 at this late stage of the Congress. My friend Rudi, I'm very happy to present my friend Rudi. Some of you might have seen him on a stage like this one before. I met him at a talk that contained the name of an animal. Some of you might remember that name. They were called Longhorn. Anyone remember Longhorn? Rudi held a talk at camp, and years later, Microsoft discontinued the product. Thank you, Rudi. Unfortunately, they turned it into Vista, so it didn't really win. Those of you who don't know, Rudi Gavais. This is not part of the talk, by the way. Rudi Gavais, a professor for cryptography. What else should I say? Just a great presenter. I'm going to leave the stage. Thank you. And as my friend Marcus Becadar told me, good morning. It always fits. Good morning. And you've been told that it's a long story. And I couldn't help but grin to see that I'm simply stuck in a time loop in some parts. Very importantly, a large part of the crypto disasters that we have right now are crypto zombies that have been around for 20 years. And finally, Microsoft has been replacing them. Unfortunately, this is not just a friendly encouragement. Also, do we have a Windows 10 botnet, or is it a gated community? Microsoft simply want to create its own ecosystem. The answer is yes, but also, as a computer scientist, a botnet is a computer network where a third party can execute arbitrary code on my system. These are exactly the end user license agreements that Microsoft is putting into its products right now. And people always thought I was joking when I was saying, yes, you can't prevent the updates, but you can delay them. And people were looking at me in a funny way. But when I said that it costs quite a bit of money if you want to avoid using untested updates, and people told me I shouldn't exaggerate. And that's the impression that I get as well, because when you look at the license terms, especially those of the test version, where Microsoft is trying to make sure it gets just about all rights imaginable, excluding maybe your first born child, it's a bit disconcerting and persisting as I am. Persisting as the CT, my favorite magazine is, there's a cover story that tells you how you can prevent updates. So it's not a necessary update, but it's one that Microsoft is trying to force you into. And it's so annoying that there are customer protection agencies that are trying to target this. And at a certain age, you might start to get a bit suspicious when people say, here, take this, and you don't want it, but they persist. My experience has made me a bit suspicious when people come at me with that kind of marketing measures. But apparently Microsoft decided this is a good approach. And to put it simply, we used to discuss if some security problems might be abused by Microsoft. We now have a confirmation, because Microsoft removes the control over your own hardware and software. And if you remember that trusted computing thing that you might remember from ages ago, they're using that now to change their system and to change the opinion of the security, your opinion of the security of the system. And I want to understand these problems. And I understand that Microsoft says, we patched it better than the average user. That's definitely something you could discuss. But as always, it's always a tricky situation when people are forced into their luck. So I read that article in the magazine I just talked about. I was wondering if I should maybe turn it into text adventure to make it more understandable. It's simply not a way that you're supposed to treat your customers. But let's backtrack a bit in web history. 2002, we had a debate on the trusted computing chip that has become a crucial point of Windows 10. This is Ron Rivers, the R in RSA, wrote that the right way to look at this is you are putting a virtual set-top box inside your PC. So you're turning your computer into a set-top box. It's no longer your computer. It's more like a computer that you leased from Microsoft. And it's essentially the normal software as a service model. And you can accept all of this. And that's well good. But it becomes less and less when you force people into it. And we're hackers. So what's happening here? We're handing all our security to Microsoft. The question is, can we do that? And at the last few congresses, I spent a large part of my slides on Microsoft security problems, many of which I quoted from the heizer security tickers to make them fairly objective. And even today, they're still taking a large part of my slides. So I can show you current problems that come from it from long ago. This crypto zombie problem is that we're still using ancient algorithms like SHA-1. Well, we're now at a congress where many people are born in an age where the crypto was essentially over. But we keep saying that if we weaken our systems, it does not only weaken the current system, but also all future system. Because this problem of backwards compatibility is how many attacks works, what enables many attacks. And please allow me to speak about another Gator community, namely Apple, who thought it would be a good idea to block an app that was made in the environment of CCC because it contained objectionable content. As a hacker, I always like