< Back to JetLib.com

talk

« Expand/Collapse

174 items tagged "talk"

December 28, 2012
20:53
Google Talk Decoder
» ‎ Packet Storm Security Recent Files

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords
20:53
Google Talk Decoder
» ‎ Packet Storm Security Recent Files

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords

20:53
Google Talk Decoder
» ‎ Packet Storm Security Tools

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords
20:53
Google Talk Decoder
» ‎ Packet Storm Security Tools

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords

20:53
Google Talk Decoder
» ‎ Packet Storm Security Misc. Files

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords
20:53
Google Talk Decoder
» ‎ Packet Storm Security Misc. Files

Google Talk decoder tool that demonstrates recovering passwords from accounts.
Tags: decoder google talk recovering-passwords

November 20, 2012
15:33
[Audio] Mark Will Talk About Hacking Cellular Phones
» ‎ SecDocs

Authors: Mark Lottor
Tags: phone
Event: DEFCON 2

Tags: audio talk hacking mark-lottor mark-will cellular-phones
October 17, 2012
21:56
[Video] Practical Win32 and UNICODE exploitation
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: Windows exploiting
Event: Chaos Communication Congress 20th (20C3) 2003
Abstract: The talk could also be called "Lessons learned when the Cisco guys went to Windows land", because there are a number of things quite different in Windows land compared to other environments. One of these things is the frequent use of wide characters and the annoying difficulties that arise from that, including return addresses of 0x00410041. Technically, the speech covers stack based buffer overflows in Win32 applications and services where the buffer content consists of wide characters. Techniques for finding return addresses as well as practical wide character shellcodes (so-called venetian shell code) will be discussed. There will also be some side notes on ASCII based overflows and format string vulnerabilities. This talk is to provide the intermediate hacker with a few more usefull tricks for her/his sleeve, so don't expect any TESO-like magic. Of course, Phenoelit would not dare to show up without some entertaining examples of software engineering, this time comming from Walldorf/Germany.
Tags: talk win windows felix germany chaos-communication-congress time-comming walldorf-germany
10:40
[Audio] Practical Win32 and UNICODE exploitation
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: Windows exploiting
Event: Chaos Communication Congress 20th (20C3) 2003
Abstract: The talk could also be called "Lessons learned when the Cisco guys went to Windows land", because there are a number of things quite different in Windows land compared to other environments. One of these things is the frequent use of wide characters and the annoying difficulties that arise from that, including return addresses of 0x00410041. Technically, the speech covers stack based buffer overflows in Win32 applications and services where the buffer content consists of wide characters. Techniques for finding return addresses as well as practical wide character shellcodes (so-called venetian shell code) will be discussed. There will also be some side notes on ASCII based overflows and format string vulnerabilities. This talk is to provide the intermediate hacker with a few more usefull tricks for her/his sleeve, so don't expect any TESO-like magic. Of course, Phenoelit would not dare to show up without some entertaining examples of software engineering, this time comming from Walldorf/Germany.
Tags: talk win windows felix germany chaos-communication-congress time-comming walldorf-germany
October 13, 2012
21:29
[Paper] Inglourious Hackerds: Targeting Web Clients
» ‎ SecDocs

Authors: Laurent Oudot
Tags: web application
Event: Black Hat DC 2011
Abstract: This talk will propose to look at technical security issues related to multiple Internet Web Clients. While such tools are used to crawl the Net and retrieve information, there might exist many scenarios where evil attackers can abuse them. By studying the protocols (HTTP, etc), and by doing some kind of fuzzing operations, we will show how TEHTRI-Security was able to find multiple security issues on many handled devices and workstations. The offensive concepts explained during this talk, will show many different tricks, like how evil attackers can become anonymous and create cover channels based on web clients, or like how to own or crash most famous current web clients and devices.
Tags: talk security web laurent-oudot web-clients technical-security
21:29
[Slides] Inglourious Hackerds: Targeting Web Clients
» ‎ SecDocs

