Aktuelle Grösse: 100%
Das Easterhegg ist das Hackerfamilientreffen zu Ostern. Dieses Jahr findet es zum ersten mal in der Schweiz, genauer gesagt in Basel statt. Die Teilnehmer kommen aus dem Umfeld des Chaos Computer Clubs und anderen chaosnahen Gruppen.
Für das Easterhegg 2012 suchen wir Einreichungen zu allen chaosrelevanten Themen, wie z.B.:
* Kreativer Umgang mit Technik
* Biometrische und genetische Daten
* System- und Netzwerksicherheit
* Hackerspaces
* Energie und das Smart-Grid
* Hacktivismus, Politik und Lobbyarbeit
* Kunst mit und um Technik
* Staatliche Überwachung und die Vorratsdatenspeicherung
* Bürgerrechte im digitalen Zeitalter
* Datenschutz und Informationsfreiheit
* Open Government und Open Data
Neben Vorträgen suchen wir auch Workshops, Contests, Podiumsdiskussionen und sonstige Treffen mit chaosnahen Inhalten. Bitte reicht eure Angebote im Pentabarf unter https://cccv.pentabarf.org/submission/EH2012/ ein und gebt dabei folgende Informationen an:
* Worum geht es? (Titel)
* Warum ist das Thema für die Besucher interessant? (Abstract)
* Warum beschäftigst Du dich mit diesem Thema? (Description)
* Wie viel Platz und Zeit benötigst du dafür?
Die Wau-Holland-Stiftung (www.wauland.de) kann auf Anfrage Referentenspesen und Materialkosten für Workshops übernehmen.
Wir würden uns freuen, wenn du diesen Call for Particiaption an andere chaosnahe Gruppen weiterleiten würdest.
Nähere Informationen und die Anmeldung zum Easterhegg 2012 folgen bald. Bis dahin könnt ihr euch mit Fragen an orga@easterhegg.ch wenden.
Wir freuen uns, dich an Ostern in Basel begrüssen zu dürfen.
Chaos Computer Club Schweiz i.G.
Verband der schweizerischen Chaostreffs
Jeder will ins Netz und trotz des Aufkommens der Mobilfunknetze sind die Festnetze immer noch die schnellste und zuverlässigste Methode, am Internet teilzunehmen.
Doch so richtig zufrieden scheint niemand zu sein: komplizierte Tarife, unechte “Flatrates” und unklare Versorgungsrealitäten in Stadt und Land machen den Zugang zur “Datenautobahn” knifflig bis unmöglich. Dies hat natürlich auch Gründe, nur sind diese wenig bekannt.
Im Gespräch mit Tim Pritlove gibt Clemens Schrimpe einen Einblick in die Geschichte der Netzversorgung, die heutige Technik und die Gründe, warum die DSL-Anschlüsse häufig nicht das liefern, was sie könnten und was in der Zukunft für neue Probleme hinsichtlich der Dienstgüte und Netzneutralität zu erwarten ist.
Themen: DFÜ in den 80ern; X.25; Telefontarife in Berlin; Tarife nach Mondphase; Dortmund und Karlsruhe als Quellorte des deutschen Internets; der ISP-Boom des Web 1.0; Ausbaugarantien des Festnetzes; Internetversorgung in Island; die Einführung von ISDN nach der Wiedervereinigung; Irrweg Glasfaser; Aufkommen der DSL-Technik; Struktur eines DSL-Anschlusses; die ATM-Infrastruktur; Transfer-Hierarchien durch Multiplexing; Sinn und Unsinn der Regionaltarife; der Vormarsch von Gigabit Ethernet; Warum es in kleinen Orten kein schnelles Internet gibt und warum Telekom-Konkurrenten meistens keine Chance haben; der Niedergang des ISDN-Netzes; Upstream vs. Downstream; DSL-Profile; Symmetrisches DSL; feste Bandbreitenberechnung vs. technischer Machbarkeit schnellerer DSL-Verbindungen; Untervermietung der DSL-Infrastruktur; DSL Training; Umfang der Kupferleitung-Infrastruktur; Glasfasern im Boden, U-Bahn-Schächten, Flüssen und Kanälen; Regulierung und Deregulierung des Netzmarkts; Provider-Kooperation verboten; die Datenautobahn; volkswirtschaftlicher Nutzen von hohen Bandbreiten; Internet über Kabelfernsehnetze; LTE als Ergänzung des Festnetzes; Netzneutralität und Dienstgüte; Zwangsproxies und der Eingriff in den Datenstrom; bezahlte Bevorzugung einzelner Datendienste oder Anbieter.