objectionable content. And it was essentially crypto hacking. And well, it gives me this feeling that I'm trapped in a time loop. And this was a talk from 1999. And Apple used this to censor an app from the App Store. And if I look at Microsoft Apple's track records with censorship, I'm getting seriously worried. And I'm not using this just to be able to show you these pictures of a younger me. We had nothing back in the day. All we had was, we could only write our maths on a flip board in horrible English. But this talk was watched by 280 people in the past 15 years until Apple got upset. The T-shirt is fun as well. I liked it back in the day. But well, nobody really worried about it. But 15 years later, the biggest American company makes it fool of itself. Besides taking this opportunity to show you pictures of a younger me, it's something you have to talk about. And Apple censors harmless mathematicians who make scientific talks because apparently it's objectionable. This is simply something that makes you scratch your head. And Apple was never very happy about export restrictions, which shows us that censors are just in a bad zone. As soon as we start censoring something, whether it's for religious reasons, like the Green Party in Berlin, Kreuzberg, who think that their taste is everybody's taste, you're in a downward spiral that can't be stopped. And these people who censor things shouldn't be surprised if the hacker community is laughing at them. However, back to the technology. So the freak attack has been just a rollback to the old security problems. And Microsoft has just covered it quickly, and decided, hey, it's updated a bit hard, but we'll try and work around. That secures the system. And what happened? Well, it was downloaded. It's just nothing worked anymore. After downloading it, no further updates could be installed correctly. And that was on the 7th. Now on the 13th, it became less and less funny. Microsoft decided once they remove old cryptography, they just throw out show on in the same time. After 20 years, it's a good decision. However, here they made it wrong. They changed the linear steel boot configuration. And the systems that ran proper Linux systems had been destroyed by the parallel installation of Windows. It just didn't boot. And I want to mention that if we think that all our Linux systems are changed Windows computers, and we want to use these control systems or the control system that once Windows admin decided, oh, I just want to make the system more secure, the Linux installation is broken. That's really, can make us really angry. And we noticed that Microsoft doesn't look at the thing at all. Another stupid thing is that the people weren't able to change anything in the update without destroying the BIOS settings. And that makes us really afraid. We love to create and usually that just doesn't work anymore. That sounds good, but it is not good if we notice that we make many mistakes that don't have to be asked politically. But they're just because of wrong decisions. And one really strange thing was the situation was that shortly before I made the camp presentation, I was at a Black Hat conference. They presented that it is possible to force updates from different person. And then there was this my favorite slide. Can you remember what that is? They don't know what that is? We should remember that name. It's quite clear. Nobody of you knows that. A small hint. You, we might have to reboot the system for it to be there, but you shouldn't ignore it. But Microsoft says update type is important. And we're a bit confused about it. So I won't be so unfair that Microsoft doesn't know what to do. It's really interesting. And so it's something where I like stupid jokes. If we have more information, we can always call the US government. And if we trust them, we can also call the educational part. And if we really think it's strange and we want to call, if we want to have help, who do we call? Well, the US military, of course. So those are the few words that are on the wrong case. Well, there are two and a half super jokes. I'll have another slide of bad jokes about that. And then I'll say why that isn't funny at all. First of all, the usual joke, every time I make this slide, I get a warning in my latte program. So just enough joke. What does that mean? Microsoft is an update with a completely broken name. That means that no human has looked at it. Because every human would have said, that's a really strange name. Are you really, really sure? No, an electronic person has looked at it. Because even the electronic would have given a warning. Nobody also had noticed. Oh, that's in the URL string. Let's see whether these URLs are written correctly. So let's forget all the funny jokes. We have a situation where Microsoft has made no explanations about it. There are no explanation. Heizer said that they wanted to ask. They didn't answer. I have since then learned. It's saying by some high German political part of the answer would make the population uneasy. I think that some of the information might make part of the people uneasy. And I would know that I wouldn't have to change them in December. However, what could happen to change after all those funny things like these random