 So welcome to the second Lightning Talk session. I'm going to briefly explain how this session works for the audience and the speakers. For the speakers, please sit in one of the front rows so you can get on the stage quickly to deliver your talk. You can do so by talking into the microphone that's very important so that people can hear you. Do not turn around to see your slides because then you can't hear me. So you can see your slides down on the screen here. Maybe it could be that you are too small then just move a bit to the side and you can see them. Use the clicker to advance the slides. Stay calm, talk loud and clearly so that everybody can hear your message. Finish on time, which is very important because we have so many talks and we don't want to use more time than we are allowed to. Then get your applause and leave the stage. Thanks, but I'm not going to leave yet. I'm going to explain for the audience how to listen to Lightning Talks. So it's pretty simple. Just be excellent to each other. Keep in mind all the announcements I just made. But also watch the timekeeper. The timekeeper is right up here or you can see it on the screen up there, which helps us to track the five minutes that every speaker has. Alex, would you take over? Yes, of course. Good morning everybody. With the last talk yesterday with Petaloon we decided to try a more speaker-friendly and more appreciative approach to cancelling a talk. You know more 5-4-3-2-1 sounds, you want to loud aid them out. So we tried to use some applause to stop the talk. This is I think more awesome for the speakers and maybe for you as well. For the speakers, as long as the timekeeper is in the green area you are in the first four minutes of your talk. You have plenty of time. When it goes up like this, now you have only about one minute left. When it starts turning yellow, you have one minute left. These are the last 30 seconds of your talk when they start to get red. So if the red turns up something like this, then you have not much time left. And we tried in your approach 5-4-3-2-1. I think this might work. Yeah, I think so too. Because we noticed that most speakers are already on their contact slide and when we bust them out it's not very nice. So we just send them away with an applause. All right, I think that's it. I'm going to mention the translation. So a very awesome job by the translation team. Please give them a huge round of applause. We will have the German talks translated into English. The English talks translated into German and also everything translated into French. See the website up there, so httpsc3lingo.org for information on how to listen to these translated streams. Yeah, well then I think we can start. Let's go with the first speaker. So good morning everyone. Thanks for being here so early. I'm here to tell you about a little project that I'm working on Saturday. I'm going to tell you it's a one-day conference that I'm organizing in Berlin next year which is very soon. And I'm going to tell you a little bit about what the conference is about which is the R programming language. A little bit how I ended up organizing a conference. And why I think it's interesting to you, maybe it's philosophy which is open and open source. So let's get started. So R is now one of the main languages for data science and statistical programming. It is a great tool for data visualization as well. And it is free and open source. It's supported by the R Foundation. And it is widely used. It's just celebrated its 25th year this year. And is used both in research and in industry companies like Google, Airbnb. You can find it just about anywhere. And I'm Noah. I'm from Berlin. And how did I end up dedicating all of my free time, some of my best friends free time, some of their colleagues and some of people I just met through Twitter because I announced it a few weeks ago. So it started with R Ladies. I've been organizing an R Ladies meetup in Berlin for the past two years. And R Ladies is an effort by again the R community to try to promote women's involvement in our code to get more women to contribute to code and to be active and to feel like R is a language and a community that is for them. And we do that by offering meetups and mentorship programs. And I've been really, I think it's like my side project and it's still some of my best work I think over the last two years. And along that I also started volunteering, so it looks a little bit like this. I think it's really fun. And if you are interested in R, I highly recommend it's open for everyone. Only the organizational roles are reserved for women. And around that time, a bit later, I also started volunteering at Fowards, which is a task force by the R Foundation to promote all sorts of diversity and inclusion, not just for women. So it's for LGBTQ+, it's for people with disabilities, it's for different minority groups and we're really trying to do all sorts of work around that. And this year I had the opportunity to get for the first time outside of my local bubble, so other than Slack and GitHub, I've only known our users around me and then maybe a few data science conferences. So I went to the European R User Meetup in Budapest this year and they actually, two years before that in 2016, organized the first Saturday event at Budapest and I was really inspired by their vibrant community and by meeting a lot of people that I only knew through Slack and GitHub thus far, and a lot of sub-communities that are not location-based in our ladies and our community. And I really thought, well, if you can do this in Budapest, why can't you do it in Berlin? I'm sure we have enough people who use R to create a similar conference. So I thought, why not? That's organized Saturday, signed up on GitHub and that's how I ended up doing that. So why did I like so much the idea of it? So it's very much relates to my history with our ladies and forwards. It's the philosophy behind Saturday, so it's not let's just have another conference for R and it's not let's just have another event for people to come and share ideas. It's really about let's make sure that as many people as possible can come and share ideas. So how do we do that? We make sure that it's completely volunteer run. We are not for profit and if we will have any leftover money, we reinvest it into scholarships for the community or events like bringing speakers and so on. It's low cost, we cap it at a minimum wage and we try to make sure it's both for beginners and for advanced users and we really make a lot of efforts to include women, minorities, LGBTQ and people with disabilities. How do we do that? So we don't need to invent the wheel thankfully and this might be the interesting part for you. There are a lot of resources about how to make sure that your events and your communities are suitable for as many people as possible and that you can use disk by an unfocus group. You can use the great resources from other conferences and I guess that's it. This is our organizing team. If you're interested in more information and if you want to help us out, then please be in touch. Thank you. Next up is the public sector information director. Good morning Leipzig. Hold on one second. So I will talk about the fancy topic public sector information and in case anybody wonders what it is, it's basically the open data legislative for whole Europe which is at the moment right now negotiated in the coming weeks in Brussels. And what does that do at Congress? Well basically ideally from the hacker ethics, public data, private data is one of the core fundamentals and I'm working at knowledge foundation so we do a lot of open data stuff like open law which was recently launched and code for Germany. And so what is open data in case nobody knows it, it's basically data you can freely use, modify or share by anyone for any purpose meaning also you can make a business out of it. And this what you see here, that part is right now negotiated. It's also like open data or data which should be open data held by like public institutions or government owned enterprises. And that's the list that we are demanding and to keep it short basically everything which is funded by public money should be also public good or in Germany there is a campaign by Wikimedia which is called ÖGÖG, öffentlich is good, öffentlich is gild the other way around. And that's the standing. In December there was an E3 Auschwitz, the voting and right now the negotiation and why this is important because also like in Germany in this legislative period we should get a new open data law at least that's like in the coalition contract. And I want to illustrate that why that is important, one example and that is like public transportation data which is like right now a really bad set affair in Germany and why is that important because for example we want to have increased mobility less CO2 and it's a big sector. In the United States where it's green we have open data in the transportation sector here we are in Leipzig and everything else is like not compatible with 2018 I would say. And when you're missing data you get some weird routing issue shit like what you can see here and that goes around all over Europe. So by the end of the day or like in the long one we first have a human being on the mass before we have like public open data in the transportation sector and we want to change that. And that's actually a hope so when we use open standards open software open data there's a great example coming from Finland which they created this platform just for Helsinki but it was open so it was modifiable for anybody else so there's like Miran which is a tiny town in Italy adapted that model like for just 15,000 euros and you have like a life map where the buses are going and that was done by one developer because Helsinki was also providing the platform as open source and there was data standards. So what that means basically you can move from like data shoveling by your hand to like industrial rollout and that means like efficiency or it's like just awesome and you think about what could be done across Europe when we have standards and that's the directive should be there for it and it's not just like this case transportation it's also like for transparency when it comes to beneficial ownership of companies or for example what public broadcasting stations are doing that you can see the content and use it later. So that's the detail list, I don't know how much time we have basically what you should think about it how awesome it would be if you deal like public data as an infrastructure and what can be done with it and so please bug your local politicians or whoever is in charge of it and look level and if you're interested contact us the slides are online, they are linked because it's I think a little bit timely and I think that was from my side so we still have time for a Q&A. Thank you. Any quick questions right now? Yeah. I don't see any hands but we are always happy if we are a bit short on time because yeah. It was my pleasure. Thank you. Next up is password strength meters. Good morning. We are here to talk about passwords and it's 2018 and we can say that passwords are here to stay and we're going to see them for a long time now and we also can admit that passwords actually can be quite good considering it's like a knowledge based single factor authentication mechanism but passwords are only quite