Links:
Die Rhetorik ist die Kunst des Redens und es ist offensichtlich, dass der, der sie beherrscht, auf sein Umfeld einen deutlichen größeren Einfluss ausüben kann. Mit Elan und Plan zu argumentieren kann der wesentliche Schritt sein, Überzeugungsarbeit zu leisten und seinen Ideen Bahn zu brechen.
Im Gespräch mit Tim Pritlove erläutert Martin Haase (maha), wie die Rhetorik in der Antike geboren wurde und bis heute weiterentwickelt wurde, wie man Reden und Vorträge herangehen sollte und welche Fehler es zu vermeiden gilt. Über die reine Behandlung der Rhetorik hinaus beschäftigt sich das Gespräch auch mit dem Halten von Vorträgen im allgemeinen und was für Präsentationen und Workshops sprachlich und im Verhalten beherzigen sollte.
Themen: Frühere Sendungen mit Maha; Entstehung der Rhetorik im antiken Griechenland; Sprechen mit einem Kieselstein im Mund; Gegen den Wind anreden; laut reden; Atemtechnik; Gedanken finden; Gedanken ordnen; Mind-Maps; Vom Gedanken zum Wort; Memorieren der Rede; Vortragen; Neusprech; Humor; Metaphern; Ironie; Schreiben fürs Lesen vs. Schreiben fürs Hören; Theatersprache; Vortragen durch Vorlesen; Geskriptete Vorträge; Pausen; Slides als Unterstützung des Vortragenden; die Rede in der Politik; das Gesetz der Fünf; Gesetz der wachsenden Glieder; Sprachweiterbildung; Das Problem der Zahlen; Emotion in der Rede; Dialekt und Mundart; Freie Rede; Res & Verba; die Umgebung als Gedankenstütze; Ruhe bewahren; laut sprechen; Blickkontakt; Überwinden der Angst; Reden in der Schule; Nervosität und das Aufbrechen der Stimmung; Inhaltliche Relevanz und Erwartungshaltungen.
Links:
Vom 18. bis 20. Mai 2012 findet in Köln die SIGINT, die Konferenz für Hacker, Netzbewohner und Aktivisten, statt.
Unser Beitragsaufruf (“Call for Papers”) ist jetzt online und kann unter http://sigint.ccc.de/Beitragsaufruf begutachtet werden.
Worum es geht? Um die Zukunft, wie schon 2009 und 2010 (2011 fiel die SIGINT aus, um dem Camp den nötigen Platz im Kalender zu geben).
In den letzten Jahren wird die Signaldichte höher, doch obwohl wir immer mehr Input aufnehmen, rücken holistische Entwürfe in immer weitere Ferne, bestimmen Reduktion und Effizienz die Identitäten der Menschen, statt ganzheitliche Ansätze. Immer mehr Informationen zu immer kleineren Zusammenhängen befördern ein fragmentarisches Weltbild, das schließlich im hyperverlinkten Internet seinen deutlichsten Ausdruck gefunden hat.
Aus der Nähe betrachtet scheinen die Elemente chaotisch und ungeordnet, aus der Entfernung aber präsentieren sie sich als Einheit. Die Komplexität wird abstrahiert: Foren, Blogs, Image Boards, private Webseiten und IRC-Chaträume werden von Politik und Presse zur Internet Community addiert.
Die Struktur des Netzes besteht aus zahlreichen Bausteinen – bis auf das letzte Bit, auf das letzte Elektron können wir Systeme identifizieren und ihre Funktionen und Attribute analysieren. Das Verhalten von Computern erscheint uns dennoch willkürlich, Programmfehler bleiben Jahrzehnte unentdeckt und die Auswirkungen auf Wirtschaft und Gesellschaft unverstanden.