strings that they will have to add another slide? Well, I have already assumed it sounds a bit arrogant. But we cryptographs like, we help people. We say, hey, you can ask what do we need so that we can help you? Do you need some secrets that differentiate you from an attacker? We'll try to make it shorter. But please do take care of those secrets. We'll take care of everything else. However, if Microsoft goes ahead and signs and publishes or passes on a secret signing key of the Xbox Live system, that was one of the few situations where I was happy was because that is one of the few signs that things like that, dangerous things only happen by mistake. So I'll hang out of the window so that if I'm here next year, I will probably have problems to get even worse than that. Because what can you do worse than leak a key that can create a system by Xbox computers? That's just the things that do infrared on all the apartment. So they don't only know what we read, but they also know what they do under the covers. So they know that. Well, maybe people should think about what to do about it, but just put it on there with a sign significant from Xbox Live possible to put another software on it to make trust. And then next thing, all these funny things about Microsoft, the funny jokes about Microsoft update problems are not at all funny, because that means all the quality control of Microsoft absolutely failed. I've sat down with enough intelligent informatics technicians that see and write how to write tests that all that slides through. So if there's a human that sees an update with that name, he will notice that. Every script you can imagine that has all these things. That means all these funny jokes we laughed about are really not funny if you have systems that are important. And I want to say, even if we don't have any windows except of Xbox, we know that in the Fire Brigade systems, they are still Windows boxes, probably Windows XP boxes even. But that's a system that's internal, which I'm not going to put on the subject list in Hamburg. Microsoft apparently can't do that. They don't have the update system under control. And can we save the system? And that's a second critical point. Microsoft, since Windows 8, Microsoft trusted computing module, so they require the trusted computing module, and they have a switch off key. And they say that instead of the Microsoft security key, it's our architecture, and we have our own architecture, was part of Windows 8 to boot without Microsoft system. However, that was removed from the Microsoft requirements. And among Windows 10, many systems cannot be switched off. They tried that with Windows 8, but we have the situation, and I really have to criticize Heiser at the first time here. Heiser said that we don't have to be confused that we have problems because all the Linux systems have signed keys, signed boot parameters. However, there's a problem. Microsoft signs a Windows boot loader, and then the Windows systems boot. Can Microsoft call back the key? Yes. Has Microsoft deactivated stuff? Yes. Has Microsoft done stuff, deactivated stuff, without proper reasoning? Yeah. That's one bad part. The second bad part is that that's all right. That Microsoft is a great company. It's one of the biggest, spend much money for the Linux kernel. Also want to be active. Signs certain distributions, but only signs that are given to them. And it's not about old and exotic software, however, but all the development system of controls of free software. We don't have to sign every step signed. There will be successful open source software. However, the real development that everybody can work towards it has a real problem if we have to have every change signed by Microsoft and other these combination. They don't have it on it. They don't let us repair it. They destroy our boot parameters, and that is something. Even though I've decided to work quite well with Microsoft, it's something I'm not willing to accept at all. And with the smile I saw that they have angered some people from Breidenberg who care about the rights of users. So back to 2003, this Microsoft decision towards market domination? To a lockout. So you will be locked out of your own system, in fact. And we don't really own our computers anymore. And it's a thing that with the inventor of the publicly crypto has said, well, it's just a requirement that we have under control our own keys and our own devices. But there's something positive to say. Some US companies, like Apple, have addressed these problems. That from end to end encryption, this is the right description. And here we have the opposite thing. To repeat, this is not something abstract. Microsoft has done this several times. Microsoft has, several times, has deactivated systems without reasoning. Maybe last time they gave out a reasoning, I have come grier and grier, because we are not sure if they really gave out it and so on. So I repeat, the problem is Microsoft is changing its strategy. Windows is a service now. We only get money by looking at your data. So this is now a problem. If there is really technical errors in this segment, then Microsoft could come back with the ideas if this is not a problem anymore. One more historical slide. In this TPM