good if we select suitable passwords and that brings us to the topic on how do we actually measure the strengths of passwords? This is a big topic. It's called password strength meters. There are a lot of them out there actually. There has been some progress in the hacking community in the academic community but there's still a lot of debate of what strength meter is actually good and what is to be considered good. I have two examples at the bottom. On the left hand side you can see Github and this is a password strength meter that starts out with like a policy that is displayed in red and as you start typing this policy is kind of validated and if you match the policy it's made green. On the right hand side we can see GMX. I tried to create an account yesterday for emails and I started typing a password like one of the simplest ones I could make up like one to eight digits and actually the meter made it quite green which is surprising that this is considered to be a strong password by GMX in 2018. Now we are trying to improve on that. So we are proposing a new password strength meter. We are planning to open source it like earlier next year and it's a phasologic based approach that combines multiple indicators for a password strength. So we can have like policy stuff in there like length and so on but we can also have like list of leak passwords we can have Levenstein distance and further combinations. It's supposed to be really lightweight so that it can be integrated in every browser and every website but it's only an approach and we have to make sure that it is really good and this is where my colleague Nikanta is going to ask for your help. So basically there are a lot of things you can use in a password strength meter but when we thought about ways to evaluate one we said oh we have a problem. You see in science a way to evaluate a hypothesis is to do an experiment and that's why we need you. So we are launching the password hiker contest with a goal of evaluating password strength by trying to break it and we want to crowdsource your knowledge to help build new better strength meters. What we did is we collected a list of human generated passwords from people we trust like our mothers etc. So no unfair competition there and this contains a mix of weaker and stronger passwords. We hashed them with a SHA 512 and with a common salt to reduce the overhead of expensive machinery for more hashing and what we want from you is to work in teams or alone use your favorite tools do whatever you like and try to break them. What we want at the end is the plain text which is the proof that the passwords were broken and a short report saying how you did it and which passwords were easier to break and which were more difficult to break. Of course we offer some amazing prizes like Amazon gift cards a lot of surprise swag like t-shirts polo shirts and so on I think but W500 which is the old IBM design so you can also use it as a brick Nerf guns and basically you can come at our office and take a lot of stuff that we don't need anymore we ship freely in a whole of Germany but we really like to see you at our office in Darmstadt so what you can do now is go on this address and there are instructions there there's a first batch of hashes and you can start hacking, yep thank you very much thank you next up would be netlink and go hello everyone good morning today I want to talk to you about netlink and go my name is Florian and I'm very interested in network stuff and if you take a look at the web servers around the world this is the kind of code you will see nowadays it's basically in this kind of example web server this is just showing your simple website and there's always one big question if you're in reliable service how many numbers of sessions do we have how long are the durations sessions and what about the number of amount of traffic that is transferred for your on your web service there are a couple solutions you can use and you can blow up the code completely and make it really hard to understand if you want to make sure that the next person you hire can also understand the business logic of your web server keep it simple and try to move the monitoring part away and there's one solution I can offer you in the moment we have the web server in the user space and the unix kernel in the kernel space and the kernel itself has some kind of tracking of sessions and why don't you use this kind of API so you can use this for monitoring there's the so called netlink family the netlink family there's a socket based interface for user space processes to communicate with the internal kernel API and you can get various information about different kind of stuff in total at the moment there are 21 different sub groups that are based on the netlink protocol for example there's netlink route netlink crypto where you can change crypto settings in kernel crypto settings of your computer there's also netlink xfrm for ipsec stuff se linux and a lot of stuff as I'm most interested in networking I concentrate on netlink and netfilter and there are divided into three parts basically and a flock and a queue and contract maybe if you work you heard of them and in goal you can now basically use this binary base protocol to directly communicate with the kernel get information out there get the number of sessions how long they take how long they last and just use this information that's already there and don't have to blow up your own code and it's completely in a separate way so you don't have to blow up your server and it can be done in a quite easy way the byte stream that you get from the kernel via the socket is basically only a byte stream in difference to most byte streams the combination is the length type and value type, length and value so there's a little bit different to most protocols you maybe know but it's basically all the same so you just have to take a look at the length check the type and then you have the value value can be anything, can be from byte sequences to strings, numbers integers, timestamps, everything what the kernel you can provide and for conversation, goaling has a lot of features so you don't have to make sure so for example if you want to monitor your replication this is a quite simple example with IP tables you send everything through nflog group 100 then you open the socket with nflog open in this example I set a timeout for 30 seconds just to make sure that this will stop at 30 seconds otherwise it will run forever and then you can get all the nflog messages so you have a quite good overview of what is happening on your web server and you don't have to change your web server application this also works for different kind of models if you for example provide your web server in Java if you do something like this or PHP so, thank you for your attention the most reliable information is the man page number 7, netlink you can try the github repo or check out the Linux kernel source if there are any questions I'm around just ping me I'm Florian and I'm happy to answer questions thank you thank you next up is the food hacking base again? hello everyone my name is Fraticek Algor Avplebek and I would like to present the food hacking base project this year it's our I think 7 congress when we are around we have been starting with 27c3 it was very interesting for us to get involved and during the years basically build up the community around food, beer and drinks I have to say that the last congress 34c3 when we actually were inside compared to 33c3 when we could see us on a roof over the whole age it was much better it was warmer, we had a warm water we have a big place where you could come and have fun I know how many of you have been visiting food hacking base during the years can I just ask for the hands up who has popped him also it's starting to get in we have been happy with the place a bit tight at the end of the congress I have to say when people finally found us but this year it got better we will go to that small overview of the year which we are just not finishing we have visited in the spring New Lagent this is the poster for the next year we have found out it is a project that actually when we are invited we can help promoting the project from the local host it really makes it possible to cover the expenses even for us we are donation based group so what we put in we put in if you support us good if you don't well we have to in Belgium which was fairly me run even where we didn't do actually crowdsourcing for a bigger kind of camp like that for us which we have found out it's difficult after to cover so experience another one I don't know how many of you have been at EMF it was my first one basically in Great Britain it was very nice we did kitchen free environment because getting our stuff from Europe to the UK was a bit complicated because of the transportation but it worked quite fine so it's good now this year we did the 35C3 that's where I am you can find us in the hall two between the door 2.6 2.7 as you can see this is already our first evening tasting and we are completely full so we have been actually really nice surprise with the amount of people who are showing up and also with the dynamic of the group I have to say it's really maybe like one of the first events when we as a core group don't have to do so much and people are actually doing the stuff they just come and use a place which is nice and just more keep an eye that things are magically appearing from the shops which has to be used so this is very nice now we will be finishing the congress I hope all goes well we hope to be a bit in a plus next year which are again community kind of based and open we would like to be at the camp of course that will be coordinated with the org where again we will do our tasting events workshop events beef jerky making incubators etc we would like to do fermentation project fermentation mobile which I already presented before which is basically you can imagine a food truck but thing which is legalized and can go to the different events where we can really kind of do workshops and stuff and I would say higher protected level so that is a project which I would like to lead and with support of the food king base otherwise I believe we are open to invitations so if you talk to us just send us email food king bit of org just you write food king base you will find us and you will get response eventually sooner or later and we are interested to come to different happenings we have been in MRMCD we have been in the balcony we have been in the news time so different events we enjoy it it's something what we like to do and promote and we hope that more people get involved and support these activities in their local hacker spaces because during the years I have to say and it's my experience, it's my feel that taking care about yourself from the point of the food, drinks a bit of exercise it really helps especially for most of you who are sitting most of the day behind the desk try to keep a bit healthy in this site it really makes your life more easy. I would like to thank all of you for listening to what I have to say please come and visit us at the food king base and that's all, thank you again, bye thank you next up is Gadaviz did I pronounce that correctly Gadaviz I don't know do you see hello, I'm here to present Gadaviz which is a research project for solving software engineering problems