Die SIGINT sucht danach, den Widerspruch zwischen dem Kleinen und dem Großen, dem Chaotischen und der Strukur, dem Einzelnen und der Masse zu überwinden. Wir wollen die Baupläne der Zukunft entwerfen und Systeme bauen, die besser funktionieren als die alten, starren Gebilde des letzten Jahrtausends, und dabei den Blick für Systeme als Ganzes nie verlieren.
Als Veranstaltung des CCC pflegen wir weiterhin die Tradition des kreativen Technikumgangs und des sozialverträglichen Hacksports. Nur durch unabhängige und ergebnisoffene Zerforschung können Pfadabhängigkeiten und Algorithmen von technischen Systemen und Gesellschaftsformen einer kritischen Revision unterzogen werden. Für uns ist das Ausdruck einer persönlichen digitalen Selbstverteidigung, die schließlich in einen Hacktivismus für Menschenrechte münden muss.
Wie in den letzten Jahren wollen wir mit der Veranstaltung aktiv in die deutschsprachige und europäische Diskussion eingreifen, dabei sind uns folgende Themen besonders wichtig:
Über Einreichungen von Vorträgen, Performances oder etwas völlig anderem, das in losem Zusammenhang mit den Themen steht, freuen wir uns. Dabei müssen wir allerdings auch eine Auswahl vornehmen. Überrascht uns!
Liebe Netzgemeinde <3,
Ein bisschen her ist sie, die Gulaschprogrammiernacht 11. Ungefähr 300 Gäste besuchten ca. 30 Vorträge und Workshops und genossen unser Gulasch. Und ein bisschen Dokumentation soll nicht fehlen. Hier also sind die Aufzeichnungen, die wir hier an dieser Stelle noch nicht verkündigt hatten:
Schaut Euch die Bildergalerie an, mit vielen vielen schönen Fotos aus dem Hackcenter:
Nicht zu vergessen die Ergebnisse des Gamejams (Programmiere ein Spiel in 48 Stunden!) mit vielen spielerischen Kleinoden:
Bis bald, auf der GPN12 vielleicht? Voraussichtlich vom 7. Juni (Fronleichnam) bis 10. Juni in Karlsruhe.
Euer Entropia.
Aus eigener Initiative heraus entstand in verschiedenen Teilen des Chaos Computer Clubs der Wunsch, die Themen des CCC in die Schulen zu tragen, um Schüler mit den Realitäten des Internets bekannt zu machen und Lehrer und Eltern im Bereich Medienkompetenz zu unterstützen. Unter dem Namen “Chaos macht Schule” bieten verschiedene Gruppen im CCC ihre Hilfe an.
Im Gespräch mit Tim Pritlove berichten Peter Hecko und Florian Grunow vom CCC Mannheim über die Entstehung des Projekts, Motivation, Zielsetzung, Inhalte und Wirkung der Aktivitäten in den Schulen, die teilweise auch in Kooperation mit anderen gesellschaftlichen Gruppen durchgeführt wird.
Dauer: 01:31:48
Themen: 28C3; Chaos macht Schule; Motivation und Zielgruppen; Inhaltliche Gestaltung; Hackerdemos; Kooperation mit anderen Gruppen; Medienscouts; Netzwerk Neue Medien Mannheim; Engagement der Polizei; Problembewusstsein der Schulen; Aufteilung der Anfragen; Eltern-Lehrer-Veranstaltungen; Themenbereiche; Dessousfotos im Netz; das Bild vom Hacker; Interne Treffen und alternative Ansätze; Vergütung und kommerzielle Angebote; Zukunft des Projekts.
Links:
This short message is to establish that we are unwilling to tolerate any sexism, harassment or racism in our community. If you witness the abovementioned at any of the CCC gatherings, please speak out, back up anyone who has been the target of such behaviour, and encourage your peers to do the same. Please also know that the organizers of any CCC event will support you in doing so.
Sexism and racism contradict the preamble of the statutes of the CCC [1] and a public statement of the CCC issued 2005 [2]. The Chaos Computer Club and the organizers of the Chaos Communication Congress take harassment seriously. The Chaos Communication Congress will adopt an anti-harassment policy and respond to such behavior more quickly and firmly in the future.
