disaster.  Security often isn't the first thing people think about in these situations -- they have work to get done, just like the rest of us, and many of these tools are built in the heat of the moment.  In a crisis, a lack of security can make a small disaster into a big one.  In this talk, we'll look at real world experiences of the security and privacy problems in the field, and how to fix them, at both large and small levels.</abstract>
        <description>People are using technology to try to save the world, whether in the disaster response world, or in activist or revolutionary work.
Many of the people involved are not technologists.
Many of the people building tools for these situations do not understand security.
This is a problem because:
Privacy issues for disaster response
Creepy uncle
Creepy government agency
Gaming the aid process with crowdsourced reports
Activists and revolutionaries are subject to direct attack, coercion, harrassment, etc.
A few problems:
People are using generic tools that don't provide the guarantees they need
People are writing special-purpose tools without understanding the problem
People are writing tools which intentionally subvert their users
People don't understand the problems they're causing with how they use tools
To fix this:
Build specialist tools with a deep understanding of the real problems
Get the help you need to make tools secure
Ask for help
Help disaster/activist ICT projects if you know your security
Build security into generic tools, even if you're not planning on revolutionaries using them, because you never know when you're going to need to overthrow a government on twittter.
Learn/teach about security and what it takes to use existing tools well
Build a security culture in your organization</description>
        <persons>
          <person id="3266">Herr Urbach</person>
          <person id="3512">willowbl00</person>
        </persons>
        <links>
          <link href="http://telecomix.org/">Telecomix</link>
          <link href="http://gwob.org/bridging-the-gap-between-traditional-relief-and-new-vtc">Geeks Without Bounds</link>
        </links>
      </event>
      <event id="4907">
        <start>12:45</start>
        <duration>02:15</duration>
        <room>Saal 3</room>
        <slug>lightning_talks_day_4</slug>
        <title>Lightning Talks Day 4</title>
        <subtitle></subtitle>
        <track>Community</track>
        <type>other</type>
        <language>en</language>
        <abstract></abstract>
        <description></description>
        <persons>
          <person id="1476">Nick Farr</person>
        </persons>
        <links>
        </links>
      </event>
      <event id="4723">
        <start>16:00</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug></slug>
        <title>DC+, The Protocol</title>
        <subtitle>Even slower than Tor and JAP together!</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>The idea of Dining Cryptographers-Networks (DC) offers a much better anonymity compared to MIX-Networks:
Defined anonymity sets, no need to trust in a central service, no possible attack for data retention.

In this talk you will learn about DC-Networks, advanced key generation methods (resulting in a DC+-Network) and a library to make DC-Networks available to your programs.</abstract>
        <description></description>
        <persons>
          <person id="879">klobs</person>
        </persons>
        <links>
          <link href="https://github.com/klobs/erlang-DC">A DC+-Server</link>
          <link href="https://github.com/klobs/dc--">A DC+-Library</link>
          <link href="https://github.com/klobs/libmulticastDC">Multicast on top of DC-Networks</link>
          <link href="https://github.com/klobs/DCoffee">https://github.com/klobs/DCoffee</link>
        </links>
      </event>
      <event id="4818">
        <start>17:15</start>
        <duration>01:00</duration>
        <room>Saal 3</room>
        <slug>evolving_custom_communication_protocols</slug>
        <title>Evolving custom communication protocols</title>
        <subtitle>Hell Yeah, it's rocket science</subtitle>
        <track>Hacking</track>
        <type>lecture</type>
        <language></language>
        <abstract>Even after years of committee review, communication protocols can certainly be hacked, sometimes highly entertainingly. What about creating a protocol the opposite way?  Start with all the hacks that can be done and search for a protocol that gets around them all.  Is it even possible? Part Time Scientists has used a GPU to help design our moon mission protocols and we'll show you the what and how.  Danger: Real code will be shown!</abstract>
        <description></description>
        <persons>
          <person id="3542">Wes Faler</person>
        </persons>
        <links>
        </links>
      </event>
    </room>
  </day>
</schedule>