and three simple steps and these steps I'm going to present you so first step is we collect a lot of data about your software project this can be a lot of things we use jq assistant for that it provides a neo4j graph database and with a lot of plugins where you can combine and link different data sources currently we support five different programming languages two version control systems and many other data sources like github issues maven build reports, junit test reports and then at the result we have a huge database with a lot of information about the software project and then this is the data source for finding the solution to your problem and to help this we visualize the data there are a lot of visualizations available there are classical dashboards with 3 maps bar charts and all this classical stuff and more fancy visualizations on the right side and here for example you can see analysis for anti-pattern this is antler we find a lot of cyclic dependencies there for example and these visualizations are supposed to help you to understand your problem which is the last step because as you know understanding the problem is almost the same as having the solution once you understood the problem the rest is rather easy and for this we provide a complex user interface for exploring and analyzing the visualized data and get a better understanding of the software project in general that's the point where I usually would give you a live demo which is not possible here so you have to do it yourself that's the official bloodshed URL or just go to bit.ly where you find some showcases and online demos you can use in the browser yeah and that are the 3 steps give it a try if you are working with software in some way and but there's a 4th step you can contribute to it currently it's a small project with academic background but we hope to build an open source community around it so you can contribute to any programming language because we are going to extend it to support more data sources with JQ Assistant or more visualizations and a better user interface and as in 2018 we are going to apply for google's next year so in a month or so so if you are a student there's a chance you can even get paid for this yeah thank you thank you next up is Sigrock okay hello everyone my name is Sören and I would like to introduce you to our Sigrock project as you can see on the table here we try to support all kinds of devices especially everything kinds of test and measurement related like multimeters oscilloscope, logic analyzers all kinds of stuff we currently support over 200 devices and the question is how do we do that if you look at the software stack of our project you can see that the core component is LibSigrock it is a library that encapsulates all the drivers for all the devices we support and provides a unified API for all of them so you can access them having only one API to deal with and getting all the data from them below that you see LibUSB, LibSerialPort, LibFTDI1 and LibGPIB and these are the libraries that we need to actually access the hardware below on top you have the LibSigrock client that is the software actually tries to communicate with the devices and display the data process it in some way we will see in a minute what actually is going on there but next to it you see the LibSigrock decode library it's a library that is kind of on the side of LibSigrock it's providing protocol decoders which I will also talk about in a minute it's using Python and LibGLEEP the first client I would like to talk about is the obligatory command line interface it's usable for acquiring data, converting data decoding data essentially it's a very scriptable tool so you can do some kind of test automation or whatever you like to do with it another client we have is Sigrock Meter it is tailored for use of multimeters so you can have all kinds of multimeters and measure the data data log it whatever you want to do with it it is quite feature which already but currently needs a maintainer so if you feel interested please come to us and talk to us another client that is a relatively recent addition is SMU View it's a program that tries to emulate source measurement units using a power supply and electronic load I haven't used it personally but I have heard it's quite good so please give it a try a very even more recent addition is the Sigrock Miniserver it allows you to access all your devices supported through the Sigrock using adjacent interface for example here we can see node red and interface to provide access to a power supply and electronic load finally we have PulseView which is our most feature rich and also the most popular client that we have it is available for example for Linux Windows OS X and Android actually it's quite flexible in what we do with it and here you can see some standard setup you have two signals SCL SCA that have been acquired through some logic analyzer and we have added a protocol decoder for I2C to actually visualize the data in some kind of meaningful way but with this pretty standard you can do that with any oscilloscope really I understand that but what we do is actually we go one step further and actually allow you to have protocol decoders written in Python that you can use to make even more sense of the data that you have in this example we have attached a DS-13007 real-time clock so you can actually see what the data means to the chip that is in and out of the chip that is on the bus so this is pretty cool because essentially it allows you to have any oscilloscope that you have on your bench if you have a driver for it or any logic analyzer that you have to have all kinds of protocols that it doesn't usually support and we can have a driver for it and provide you with all the protocol decoders that you already have also what I would like to point out is that there is a Cyprus FX2 development board available for less than ten dollars or ten euro here in Europe which you can use in combination with Sigrock to actually have a ten euro logic analyzer which is quite feature rich and since we have currently over 100 protocols available you suddenly have all kinds of utilities available on your workbench for only ten euros so that's quite popular and also the reason why the Sigrock project is very popular in these kind of circles I would like to give you some examples of what exactly we have also it's RMETM as a decoder oh I have to speed up, okay which you can use to trace and have code this is USB also with pcap output and what it only take away is that we try to be a unicorn we do have lots of decoders and we can give you lots of opportunities if you want to contact us come to our assembly or come to Twitter Mastodon or just chat for some IRC thank you very much thank you so then next up is Datenkrake gefunden und nun it's going to be a German talk so you might want to check out the translation page on c3lingo.org translated streams Good morning I don't want to hear my English that's why I like to speak German my name is Alba Freute I'm a member and a reference for the International Treaty on Data Protection in Baden-Württemberg and I'm going to tell you a little bit about the topic of data protection one or the other might again and again with the analysis of a software a hardware, a website that you might not want for privacy reasons or similar you might ask is that allowed at all? Well, no, it's not allowed because data without important reasons or the use of the user is often due to the data protection many might have heard stories with sound shields that go through the media but there are many things where you can do something you can look at which software, which hardware have strange data transfer and see what's wrong for example we have a duty to ensure data security in Article 32 for example there is an explanation often it's like we also require explanations and we have the duty to privacy by design and privacy by default they come from Article 25 of the data protection for example we have in Baden-Württemberg the first budget in Germany was given to a company a few weeks ago it was about a company a user of a web service who saved the data in clear text and the password I don't need to tell you why this is bad they got a relatively small budget because they were very cooperative and also a relatively small company with bigger companies it can be relatively expensive in total at the DSGVO costs 20 million or 4% of the worldwide year budget unconnected data carrier or USB sticks or on notebooks would be something that you could guess or depending on the context you have to take a closer look at it but who regularly sends medical data via e-mail would also get problems tracking without permission or further use of data on 3rd like Facebook Custom Audiences is also according to the opinion of the right wing that the Bavarian colleagues have already made judgments before court what can you do somehow update your devices so that no data flows out but that only helps you and not the people who do not know so well but you can also complain about the respective authorities with the authorities that are responsible for the manufacturer or for the salesman or the other responsible as you call them who collects the data or the authorities on your home simply search according to the search machine of your least mistrust data protection authority Bundesland and then you will find it as said, high budget money can give up and the authorities must then also be involved so if we do things ourselves then we can be involved, then we do not necessarily do it but if you do a task we have to be involved but that can also be that we from Baden-Württemberg that then to Berlin, Hamburg or Schleswig-Holstein when the responsible is sitting there is important for such things what you have found what you have found as many details as possible in the authorities sitting in the meantime almost everywhere, good technicians who understand that, not only lawyers the technical teams are usually relatively small we are five people in Stuttgart, in Baden-Württemberg but still there are people who understand what you send there so also a TCP dump or something else what is now somehow the people a term exactly, sign language, as many details as possible you can also do it anonymously so if you for example not only analyze a third of the software but work at a company where you say it doesn't even matter what happens here and my bosses don't listen to me that this is not legal and you don't want to carry it on you can also do it anonymously as a whistleblower to the authorities and make an entry accordingly a small tip leave any contact possibility because often we have then back questions because not always everything is 100% clear from the complaints or entries yes, let's do it as a big red circle tonight there is still a self-organized session in room M3 between 18.30 and 20.00 there are several people who tell something about data protection I will also be there I have reported it and we'll see if there are any questions or if someone has any special problems, wishes or anything 18.30 room M3 tonight bye and on the first few slides I have some overview for the people who don't know it yet my name is Thomas and let's see so quick, the features of Borg backup it's a backup tool and you usually use it on the command line so it has a CLI interface like ours thing or like it or whatever but recently there were