The 28th Chaos Communication Congress ended yesterday and most of the talks are already available for download.
http://events.ccc.de/congress/2011/wiki/Documentation
Credit goes to the FEM, who did a really tremendous job streaming the talks during the conference and who still continue their hard work by publishing the Official Releases of the last talks.
Did you really love certain events? Weren’t so excited about others? Let us know! You can leave feedback via the Fahrplan. Find the events you’d like to leave your thoughts on and click on the green “Give Feedback” link in the lower right hand corner. We use this information to plan future events, so your input is essential.
Many thanks again for a great Congress and we’ll see you at the Sigint 2012 in May or the next Chaos Communication Congress!
After many attacks on X.509 and the internet PKI infrastructure, it became clear, that the current state does not meet the requirements for the upcoming challenges for secure internet communication in the future. CAs have been completely compromised, and weak cryptography used by PKIs has been broken in practice to issue rouge certificates. So there is a need for an alternative how to establish a binding between your public key and your identity. The EFF will present their proposal to improve the security of SSL/TLS connections this evening at the congress.
See the talk, Day 3, 23:00, Saal 3.
Author: Erik Tews
Tonight the young Swiss music group “Europa” is bringing “new airiness” to the 28C3 in the form of a Gala. The main goal is to put in question the practice of the entertainment industry and alienate its conventions by overdriving them. It’s going to be an experiment you can become part of as spectators. Please watch the following teaser. [The teaser has been removed since the server hosting it was a temporary one located at 28c3. Check the vimeo link below or download the recording of the actual talk]
Video: http://vimeo.com/34302758
Link 28C3 Fahrplan: http://events.ccc.de/congress/2011/Fahrplan/events/4832.en.html
Link Official Website: http://neueleichtigkeit.eu/
Some of you may remember the Cold Boot Attack. It’s a general method, how almost all disk encryption schemes on PCs and Laptop can be circumvented. Usually, when a harddisk or just a partition is encrypted, the encryption software used, needs to store the keys in memory, as long as the filesystem is mounted. Three years ago, it was shown that this key can be extracted, just by removing the RAM module, and dumping it’s content on a second PC using a custom software. Alternatively, the system can be booted from a CD or USB-stick with a custom software, that dumps the content of the RAM. As long as the RAM has only been off for a few seconds, or cold down to a low temperature, it doesn’t loose the stored data completely, and the encryption keys can be recovered from that dump.
Today, a solution for this problem will be presented, that prevents the attack by never storing the encryption key in RAM. Instead, CPU registers are used, and because the encryption code runs in kernel space, it can ensure, that they are never stored in RAM.
This sounds like a good solution to me, except that it only prevents the encryption key from leaking. Of course, the actual data, that is decrypted and that applications on that system work with, can still be found in RAM, but I have no idea how this can be fixed easily.
See the talk: Day 3, 14:30, Saal 2
On Day 3 of 28C3, an absolute crypto highlight will be presented. A Person-In-The-Middle (previously known as Man-In-The-Middle)attack against HDCP-secured links. For those who don’t know, HDCP is a protocol for digital video links like DVI, Display Port and HDMI, that encrypts the content between your PC or Blue-Ray player and your digital TV or display. HDCP was invented so that the encrypted high quality video, as you can find it on a Blue-Ray disc or HD-DVD will never be unencrypted in it’s digital form on the way to the display. If those systems would be secure, this could prevent pirated high quality rips of these videos on the internet.
However, such systems have been broken, for example Blue-Ray discs can be ripped with a standard PC using the right Blue-Ray drive and a commercial software. Even HDCP has been broken in practice so far. I don’t know how it append exactly, but the HDCP master key has been posted on a public website on the internet, which I won’t link here. Using this key, you would be theoretically able to decrypt a HDCP secured link, and record the raw digital signal transmitted there. The practical problems are, that DVI, HDMI and DisplayPort are very high speed links, and no general sniffers and universal transmitters are available for a low price. In contrast to that, WiFi can usually be sniffed using the build-in WLAN adapter in a consumers laptop.
In this talk, a custom build hardware will be presented, that can be used to act as a Person-In-The-Middle on DHCP secured links, and can alter the signal transmitted there. The actual brilliant idea here is, that this type of attack does not allow you do record the transmission in clear, so that this is a non-copyright circumventing attack, and cannot be prosecuted using copyright enforcement laws. However, due to the open nature of the hardware platform, one may modify this attack to archive other goals.