Authors: Laurent Oudot
Tags: web application
Event: Black Hat DC 2011
Abstract: This talk will propose to look at technical security issues related to multiple Internet Web Clients. While such tools are used to crawl the Net and retrieve information, there might exist many scenarios where evil attackers can abuse them. By studying the protocols (HTTP, etc), and by doing some kind of fuzzing operations, we will show how TEHTRI-Security was able to find multiple security issues on many handled devices and workstations. The offensive concepts explained during this talk, will show many different tricks, like how evil attackers can become anonymous and create cover channels based on web clients, or like how to own or crash most famous current web clients and devices.
Tags: talk security web laurent-oudot web-clients technical-security
October 11, 2012
9:44
[Video] How To Herd Cats
» ‎ SecDocs

Tags: social
Event: Chaos Communication Congress 21th (21C3) 2004
Abstract: Any goal-oriented group has to deal with workflow issues, but with capable, creative people this can often be a larger challenge then completing the goal. This talk will attempt to draw the line between management, tools, and communication in dealing with volunteer or professional workgroups. In terms of technique I will cover dialogue, debate, team management, hierarchies, and defining goals to determine necessary milestones/techniques. In terms of tools we will look at CVS, ticket systems, e-mail/instant mesaaging/IRC, and wikis for centralized data retrieval. In terms of scenarios there will be two major sections, goal oriented development/teams, and general research groups. In the first category would be open source development teams, CTF teams, and IT departments. In the second category would be meeting groups (CCC, 2600). Every section of this talk allows for a lot of expansion so the Q&A should be excellent. This talk will especially appeal to project managers, IT directors, educators, and involved hackers. Often the lack of social skills on the part of members of a team can destroy a project, this talk is meant to objectively analyze these weaknesses and suggest practical systems that allow people to work, learn, and even play together nicely.
Tags: talk goal communication chaos-communication-congress open-source-development workflow-issues
9:44
[Audio] How To Herd Cats
» ‎ SecDocs

Tags: social
Event: Chaos Communication Congress 21th (21C3) 2004
Abstract: Any goal-oriented group has to deal with workflow issues, but with capable, creative people this can often be a larger challenge then completing the goal. This talk will attempt to draw the line between management, tools, and communication in dealing with volunteer or professional workgroups. In terms of technique I will cover dialogue, debate, team management, hierarchies, and defining goals to determine necessary milestones/techniques. In terms of tools we will look at CVS, ticket systems, e-mail/instant mesaaging/IRC, and wikis for centralized data retrieval. In terms of scenarios there will be two major sections, goal oriented development/teams, and general research groups. In the first category would be open source development teams, CTF teams, and IT departments. In the second category would be meeting groups (CCC, 2600). Every section of this talk allows for a lot of expansion so the Q&A should be excellent. This talk will especially appeal to project managers, IT directors, educators, and involved hackers. Often the lack of social skills on the part of members of a team can destroy a project, this talk is meant to objectively analyze these weaknesses and suggest practical systems that allow people to work, learn, and even play together nicely.
Tags: talk goal communication chaos-communication-congress open-source-development workflow-issues
September 27, 2012
21:28
[Video] 22C3 Network Review
» ‎ SecDocs

Authors: Sebastian Werner Stefan Wahl
Tags: network
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: An Introduction into the structure and design of the congress network - featuring a description of hardware setup and focusing on the uplink to the internet. Building a high-demand network in less than 72hrs is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before congress doors open. 22c3 network concept is based on the experiences of the last two congresses and tries to solve some problems that arised on 21c3. So this talk will show you, why network is the way it is. Focus of this talk is wired network from access layer to the backbone and our upstream routers. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile
21:28
[Slides] 22C3 Network Review
» ‎ SecDocs