also some people working on the GUI so if you have non-nerdy friends that rather click around then you can also use it now we have quite good architecture and platform and file system support and the main features are we are doing deduplication we are doing compression authenticated encryption and the usual way you use it you read the data from a local amounted file system and then you store it to another local amounted file system or you can also store it to a remote server over SSH and the one Borg will talk to another Borg on the remote side a nice feature is you can fuse mount your repositories, your backup archives and okay, if you do not have a remote server it's no big problem, there are some service providers meanwhile that offer such services like for example oursing.net and the new one is Borgbase.com it has a quite nice web interface and the Borgbase guy is also programming this nice GUI client also if you don't want to rent a server you can just search for another nerd and you can do mutual backups, they are encrypted so you don't have a big trust issue because the other guy won't be able to look into your backup another way to use it if you rather prefer to have something in the cloud maybe additionally to your local repository you can first create a local repository and then push this complete repository to the cloud for example using RClone and of course if you have your own server you can just use SSH the GUI tool I mentioned is called Volta and it's implemented in Python and Qt currently it's tested on Linux and on macOS but it might be even possible in the future maybe to adapt it to Windows and as I said you can show it to your friends another tool is Borgmatic it's basically a configuration layer on top of Borg so if you prefer a config file like any style you can use this tool and there are lots of other tools and scripts and integrations and we have a special community repository and if you search additional tools you can just look there in general it's a community project so if you are coding in Python or C or Python join us please currently we are a bit low on developers but you can also help if you can't code for example look after the docs or just test it we have a good test suite and using continuous integration and for platform testing we use Vagrant also we need supporters for different platforms so if you for example use NetBSD or something also come to us the current status is there is an old stable release out since quite long I think you can find it in about every distribution and the currently release is 1.1 so this is the newest stuff and the next release maybe 2019 will mostly have code cleanups, refactoring and some internal stuff and also a new repository compaction handling it will be separate not automatic like now and for the bigger changes on the bottom for the Helium milestone we need more people because the crypto changes will be a lot of work and also the multithreading changes are a lot of work we also need community supporters so for example if you can help people because you use Borg yourself you can also help and look after GitHub and the mailing list a security review would be also good we have some known issues but also somebody could look over the code and we also need more sponsors and donations because we do bounties using bounty source so I'm here at the congress find me at python assembly and yeah I think we are out of time so you can click on the screencasts using that link okay thank you thank you so just a quick reminder all the slides that the speakers uploaded into our system you can download them just visit c3lt.de c3lt.de and there you can download the slides, visit the schedule and so on alright next up is tomb exam oh that was the browser that's why I prefer pdf so if you want to give a talk here you do best with pdf it's portable it's a document format okay let's go so first of all it's a pdf okay so my name is Stefan Günther I'm from the Technical University of Munich and I want to talk about how we are going to do a big test so let's take a look at our basic lecture, it's a duty event for all informatic bachelors students at TUM in 2015 we had 1,152 classes, that's in the last three years on almost 1,700 just because we have more students in 2015 we had 36 part-time jobs this year we had almost 30,000 students now we have shorter jobs that are easier to correct because we only have 1,200,000 this year we had 150,000 individual exams that we had to complete only the number of pages went back a bit on 23,000 pages that was because we used a shorter or more compact template this year we had another 5,000 pages so, how are we going to finish without getting crazy? since 2015 we have been working on a scanner clausure system called TUM-XM, we see the data with QR codes we can correct it because we don't have a name on the clausure, we scan the clausure and determine the ratings digitally and put the clausure online in order to be available if you are interested in how it works you can watch our lightning talk from 2015, we explain it now I want to briefly talk about what has been done since then until the end of 2015 we only used TUM-XM in our own teaching school, it changed first of all at friendly teaching schools we have changed from QR codes to data matrix codes simply because they are more robust and flexible we have implemented our clausure template in Latech we have implemented the database in Postgres, we have bought a document scanner document scanners would be our own lightning talk, the mechanics are great with the devices but the software is a total disaster since then we have our own platform for the online views since the end of 2016 we have developed a web interface for clausure processing and touch and pen input, we have integrated the so called carbfinger clausure concept, if you are interested it is linked at the end of the video it is a concept for particularly compact mathematics tests, we support quiz and multiple choice tests, we have between May and October 2017 over seven and a half clausures and quizzes in a little more than 20 events with the system developed, we have then also bought a real VM server since the end of 2017 we are also involved with the integration of full digital tests into the mix, we have implemented our own scanner front end because of the problem with the scanners our web interface is now finally usable at the beginning of the year, in the student work we have implemented an automatic synchronization with the single platform also a student work is currently involved with an iPad app for full digital testing we also support foreign clausure conditions that do not use our latex template and again today was a lightning talk if you are interested in the topic can come to the student assembly we have a bit of looking material we can just exchange a bit and if you are really interested maybe you can use it too thank you thank you next up is Irma I'll review my attributes there is a if you click the left I'm already supposed to click the link let's see what happens you have been owned ah ok that's a pdf right yeah it's a pdf you can also just maybe I can put it here ok ok I want to introduce Irma to you it's an open source project in which you can differently secure and decentrally provide authentication and signing so for the user the most central thing is the app that you see on the left side is from iOS and Android and the project is intended to authenticate and sign statements about yourself with attributes you collect your own mobile phone so for example you see a login to Irma Tube our demo application but there is also a few attributes from governments which you can collect and you can later prove that information to others in a way that they can be sure that the information is correct but also that those people don't learn anything about your interactions online that's the key difference between how authentication is done nowadays for example when you click a login with google or a login with facebook link at this moment you have a user identity provider and you want to login on a web store for example at this moment you first go to the web store that has a page that says I want to login with google so you go to the identity provider to google and then the identity provider reveals the login information to the web store so google now knows what you're doing and that probably isn't, maybe it's the problem if you want to order something but if you want to login in your doctor's office for example you don't want all those companies collecting that information so what we want to provide is a different solution is that you collect all the statements that allow you to login somewhere on your mobile phone so you first go to an identity provider you collect those statements then you reveal them to the web store without communicating with the identity provider anymore and you can do that again and again and you don't need to contact that identity provider again to do another login or do another authentication so the security guarantees we have is that the attributes, the information in the app that it is authentic it's signed with a digital signature it's well you can prove ownership you need to prove knowledge of the earmap pin so you need to fill in the pin code to say you have knowledge of that there's a secret key stored on your mobile phone that also says that you own those attributes so you have a two factor authentication the disclosures you do are also in another way unlinkable we use credentials an attribute based credential scheme called edmix which if you do two disclosures it makes it unlinkable so it's a multi show unlinkable credential scheme and that makes that as long as you have attributes that don't reveal anything about yourself for example if there's an attribute that says I'm over 18 or I'm a German citizen for example if you reveal those attributes to someone they can see that you're the same person two times so the attributes are not linkable as long as the attributes themselves are not identifiable and there's kind of automatic data minimization because you only reveal the attributes that you really need to the one who's who you're proving them to really needs to see so you only show relevant attributes and you need to give your consent if you want to hand in to so a typical session goes you go to the website of the Web Store here you scan a QR code or you click on a link the Irma app then opens it asks you hey this Web Store wants to know this and this information of you you then either consent or you don't and then go ahead prove those attributes without involving anyone except you and the one on the other side the Web Store in this case we also do signatures so there's also since the 90's it's always been a problem to give people access to proper signatures you have to create a public key infrastructure and people have to collect their own signature have to manage their private keys we also with this have attribute-based signatures so you collect those attributes for example your government numbers and you can sign any message you want so for example here I can share data with my doctor you can sign that statement with an attribute and then prove that you have retrieved that attribute from the government in this case so in the Netherlands we do this with and then you collect your information anyone can do this it's a decentral system there's some more information