A short summary from the abstract:
A system has been described that enables a man-in-the-middle attack upon HDCP secured links. The attack enables the overlay of video upon existing streams; an example of an application of the attack is the overlay of a personalized twitter feed over video programs. The attack relies upon the HDCP master key and a snooping mechanism implemented using an FPGA. The implementation of the attack never decrypts previously encrypted video, and it is incapable of operating without an existing, valid HDCP link. It is thus an embodiment of a bona-fide, non-infringing and commercially useful application of the HDCP master key. This embodiment impairs the equating of the HDCP master key with copyright circumvention purposes.
The slides are already available at: http://events.ccc.de/congress/2011/Fahrplan/attachments/2011_HDCP_MITM_28c3_bunnie.pdf
See the talk: Day 3, 18:30, Saal 1
Author: Erik Tews
Two Bitcoin related talks will be presented tomorrow. Bitcoin is a decentralized digital currency, and of course uses various cryptographic schemes as building blocks. Because Bitcoins can be exchanged with real money, Bitcoin is more than just an academic playground and real cash could be lost, if an attack on Bitcoin would be found.
The first talk Bitcoin – An Analysis will be presented by Kay Hamacher and Stefan Katzenbeisser. From the abstract:
In this presentation, we show results on network analysis of the money flow, the behavior of individuals, and the overall scalability of P2P-currencies. At the same time we will discuss advanced “financial instruments” that one might find in the transactions.
So I assume that this will be an in-depth analysis of the current state of the Bitcoin network. The second talk Electronic money: The road to Bitcoin and a glimpse forward – How the e-money systems can be made better given by peio will cover the general topic of digital money and what lead to the development of Bitcoin. It will even look beyond Bitcoin and what can be improved in the future. From the abstract:
The proposed talk provides a definition of the problem of creating e-money and after a review of the state of the art points out possible solutions and proposes questions for discussion for the properties of electronic money system.
For me, both talks are interesting. Besides the cryptographic challenges in this research area, this topic also has an heavy political impact. What would you do, if you could exchange money over the internet, untraceable and anonymously?
See the talks, Day 3, 14:00 Saal 1, and Day 3, 17:15, Saal 3.
Side channel attacks are very well known in cryptography. In a nutshell, a side channel information (not the ciphertext or the public key) is used to recover a secret. This can be the time it takes for a cryptographic operation, the power consumption of a device, the variations in the electromagnetic field surrounding a device or just the acoustic noise produced by a device. Secure implementations of cryptographic schemes usually implement countermeasures against these kind of attacks.
In contrast to the cryptography world, side channel attacks are not very well known in the general IT security business. However, side channel attacks can also be used against applications, that don’t use cryptography, but process any kind of secret data. Examples could be the size of a database, the privileges of a user, or just the length of a stored password. Sebastian Schinzel will present his analysis, as well as general attack techniques, than can be used to exploit side channel weaknesses on the web.
I think this talk is important, because it raises the general awareness of side channel attacks to the general IT security community. Side channel attacks are not solely restricted to cryptographic algorithms, and can be used as an effective attack against many more applications.
See the talk, Day 2, 18:30, Saal 2
Author: Erik Tews
Alexander Koch will be presenting the results of his bachelor thesis at 28C3. In his thesis, he implemented a person-in-the-middle-attack (don’t call it man-in-the-middle attack) against a USB chipcard reader for digital signatures. Instead of modifying the software on the users PC, he implemented a USB hardware device, that can be plugged in between the chip card reader and the host PC. Because the device behaves passively as long as no signature is made, it is hard to detect from any kind of security software from the PC side. When a signature is made, the device can transmit a different message digest (another document is signed) to the chipcard reader. The generated signature is stored and can later be retrieved from the attacker using a wireless link.
I think this is a good demonstration that shows, why digital signature made on (secure) devices, that cannot display the signed document are not a good idea. Also, a hardware device is hard to detect in software, because it acts like a valid chip card reader to the PC.