module, we have a secret key which we cannot access. So who can access this private key? Hopefully nobody. But if these keys are generated outside the TPM and then written into it, so somebody might have a copy of it. And then he has a general key which works RAE. This is, of course, interesting for the NSIA, et cetera. So well, this is a historical slide, but the reality has taken it in. So I could have removed this slide. But yes, once again, the manufacturers of these things are usually not in the US, but in China. So when I cannot really trust a democracy like America, then I have even greater worry about an authoritarian state. So here, it cannot be possible that we have an infrastructure where somebody who can simply file has a key to everything. So last things, all these things that we said, UFE backdoors, we allowed virus scanners, software, et cetera. The answer, if something is broken by UFE, what can we do? Then can throw away the hardware, and there's nothing else we can do. That's somebody of a really good company who said this, which worries me. Yeah, when people in high positions in industry have an unlicinic meaning like we in the hacker community. So while Lenovo is based in Peking, and I'm really sure that they are not affiliated with the government. We had a Dell backdoor that didn't really work with the Microsoft strategy of, let's publish our private keys, maybe somebody else can use it. It's scary. And the only thing that pleased me as a cryptographer was the Juniper backdoor. Because you may remember, I showed you an elliptic curve generator last year and said that there's a backdoor in there. And we cryptographers warned people just a few days after these things came up and said there's an open door so they don't use it. But companies, of course, use it, look at Juniper. But the nice thing is, a backdoor in an elliptic curve there is just a few bytes. And somebody took these bytes that were an NSA vector and threw them away and replaced them with its own vector. So you have a gate to Fort Knox and remove it and put your own gate in place. It's really scary, though. This problem is obvious when we outsource all our IT to Microsoft and say they provide updates, they know what we need to do. This means that if we have, we can't really put pressure on Microsoft there, and this is something that's rather unpleasing. This is my last slide that's only cut and pasted for a small part. The federal government said quite clearly that if you want to build a secure environment, yes, you can do that. But the people have to be able to make their own decision if they want to enter that closed system and they need an opportunity to get out of that closed system again. That's been in there for a while. Now we have the problem that when we use things, we should use up-to-date cryptography. But Microsoft threw out many companies threw out one. But these hooks still exist. We need cryptography that protects privacy, like perfect forward secrecy. And all these things have been in the standard for a while. We need international certification of the TPM production to just say it again, I'm a company that makes TPM. I have a master key for everything, so I can access all the systems. That can't be right. And you attract a nasty crowd if you have that. So it's a way for companies to protect themselves if they open up their system, if they open up their certification and booting code for relevant software for Windows 10 and 8. And we also need to check for monopolies because Microsoft is no longer the dominant company. Elmer just said we looked at some of the old Windows talks. They used to have 90% market share. And that's no longer the case in some areas. And yet the normal hardware that people use in their personal computers still runs Windows for the most part. I mean, there's the Apple word. That's another subject. But most personal computers are still running Windows. And finally, I'm going to say some nice things about the German telecom and where there's still T systems in Microsoft. There was this small article that some of you might not even have noticed that Microsoft and T systems had sketched out how a German cloud might look. And I'm always a bit skeptical of these weird national cloud propositions. But this is interesting for some companies. I mean, they can say we have a server in Germany. This is not sufficient according to the current regulations because companies that are based in the United States, they might be forced to abduct their data to the United States. This won't lead us to world peace. But it means that companies have legal certainty that they'll only be in trouble if they run counter to German law. And that other countries' secret agencies won't be able to read everything they write. And this legal security is being opened up to private consumers as well, at least I hope so. I think this is a reasonable expectation. I mean, that you have these things from the real world, where you have legal recalls, should be available in the digital world as well. And I hope that the EU stance on safe harbors is going to lead to change here. So let's make sure that the privacy standards we've thought for survive Microsoft's corporate policy. Thank you very much for your attention.