about this we're an open source project you can see on our GitHub the course in written in Go we're transitioning for the server part to Go as well it's a Java server at this moment you can see some more information if you want to join a Slack in which we communicate about this you can ask for an invite and well you can download the app please do so thank you last talk before the break it's going to be in German in German why we printed out wikibook for two years yes hello we wanted to print out parts of the internet and then tried it with a wikibook platform and as a result we have the most beautiful in print form wikibook in our hands the wikibook we chose is not freaks, does anyone know this? okay a few here we are already a bit overworked the design of our designer the goal is simply that you bring students the high school mathematics of course and to do that we use embedded media, pictures have this semantic content with definitions boxes and as you can see below we also embed videos this wikibook project belongs to serlo for some time this is another learning platform for gyms and also there is multimedia work and as you can see it's not only about the content of the teaching, but also to make this teaching available freely and to keep the organization transparent and democratic works the whole there are the user numbers right here 800.000 users for serlo and 110.000 for matt for not freaks and also the book was downloaded until 10.000 times the project serlo was originally in münchen but it spread in the last years over germany we are now the user group in dresden but also in berlin and münster you can find in between locations why we printed the wikibook you can imagine we want an alternative to conventional very expensive material the book is also in the library of lmo münchen the question is only why did we need two years for this we just have the wiki article by pandock and you already have the book it's not that easy on the one hand we have a lot of semantic marks which we are also very proud of we simply use the pandock because it can be seen differently for every target for example in pdf we want definitions or media different than in hdml for example on the other hand we also have more dependencies not only the article content here you can see this red dot in the middle that's the actual book and all the other dots are the dependencies this green dot are all in the media so mainly videos and pictures articles which are used in other articles and in this circle you can see parts of the you can see the article as they are in the file text then converted into a intermediate format then exported and then brought to the book the whole system is a system based on make which calls different rust tools at the moment it looks like this we have our wiki platform a parser creates a intermediate representation and from this we export the actual article and we also have a linter which our authors can give automatically thank rust can run the whole thing in the browser in the future we want to better combine these two platforms and then of course save some effort that's why the goal is to transfer the pages on the basis that we can then implement the linter and can add further export days ebooks would be very nice if we don't have so much potholz at the end if you want to come in contact with us or have any suggestions we are always very interested in suggestions for the development of the platform also in technical terms there is the e-mail address in general if you are interested in this export project or if you are in the vicinity of Dresden and if you are interested you can contact us otherwise you can also find us here at the congressman very often at the AGDSN assembly or just call us thank you thank you next up is open age and we already have the slides on the screen so we can just go ahead hi everyone we are a small part of the open age development team we are doing a free re-implementation of Age of Empires 2 I am Jonas and I am Michael so what we are doing we have been developing a free engine clone for Age of Empires 2 to converse expansion we started in 2013 and since then we have been doing it our game requires the original game assets so you have to own a copy of the original game but we have been writing a completely new engine with unlimited possibilities for modding and so on the original game engine is quite limited starting with the fact that it only runs on windows so it is a short overview of the technology which we are using the engine core is written in C++ but there is an extensive interface to call most of the engine features from Python 3 we are using Scython as glue and CMake, OpenGL Vulcan isn't even mentioned here SDRQT and we have our own data description language but more on that later so this is what it is currently looking like and in the last year we have had three main advancements VTech wrote a new renderer then we have got a new world simulation engine which is completely event driven which was done by Tomato with a new modding API which was designed by Heinersen all of those advancements are mostly in the background so there is little stuff which is actually visible which has changed in the last year but now we are ready to integrate everything together and basically finish the game so the new central component of the engine component based and this is the game entity which has abilities abilities are now in green and Bony Bony are things like the unit is standing on a hill and therefore has more attack damage and the abilities are permanent things an entity can do for example exist move, die, attack, whatever in practice in our own description language this in a simplified way is a villager that just exists with 25 HP and can move and die the definitions of move, die, attack are not here now but with that way it's possible that any entity can do everything and so trees for example can train new units or animals can convert villagers or relics can even start to chop wood if you like so this API overview here is the whole thing that is able to simulate Age of Empires 2 the green boxes are again all the abilities we have new things like actual inventory management so the monk transporting a relic is implemented properly and not a new unit that is a combination of the relic and the monk for example and our system supports non-linear attack trees so you have kind of arbitrary conditions chained together for advancements in discoveries for your technologies and this is implemented the following way so a technology is again just an entity and the entity the technology has the most important parameter the updates all at the bottom which is a set of patches patches are a special feature of our neon language that allow to change values on the fly in the database so in this case the update is on line 9 which is the more HP patch that updates villagers live by adding 15 new health points so whenever this technology is activated then the database is updated with the same trick we can do things like attack and defense so that for example ranged attacks and ranged armor are matched up and produce the correct amount of damage and we can do very complicated things like transforming the trebuchet into packed and unpacked and this whole thing is set into the event engine as I said which basically is a history of everything in the game in past and the future and what the engine what the client only does is play back that view so it's just a snapshot so next is funny new things like data conversions and that was it already join us and help us develop a cool thing thank you next up is crypto payments in hyper inflation countries and beyond hello everyone thanks for being here my name is Felix, I'm from the Dash MSC Thailand and for last couple of months we were very busy basically trying to bring cryptocurrencies from high level talk to street level reality and it's really a challenge and I want to share some experiences that you also experiences the other teams had on the example of Dash so cryptocurrencies basically have been the most famous use case since we talk about blockchain since we talk about bitcoin but still almost 10 years later nobody basically sees any option to pay with cryptocurrencies in the real world and it's really a challenge to do that you were always talking about the freedom of banking system at the same time so many cryptocurrencies and I just read a new study saying more than 60% of all these tokens are basically cryptocurrencies compared to any other utility token or something so for the example of Dash you can see quite a big increase of acceptances worldwide so we started with 500 this year and up to 4500 if you look at bitcoin numbers and all other currencies is not that much higher or even worse it's very hard to get good statistics because there are some maps you can register your company if you accept bitcoins or whatever other currency but it's not really that you can go anywhere and get a proper number of how many cryptocurrencies acceptances are in the world so for Dash especially Venezuela turned out to be use case number one if you look at it it makes total sense Venezuela has an inflation rate of 1.4 million percent for this year so people are really struggling if you go in the morning buy some eggs you need some money if you go in the evening you need quite much more money so Dash managed to get really a growing and healthy ecosystem in Venezuela so that we can basically say if you have a hyperinflation country cryptocurrency is a fabulous use case we have Venezuela, we have Turkey we have some countries in Africa there's more and more countries coming up where this totally makes sense but of course for me from business perspective would be very sad to say we focus only on the hyperinflation countries we want to go beyond that of course you have to have everything in place, you have to have the regulators you have to have taxes, you have to pay your taxes you have to do everything and if you talk to merchants and that's especially the point you will find out and the most important thing they don't really care for cryptocurrencies what they care for is a simple solution which fits into their business process and they don't want to have any investment for additional software, for additional hardware for additional stuff training so that's why we go to the merchants we try to really understand what they want and how we can help them setting up a system and afterwards also giving support to them for their questions because if you start with crypto payments and you really go to the street level there will be more and more things and questions popping up from taxes to regulations to how to integrate it into POS systems so there's many many things and it's ongoing questions one other thing is we started with the low hanging fruits for us in Thailand going to every single bitcoin shop there who claims to accept bitcoin on the door just realizing everybody just forgot it so we went into these stores and people look at it and say be what they don't even know what bitcoin was because the stuff in there they forgot it already a long time so that's why I say it's really important to give them ongoing support and to help them basically solve a problem and the biggest problem they have is they want to make business this is what they really care for they want to sell their products and get more customers and at the end of the day they want to get happy