Authors: Sebastian Werner Stefan Wahl
Tags: network
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: An Introduction into the structure and design of the congress network - featuring a description of hardware setup and focusing on the uplink to the internet. Building a high-demand network in less than 72hrs is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before congress doors open. 22c3 network concept is based on the experiences of the last two congresses and tries to solve some problems that arised on 21c3. So this talk will show you, why network is the way it is. Focus of this talk is wired network from access layer to the backbone and our upstream routers. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile
21:28
[Audio] 22C3 Network Review
» ‎ SecDocs

Authors: Sebastian Werner Stefan Wahl
Tags: network
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: An Introduction into the structure and design of the congress network - featuring a description of hardware setup and focusing on the uplink to the internet. Building a high-demand network in less than 72hrs is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before congress doors open. 22c3 network concept is based on the experiences of the last two congresses and tries to solve some problems that arised on 21c3. So this talk will show you, why network is the way it is. Focus of this talk is wired network from access layer to the backbone and our upstream routers. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile
September 26, 2012
12:25
[Video] Lightning Talks Day 4
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
12:25
[Audio] Lightning Talks Day 4
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
September 24, 2012
21:46
[Video] Terminator Genes and GURT - Biological Restrictions Management
» ‎ SecDocs

Authors: Julian Finn Oliver Moldenhauer
Tags: science
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: Terminator Technology prevents plants from producing reproducible seeds, acting as a sort of copy protection technology for plants. In this talk we want to talk about the technological background, explaining the bits of genetic code that can switch reproduction on and off. Also we want to focus on the implication of this technology, the parallels to our struggles as hackers, and the resistance to its introduction. In 2000 the conference of the parties of the convention on biological diversity agreed on a quasi moratorium towards the introduction on terminator technology. Now, as problems within green biotech rise, terminator seeds are being introduced as a "safety mechanism". In fact, this technology is capable of making farmers more dependant of seed-producers, disallowing own reproduction of seeds. This talk will not only explain the genetic coding behind the terminator technology, but also point out the many aspects BRM (or ARM) and DRM, farmers throughout the world, especially in developing countries, and hackers and other civil libertarians have in common and where a joint struggle can bring help both sides.
Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes
21:46
[Slides] Terminator Genes and GURT - Biological Restrictions Management
» ‎ SecDocs

Authors: Julian Finn Oliver Moldenhauer
Tags: science
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: Terminator Technology prevents plants from producing reproducible seeds, acting as a sort of copy protection technology for plants. In this talk we want to talk about the technological background, explaining the bits of genetic code that can switch reproduction on and off. Also we want to focus on the implication of this technology, the parallels to our struggles as hackers, and the resistance to its introduction. In 2000 the conference of the parties of the convention on biological diversity agreed on a quasi moratorium towards the introduction on terminator technology. Now, as problems within green biotech rise, terminator seeds are being introduced as a "safety mechanism". In fact, this technology is capable of making farmers more dependant of seed-producers, disallowing own reproduction of seeds. This talk will not only explain the genetic coding behind the terminator technology, but also point out the many aspects BRM (or ARM) and DRM, farmers throughout the world, especially in developing countries, and hackers and other civil libertarians have in common and where a joint struggle can bring help both sides.
Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes
21:46
[Audio] Terminator Genes and GURT - Biological Restrictions Management
» ‎ SecDocs

Authors: Julian Finn Oliver Moldenhauer
Tags: science
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: Terminator Technology prevents plants from producing reproducible seeds, acting as a sort of copy protection technology for plants. In this talk we want to talk about the technological background, explaining the bits of genetic code that can switch reproduction on and off. Also we want to focus on the implication of this technology, the parallels to our struggles as hackers, and the resistance to its introduction. In 2000 the conference of the parties of the convention on biological diversity agreed on a quasi moratorium towards the introduction on terminator technology. Now, as problems within green biotech rise, terminator seeds are being introduced as a "safety mechanism". In fact, this technology is capable of making farmers more dependant of seed-producers, disallowing own reproduction of seeds. This talk will not only explain the genetic coding behind the terminator technology, but also point out the many aspects BRM (or ARM) and DRM, farmers throughout the world, especially in developing countries, and hackers and other civil libertarians have in common and where a joint struggle can bring help both sides.
Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes
September 21, 2012
21:52
[Video] Memory allocator security
» ‎ SecDocs