See the talk, Day 2, 18:30, Saal 3
Author: Erik Tews
Julian Wälde and Alexander Klink will be presenting a new attack against Web Application Frameworks (WAF), that can be used to generate HTTP requests, that take several minutes of CPU time to process. Sending many of these requests in parallel can be used as an effective Denial of Service attack against many websites. Even one cannot spot any relation to cryptography from the abstract, I have been informed that this talk will also cover many cryptography related aspects.
See the talk, Day 2, 14:00, Saal 1
Author: Erik Tews
A group of enthusiast interpreters at the congress are organizing simultaneous translation into English for a small selection of German talks. We are aiming for the “fun” events that have been translated for a few years, and for the first time this year, we are trying our hand at some “content” talks as well.
The provisional list of translated events is:
Be sure to tell your English speaking friends to check out some really great content they might not otherwise have access to!
We, Sebastian and Julian, are part of last year’s core team of live interpreters. In the past we have translated at several Chaos Communication Congresses, together with Volty who cannot be there this year and many others.
We want to continue this tradition of translating important talks such as the Fnord News Show and the Hacker Jeopardy, but also others, depending on our resources.
If you are interested in helping out, please meet us on Day 1, December 27th, at 21:00 in the angel area down in the basement. You may also contact us via e-mail at Sebastian.Lisken _at_ gmx.net or julian _at_ phinn.de – or via twitter at @hdsjulian.
The talks we want to interpret are:
http://events.ccc.de/congress/2011/Fahrplan/events/4844.en.html
http://events.ccc.de/congress/2011/Fahrplan/events/4788.en.html
http://events.ccc.de/congress/2011/Fahrplan/events/4775.en.html
http://events.ccc.de/congress/2011/Fahrplan/events/4866.en.html
http://events.ccc.de/congress/2011/Fahrplan/events/4898.en.html
Now, as we have gathered some experience in the past few years, we would like to intensify our efforts and get even more important German talks to be translated even better.
Therefore we need help from fellow hackers. Please note that the following rules might sound a little strict for a voluntary job. However, experiences from the last years have shown that this work can only be done if there is absolutely no personal vanity involved and everybody is willing to submit to a strong hierarchy in order to do a good job. Nobody wants to get bored with a bad translation and we are truly willing to give our best. Also the work in the interpretation booth can be very, very stressful at times.
We want to provide all congress attendees (and people watching the stream) the best possible translation. In order to do this we are willing to work hard and submit ourself to a strict set of rules. We expect the same from everybody who wants to help us.
You are:
- Excellent in speaking English and German
- Or excellent in understanding English and German, with a talent for keeping your head up in stressful situations
- Willing to submit to a strong set of rules
- Possibly experienced with translations
Jobs to be done:
Interpreter
We need some good translators willing to spend part of their time at the Congress in the speaker’s cabin. You will sit together with two other translators and do your best interpreting talks live in several minute long segments as told to you by the director.
Director
We also need some very few “Directors”. In the past we have noticed that we get into the best flow if we have a person listening to our translations and deciding on the fly who should do the talking. This director will have to have a good understanding of the work the interpreters are doing. They will decide autonomously when to choose which interpreter for how long. Their job is to get a good flow into the translation and prevent exhaustion and lack of concentration among the interpreters.
The director can be an interpreter as well. When they choose to act as interpreter, the director will put a replacement director in charge for the duration of that segment.
Rules:
Please do not feel insulted by the strictness of these rules. We have had issues in the past with the vanity of individuals who didnt do a good job but insisted to continue interpreting. We want to prevent this.
1. During the talk, the core team’s word is law.
2. The core team at first consists of Sebastian and Julian. We will be eager to invite more people as we move along. We strongly believe in a trust and merit based system.
3. There will be no discussions in the interpretation booth. Period.
4. Disputes will be solved outside and _after_ the talks.
5. We do understand that interpreting is a skill to be learned through practice. We will not send away newbies. We will however make sure their talking time is limited until they feel secure and able to do more segments.
6. After the talk we will have a discussion with all participants. There will be open criticism and everybody will have the right to speak their mind. This includes criticising the core team (who will also be interpreting and directing, of course) as well as the other directors and interpreters for their work as well as their behaviour. Of course this round is also open for positive criticism and finding out what was good.