customers because happy customers will come back in their stores so that's why our approach for the example of Thailand and also Venezuela is going a bit in that direction is growing healthy ecosystems that means you have to have the whole set of things together one thing is the exchanges you have to get your money back you have to manage a cash flow as a merchant so basically you have to choose do I want to keep my cryptocurrency for speculative reasons or will I sell it instantly when I get it you have to have the payment providers of course you have to pay your taxes at the end of the day just the one side and the other side is the customers coming in you need a community coming and paying with that stuff only hodling is really not paying with it so you need people who come in the stores help and all that so at the end of the day it all boils down to sustainable ecosystems thank you I'm here for questions next up is Balkkon good morning I'm Jelena from Balkkon Orga team I'm here to present our conference small hacking event that's happening in Serbia Novi Sad so for the next year it will be the seventh time that we organize this event it's Balkkon computer congress the dates are already set up so it will be second week in September 14, 14, 15 September Novi Sad so remember it what exactly is Balkkon we got an idea 10 years ago on CCC to start organizing small conference in Serbia because there is a lot of students in Novi Sad there is a big technical university we wanted to share with them this experience that we have here and we want to introduce the young people from that Balkkon region with the hacking culture so that's the reason why we started organizing this and now it starts to be an annual event we are doing what we are saying just for fun because we have a lot of fun there so we are inviting you to join us next year if you weren't there so this is the important dates the place is Novi Sad Serbia and the CFP will be open from February somewhere and the complete list of speakers will be somewhere end of July and yes we also have the CTF we are organizing every year so if you are not able to come you can also join playing the CTFs and have fun with us and who was this year's with us we got some also famous speakers Travis Goodspeed was couple of times on Balkkon virus from US Mitch Altman was there also with soldiering Mo then Rob from US so there is a long list so if you are interesting what we are doing previous years you can also check our website and also complete archive with the videos that you can watch so that you know how it looks like and what's important yes we have there a lot of fun we have some let's say that's tradition on second day in the evening we have rakia tasting or rakia leaks so if you don't know what rakia I want to try different sorts of rakia you are welcome to come also if you want to try here rakia on our Balkkon assembly you can come and try it just in advance to be prepared what you can expect so I'm just informing you so Balkkon why Novi Sad it's our hometown so we started organizing there but Novi Sad is on the list of Lonely Planet I think somewhere in the top 10 to visit next year so 30 cheap food is very good incredible you can ask other people who already visit us how it's food and how it's cheap accommodation and the travel it's very easy to come because it's only one hour from belgrade airport so it's very easy it's over 3 hours from budapest so you can choose it if you have questions what we are doing and why we are doing that you can also send us in email we are responding very quickly and you can also visit our website or you can track it us on the twitter also here on Balkkon assembly here near in the Kavsvesh hall you can find us grab some stickers we have some cool stickers also this year and also some flyers so you can come or you can just talk to see what we have also what we have we try to bring there also hacking community to build the community we also have hacking space area so if you are from some hacker spaces you can organize also some assembly so it will be nice to join us because we also have some blinking stuff we want to bring it more and more to make it more shiny so remember next September 13, 14, 15 please come and join us to have a lot of fun thank you now next up is exploiting WPSPBC on windows 10 all right hi guys my name is George I am the author of wifi fissure wifi fissure is an open source rogue access point framework so today we are going to talk about exploiting WPSPBC on windows 10 this is a wifi association attack please raise your hands okay I see some hands so karma is a very popular association technique what it basically does is getting money in the middle for the attacker but there are others in this talk we are going to talk about one attack by exploiting WPSPBC that actually achieves the same result money in the middle over wifi so WPSPBC I guess most of you already know it it's a feature that allows you to associate a device with an access point very easily just by pushing a button on the access point side and then another button on the device side it doesn't matter the order right you can push the device first and then you can push the button on the access point later but you need to do that within 120 seconds so no other authentication mechanism in place this is how WPSPBC works so you see this is the station it could be a laptop, it could be a mobile device you push a virtual button there then within 120 seconds you need to push the button on the access point and these two the association happens and the station is now connected to the access point, what's the problem here the problem is that someone can push the button faster than the operator of the access point so it will achieve the money in the middle position because the station will connect to the rogue access point instead so this is the way to achieve a money in the middle attack over WPSPBC in order for this to happen of course the victim needs to push the virtual button on his station the thing is that even if you don't use WPSPBC actively you are still vulnerable on Windows 10 and let's see why this happens the problem with Windows 10 is that if you select a WPS network then you automatically the Windows 10 pushes the WPSPBC virtual button for you even if you are not actively using it you are eventually so this is actually usability over security feature that Microsoft introduced for another usability over security feature which is WPSPBC how can we exploit this first I will show four steps right so the first step is that let's say that the victim is connected to a WPA2 network we don't do nothing here everything the victim is happy of course the victim uses a Windows 10 laptop so what we are going to do first is disconnect the victim from the network we can do that via common methods we can craft the authentication frames for example we can leverage jamming techniques there are many ways to do that so we want to disconnect the victim from the network that is currently connected to we do that the victim we expect the victim to manually click on the network to re-establish the lost connection but at the same time we advertise the same network same SSID with a random password if it's a WPA2 password but this time we also offer WPSPBC capabilities so can you guess what will happen the victim will click on the network and the virtual WPS button will get pushed from his side so what we need to do now we simply press the button from our side as well and the victim will eventually connect to our rogue access point the victim will probably have the impression of the auto connect feature do you know the auto connect feature is the feature where you go back to work and you see that your device is connected automatically to the network even if you had connected to it like a week ago this is the auto connect feature so that it will give the impression to the victim that it was connected because of this feature so what is funny about this is that the network can be closed it will have the same SSID it will be WPA2 protected you will just click on the network that you want to connect but still you will connect to a different one and again the problem here is that Microsoft has let's say tied clicking on a network with pushing the WPSPBC button on the client side this hasn't been disclosed before it's the first time that I'm disclosing this and you can do this attack by using the latest version of Wi-Fi Fissure we're going to push an update soon so you will be able to do this attack for your penetration testing thank you very much thank you now next up is human connection free and open source social network for active citizenship ok hello everyone my name is Robert I'm one of the developers of human connection which is free and open source social network for active citizenship now I want to highlight a problem let's say you are a user of social network for example Facebook, Twitter, YouTube and you use the social network as a primary source of information then you are not in control of your newsfeed anymore why? Facebook, YouTube are private companies the source code is closed source and the algorithm determines what information you will see, what content you see if they run ads also what ads you see and that's why I demand that social networks should be free and open source software the definition of free software the users control the program non free software is if the program controls the user that is the case for Facebook, YouTube and Twitter therefore we are developing a free and open source social network which is funded by donations and we are almost sustainable we need 30k per month for a team of 10 people and I'm showing you this chart because I want to show that this works this market let's say for donation funded software also I want to highlight that free software is it is very important that free software is funded by donations why? Facebook and YouTube have their advertising customers and they will probably implement features that are not in the interest of the users right? free software is community driven and since the users control the program features should always be in line with the interest of the user so Facebook will show you ads that's definitely not in your interest Facebook will collect your data that's also not in your interest whereas free software will not do that human connection is free and open source software we will not show you any ads and also we will not collecting your data or if you do, we do it on a certain purpose and you can see our open source code on github and see how it works so we are currently in a technology transition you can check out our current staging environment it's called Nitro you can see a link on the right side you can also see the login credentials on the right side you can go there right now and try it out since we are in a technology transition I will tell you what we are using for this version we are using Vue.js in the frontend and we are using Node.js on the backend side both parties communicate through GraphQL as an interface and on the backend side we are using Neo4j as the primary database the primary version we have 4000 users and 2300 of them are active donators yes and probably you have heard about similar initiatives like that you probably know Mastodon you probably know Diaspora and there are many more and we want to collaborate with these there is good news there is a W3C standard