Authors: Yves Younan
Tags: C / C++
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will discuss a variety of memory allocators that are available for C and C++ and how they can be exploited. Afterwards I will describe our modification to one of these memory allocators that makes it more resilient to attacks. While stack-based buffer overflows have dominated the vulnerabilities which can cause code injection attacks, heap-based buffer overflows and dangling pointer references to heap memory are also important avenues of attack. In this talk we will describe how attackers can exploit many common memory allocators. We will discuss the memory allocator used in Linux (dlmalloc), the one from FreeBSD (phkmalloc), 2 academic allocators (CSRI, Quickfit) and Boehm's garbage collector. We will then discuss our more secure memory allocator (called dnmalloc) and will also describe several countermeasures that exist that protect against these attacks: Robertson's heap protector, GlibC 2.3.5's integrity checks and Contrapolice, .... This talk will also mark the first public release of dnmalloc which is the more secure memory allocator that I will be talking about.
Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory
21:52
[Paper] Memory allocator security
» ‎ SecDocs

Authors: Yves Younan
Tags: C / C++
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will discuss a variety of memory allocators that are available for C and C++ and how they can be exploited. Afterwards I will describe our modification to one of these memory allocators that makes it more resilient to attacks. While stack-based buffer overflows have dominated the vulnerabilities which can cause code injection attacks, heap-based buffer overflows and dangling pointer references to heap memory are also important avenues of attack. In this talk we will describe how attackers can exploit many common memory allocators. We will discuss the memory allocator used in Linux (dlmalloc), the one from FreeBSD (phkmalloc), 2 academic allocators (CSRI, Quickfit) and Boehm's garbage collector. We will then discuss our more secure memory allocator (called dnmalloc) and will also describe several countermeasures that exist that protect against these attacks: Robertson's heap protector, GlibC 2.3.5's integrity checks and Contrapolice, .... This talk will also mark the first public release of dnmalloc which is the more secure memory allocator that I will be talking about.
Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory
21:52
[Slides] Memory allocator security
» ‎ SecDocs

Authors: Yves Younan
Tags: C / C++
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will discuss a variety of memory allocators that are available for C and C++ and how they can be exploited. Afterwards I will describe our modification to one of these memory allocators that makes it more resilient to attacks. While stack-based buffer overflows have dominated the vulnerabilities which can cause code injection attacks, heap-based buffer overflows and dangling pointer references to heap memory are also important avenues of attack. In this talk we will describe how attackers can exploit many common memory allocators. We will discuss the memory allocator used in Linux (dlmalloc), the one from FreeBSD (phkmalloc), 2 academic allocators (CSRI, Quickfit) and Boehm's garbage collector. We will then discuss our more secure memory allocator (called dnmalloc) and will also describe several countermeasures that exist that protect against these attacks: Robertson's heap protector, GlibC 2.3.5's integrity checks and Contrapolice, .... This talk will also mark the first public release of dnmalloc which is the more secure memory allocator that I will be talking about.
Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory
21:52
[Audio] Memory allocator security
» ‎ SecDocs

Authors: Yves Younan
Tags: C / C++
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will discuss a variety of memory allocators that are available for C and C++ and how they can be exploited. Afterwards I will describe our modification to one of these memory allocators that makes it more resilient to attacks. While stack-based buffer overflows have dominated the vulnerabilities which can cause code injection attacks, heap-based buffer overflows and dangling pointer references to heap memory are also important avenues of attack. In this talk we will describe how attackers can exploit many common memory allocators. We will discuss the memory allocator used in Linux (dlmalloc), the one from FreeBSD (phkmalloc), 2 academic allocators (CSRI, Quickfit) and Boehm's garbage collector. We will then discuss our more secure memory allocator (called dnmalloc) and will also describe several countermeasures that exist that protect against these attacks: Robertson's heap protector, GlibC 2.3.5's integrity checks and Contrapolice, .... This talk will also mark the first public release of dnmalloc which is the more secure memory allocator that I will be talking about.
Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory
September 18, 2012
21:35
[Video] Lightning Talks Day 3
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
5:30
[Audio] Lightning Talks Day 3
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
September 12, 2012
13:45
[Video] Lightning Talks Day 2
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
13:45
[Audio] Lightning Talks Day 2
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
September 07, 2012
21:26
[Video] Covert channels in TCP/IP: attack and defence
» ‎ SecDocs