which is called ActivityPub it's like a language how different social networks can communicate with each other that is they can exchange content and from the user perspective it doesn't really matter which social network you should join well that's the dream and we are not implementing it yet but we are intended to do so and we have bi-weekly meetings social networks including Comonecte we change and even NexCloud they all are interested in implementing ActivityPub and we are trying to learn get familiar with it and eventually implement it if you want you can join us use the chat for our let's say we call it the open apps ecosystem the network of the networks and we are also having a weekly meeting for the open source community that's linked on the right side we have weekly meetings and we try our best to onboard open source contributors we do peer programming we do video conferences feel free to join us that's all I have, thank you very much thank you next up is iOS Privacy Hi so quickly a few words about me who I am I am both the Apple guy at Surrogate's security company and I am also an activist and politician and things like refugees and trying to save a forest for a mean environment for a mean energy company so I built a sample app called my privacy where I am going into it's a very simple app where I am showing you different stuff that are important on iOS and that developers should do and that user should also look at the BI location and surprisingly enough Siri I was surprised the first time that I was researching on this because Siri turns out to be something that was appearing by default for every app so it's default, it's opt out and the app isn't setting Siri but in the Syrian search it's not always in the settings app it's a little bit confusing and it says as you can see over there in the screenshot it says that it may learn, it makes sense based on how you use the app I was wondering what it actually means that's basically what they mean is a shortcut to accessions which is a good thing but at the same time also kind of a pain as a user the most of the stuff actually all the stuff of Siri is on device so it's good to know the speak to text now is not on device so that's something you should know all the stuff on iOS in terms of privacy is that it all goes through a set of permissions you get for the photos it's kind of the same as for the events or the contacts it's a lot of time just an enum which gives you if it's authorized, denied or if it's not yet asked, if it's restricted you are the luck because it's mean it's either parental settings or something else in an enterprise the app will crash luckily if you haven't done this which is adding what's called a description, a usage description this is something which is going to be shown to the user, this is just to visualize your photos on the map and it's also going to be checked by Apple it should be checked at least in the review process that you are telling to your users what you are actually doing with it so please tell the users what you are actually doing with it and don't lie on your users what you are doing with the photos which are basically in your info peel list they all start with privacy and you have to explain whatever you are going to do with calendars or Bluetooth or whatever you can also ask again that's something good to know by calling this URL which is basically the open settings URL string it's not going to pop up the permission settings anymore but it's going to be the user is going to be able to enter the privacy over there so you have to always check the authorization status obviously and there are ways that you can retrieve data for example from a metadata for if you get for example the location over there so this is going way too fast please use the pickers, that's very important because if you don't use the pickers then people will have to have access to the full thing so if you want to be a good developer please only pick up a set of data and don't take everything else because that's what a bad developer would do and that's take a lot of information that's why the ugly developer would do take all the information for all the server uploaded on the thing so please don't be that guy have a good karma and just also you don't need to ask the permissions if you want to try as well where you can only have one of the pickers also the contacts have a location even if they don't have a latitude longitude because if they have a postal address you can retrieve this so with like geocoding so this is something to know you can also the other thing that I wanted you to know is that the location API is interesting because MapKits already knows where I am allow them to tell him you might think it's because of region settings but it's not, it's most probably the IP address I would prefer if they actually ask me before they centralize this map on where I am on the location API when you request the authorization you have to use, when in use or always please do not directly ask the full Monty ask first this and then you would be able to avoid this guy because the second time you ask you will have only this and that's basically I'm running out of time there is something on the calendars which is taking all this thing if you want to know more about this just get in touch with me I will be happy to show you this thank you for this anime slideshow nice right next up is tree area network hello my name is Ingo I wanted to share an experiment with you I did earlier this year it's called Tan Tree Area Network and when I put up this presentation I basically said well it's actually a bunch of holiday images to share with you but before I do that what is capacitive coupling that is the technique to transmit or transfer information through capacitive coupling which means you have information you go into something you encoded you amplify that you send it into biological conductor like a human being human being is a very good conductor like a capacitor it has very low resistance internally and a skin which is high resistance so it does capacitive coupling to another part of the body or another body then you can take this information out and decode it and get the information back that works with humans that also works with plants what I did at the Dynacon Digital Naturalist Conference in 2018 in Phuket in Thailand is I wanted to try out capacitive coupling devices I built for e-textiles in the first case but the experiment was to use it on trees and if possible to use it to send information from one tree to another and then use the jungle as a network and send one bit of information from one side of the jungle to the other side of the jungle so I wanted to try it out if it works at all that was the first experiment I just stuck this capacitive plates on some plants and you see my face it didn't really work I don't know if you see the oscilloscope it's picked up very very low signals that was the second attempt I wrapped around capacitive like the electrode around the tree and it worked much better you see that in the signal picked up very good signal so I can decode information again what could I do I could transmit data for 5.4 meters from one tree to the bottom of the tree that is how the schematics looks like the transmitter is a simple resonant circuit transmitting a carrier wave of 300 kHz basic radio stuff amplifying and filtering that is how it looks on a tree left is the transmitter with a sensor it transmits the data over the tree picked up by another part of the tree on the right side and sent to a computer the data is sent over serial to a computer to read out that's some details what the implementation can do a simple moment on off-keying the next step was the costume tan tree area network for tree huggers so how do we pick up information from trees we can hack the tree it does capacitive couple from the tree to the human body we can then get the data out of the human body and that's what we did we decoded information we don't understand what it says so the scientist is reading the signal from the probe from the human probe getting the data from the tree right so if you want to try that out yourself everything is up on github and on my web page try it out have fun thank you very much thank you next up is new linux improved yeah hello my name is zem or hans and as you have seen two talks ago it is very hard to make the security right in ios and linux is not the problem here because all the features aren't there exactly so and i think that is wrong in 2018 os should be able to restrict applications from modifying each others data and restrict applications from spying the users habits so yeah situation is that all applications have the same permissions usb drivers are fetched automatically xorg is a whole security nightmare and processes can read any data in home user and also there are interfaces that doesn't need to be exposed to each application you are running so there are a few developments we always have the ability to make unix politics users groups we have up armor we have se linux we have kvm we have namespaces we have usb guard docker xpra there are some linux distribution projects like kubes os sub graph os which are trying to improve the security as well so i have still some questions left for example do you remember that there is a policy in debian that there has to be a man page for every unix command on the system so also why do we still have xtm why do we have those graphical display managers it doesn't make sense to have a graphical display manager if you don't have to switch the display resolution in the display manager and that's the case with new valent and new frame buffers so the kernel already runs at a reasonably display resolution so we don't have to do this for a proper lock-in so also there are things in the linux world so why do i have to become an expert to get a gnupeg key layout i mean this is an application thing but reasonably why do i have to be an expert to get an authentication key so i would like to make a fresh start by creating a small but functional base system that actually boots up without taking resources from stash usr like most like the freebsd things are doing adding an up armor profile add a package manager that can be used to install apps create a quick and dirty installer push the thing on a separate githlab instance for bug tracking and building and i would like to discuss those ideas with you so let us meet at 11.30 today in lecture room m1 you see i have a few bugs in my slides i also have i have created an improved matrix channel 35c3 linux improved where you can meet me there will be an email address linux improved at fnordpol.de where you can contact me and you can meet me at the meta lab in vienna if you want to discuss details i think that's it thank you next up is navigating in linux kernel security area hello my name is alexander popov i'm the linux kernel developer and security researcher and i want to tell you about navigating in the linux kernel security area linux kernel security is a very complex area there are key concepts there there are vulnerability classes exploitation techniques bug detection means and various defenses some of them are in the linux kernel mainline some of them are still out of tree some of them are commercial some defensive technologists need special hardware to work and all these items have complex relations between each other and it would be really great to have some graphical representation to navigate for easier navigation in the documentation so i created such a map it is available at the github it operates the key concepts which i already described and the connection between nodes represents some kind of relation this map is about the linux kernel self protection it is not about cutting attack surface so this is a map it is very complex i guess you can't see anything but i want to show some part of it so there are those are vulnerability classes stack depth overflow initialized variables usage information exposure we have cwe common witness enumeration numbers for easier search and there is a pecs memory stackleague feature from jar security which provides some mitigations against those kinds of attacks against those kinds of vulnerabilities and there is a stackleague port which i prepared for the linux kernel mainline to kernel 4.20 and there is a game send debugging mechanism it is not for protecting you in production it is for debugging and we can combine such technologies enable them and fuzz the kernel to find the bugs and zero days and i really hope you are interested and i encourage you to experiment with your kernel and read those information there is a really nice list of jar security features there is a linux kernel security documentation in the mainline which is a really nice document describing the whole picture of linux kernel security which tasks do we have we need to achieve there is a list of recommended kernel settings from kernel self-protection project if you enable them your kernel can be more secure and there is a mitigation checklist which shows the current progress in upstreaming jar security features into linux kernel mainline and to android open source project then it is really not very funny to search in your config file for the hardening options enabling them and so on so let's computers do their job and i created a script which can check your kernel config file against the hardening recommendations and you can just run it with your config file see the recommendations and then go to the map and see where in the documentation you should read about this particular feature so thanks for your attention you can catch me here at the congress you can write me emails linux kernel developers really like plain text emails and the main point enjoy the congress thank you next up is past the cookie and pivot to the cloud hello everybody my name is Johan i'm a security engineer and professional penetration tester and today i want to talk about past the cookie which is a technique but i think we need to talk more about this to protect infrastructure better so what are cookies? i think we don't have to talk about that much everybody knows about cookies they're used for security, for authentication establishing a session between a client and a web server and it usually is a single key to the kingdom which means if you steal the cookie then you get access to the web application there was a lot of talk about four or five years ago with fire sheep that was really really good the industry stepped up and we kind of deployed SSL much more widely which is very very good everybody should use that but what i want to talk about now is other techniques somebody might deploy or leverage to steal your authentication cookies so think about it a cookie might be the single key who here uses AWS or Microsoft Azure a cookie might be the single key to your entire virtual data center so if you have a data center or a building you imagine right the cookie is the key to that building or personally if you have cryptocurrency or finances right or facebook the cookie might be the authentication token to get an attacker in so what is past the cookie so if you can tell it's very much similar if you're familiar with past the hash it's the same concept you have the token you pass it and you pivot through the environment so there might be after valuable assets valuable hosts in your infrastructure where there might be powerful cookies available and as I said I've used this many many times during adversarial emulation to achieve mission objective so how can you kind of gather the cookie in the first place so past the cookie is sort of a post exploitation technique which means the host that we talk about is already compromised phishing attack there's a b-chat established in the organization in the company and then the adversary starts pivoting through the environment maybe even compromise the domain controller so at that point they have full capabilities within the company but they still have not pivoted what I call pivot to the cloud so now you can go find an administrator of the subscription or the AWS account compromise that machine and then they can pass the cookie they steal the cookie some of these techniques here and then pass the cookie to pivot to the cloud infrastructure the one thing I want to point out here is process dump which is sort of a very very simple tool but cookies are not just stored in processes of browsers right or the disk from a browser perspective cookies you can also find them in other applications that do authentication so somebody might use process dump to kind of dump all the processes in the machine and look for cookies and then how do you pass the cookie in the past like four or five years ago you had to install some extensions and so on now it's really simple you use the developer console you just go in the consoles and set the cookie or there's even UI like Chrome has a nice UI to set the cookie I want to point out cookie crimes right now I work at a place where we have a lot of mechs so I had to look for techniques on how to do this on a mech and there's great research done and there's something called cookie crimes you can use Chrome to allow you to steal the cookies so here's a simple example how you might compromise get up you go to the web page refresh there's no cookies you're not authenticated there's a single cookie called user session you paste it in refresh the page and you're logged in and now let's move this to the cloud this is sort of really what I want to kind of highlight is for Google cloud compute for instance another like one of the three big cloud infrastructure providers an adversary might have stole compromised the administrator and then they steal the cookie and put it into the cloud so sort of a three step process sort of part of my own work I started building out this cheat sheet for myself so I thought I shared which kind of cookies you might be interested in depending on the client you work with and always make sure that you have authorization for any of this kind of work that's sort of something I've put it in the very beginning as well so here you can see a sample of interesting web pages and the cookies that you can steal or that somebody might steal an adversary might steal to authenticate and simulate a breach talking about detections there's things that we kind of have to do is like monitor for process dumps monitor for access anomalies monitor for unusual activity on websites and I want to move forward and talk about mitigations also right deleting cookies on the machine regularly is very important delete the session cookies right this is one thing I want to highlight if you are not the only administrator on your machine it is not your machine anything on it belongs to anybody else or any other administrator on the machine also that is very very important especially if you work in a company that brings you company laptop to perform work thank you thank you next up is more on drugs hello the full title of the talk is war on drugs undoing 50 years of fake news and propaganda you need to decide for yourself what do you want to do what is your core set of values and me personally I am pro choice, freedom and education there are many different scientific research this is about the fat and sugar the sugar industry blamed fat you eat fat you become fat but this is not true you need to provide fat to your body because it is part of a healthy balanced diet this is the cigarette advertisement from 50 years ago of course your doctor smoke camels the Marlboro guy who was advertising cigarettes he died from lung cancer and this is probably one of the most important quotes 50 years ago Nixon presidential election and basically you cannot make illegal to be against war so what they did to keep the war in Vietnam going they criminalized drugs the war on drugs is a direct consequence of war in Vietnam they couldn't keep up with the peace movements so they had to find a way to put them into prison then we have a private prison system the moment you make money from putting people into prison you are incentivized to keep the system going and this is basically a vicious circle it is a complete bullshit and I encourage you to just think follow the money if you do not know what's going on just follow the money all these pervert incentives create a situation when judges are bribed by the prison system to put children into jail however now we have a little change in the law because of the internet internet allows us to communicate freely this is the legal map of cannabis in the US in many states cannabis is legal or legal for international purposes it is changing rapidly the human perception is also changing in the United Kingdom the medical cannabis was legalized 1st of November in Mexico it is also changing in South Africa it is changing it is pretty much becoming legal so this is just the cannabis this is about the business model of the industry they get money if you are hooked on their legal drugs and they don't have incentives to use the drugs that are actually helping people this is the ketamine that is testing for depression MDMA for PTSD psilocybin for people who have terminal diseases and they know they will die but using psychedelic it allows them to become more okay with death like okay I am dying but this is only my body my soul will survive so it is they are reducing their anxiety and this is like a second level research that we already know that psilocybin is effective so now we are testing which type of music for this type of treatment so this playlist is amazing highly recommended and T this is a metaphor that we have the telescope to look into the stars we have the microscope to look into a very very small object but we are still looking for the microscope for the brain so here it is an example of a scientific research of scanning the brain various connections in the brain here is the wiki with a self-medication psychedelic retreats and this is probably if you want to stay connected psychedelic.community you can meet with like-minded people you can learn more and always do your own research thank you, thank you, thank you thank you now the next talk is not going to be a talk but rather an experiment and one of the rare occasions where we surrender our hardware to someone else this is the last event in this session so if you are not comfortable with any of this you can just leave without missing out on anything I don't know I just go away and let them do their work thanks so big round of applause for these guys and that's the end of our session today thank you for being here, thanks to all the speakers who participated and big round of applause for everybody who stood on the stage here also big round of applause for the translation team who did an awesome job translating the live talks