Authors: Steven J. Murdoch
Tags: covert channel
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will show how idiosyncrasies in TCP/IP implementations can be used to reveal the use of several steganography schemes, and how they can be fixed. The analysis can even be extended to remotely identify the physical machine being used. A number of steganography techniques have been designed to insert a covert channel into seemingly random TCP/IP fields, such as the IP ID, TCP initial sequence number (ISN) or the least significant bits of the TCP timestamp. While compliant with the TCP/IP specification, their output is unlike that an unmodified operating system would generate. This talk will show how by taking in account the implementation of the TCP/IP stack, a number of such specification-based steganography schemes can be broken. This includes Nushu, an ISN based scheme presented at 21C3. Firstly the talk will introduce the field of covert channels and TCP/IP steganography in particular, giving an overview of the steganographic potential of different fields in the protocol. This will show that only the IP ID and TCP ISN can be plausibly used for steganography. The talk will then describe how these fields are generated, and how steganography schemes which do not properly take in account these algorithms can be detected. The talk will then present improved TCP/IP steganography schemes for Linux and OpenBSD which, by deriving a reversible transformation from the standard TCP/IP stacks' implementation, make a much harder to detect covert channel. Such a scheme can be shown to be as strong as the underlying encryption, when attacked by an adversary monitoring packet content. Finally, a side effect of the steganography detection system is to reveal microsecond-level deviations in the clock speed of the device being monitored. Clock-skew varies from computer to computer so can act as a fingerprint of a particular physical device. This talk will show how this fact can be used to track physical devices across the Internet, and how the use of TCP ISNs can improve over schemes based on TCP timestamps.
Tags: talk tcp steganography steven-j.-murdoch-tags chaos-communication-congress initial-sequence-number clock-skew
21:26
[Audio] Covert channels in TCP/IP: attack and defence
» ‎ SecDocs

Authors: Steven J. Murdoch
Tags: covert channel
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk will show how idiosyncrasies in TCP/IP implementations can be used to reveal the use of several steganography schemes, and how they can be fixed. The analysis can even be extended to remotely identify the physical machine being used. A number of steganography techniques have been designed to insert a covert channel into seemingly random TCP/IP fields, such as the IP ID, TCP initial sequence number (ISN) or the least significant bits of the TCP timestamp. While compliant with the TCP/IP specification, their output is unlike that an unmodified operating system would generate. This talk will show how by taking in account the implementation of the TCP/IP stack, a number of such specification-based steganography schemes can be broken. This includes Nushu, an ISN based scheme presented at 21C3. Firstly the talk will introduce the field of covert channels and TCP/IP steganography in particular, giving an overview of the steganographic potential of different fields in the protocol. This will show that only the IP ID and TCP ISN can be plausibly used for steganography. The talk will then describe how these fields are generated, and how steganography schemes which do not properly take in account these algorithms can be detected. The talk will then present improved TCP/IP steganography schemes for Linux and OpenBSD which, by deriving a reversible transformation from the standard TCP/IP stacks' implementation, make a much harder to detect covert channel. Such a scheme can be shown to be as strong as the underlying encryption, when attacked by an adversary monitoring packet content. Finally, a side effect of the steganography detection system is to reveal microsecond-level deviations in the clock speed of the device being monitored. Clock-skew varies from computer to computer so can act as a fingerprint of a particular physical device. This talk will show how this fact can be used to track physical devices across the Internet, and how the use of TCP ISNs can improve over schemes based on TCP timestamps.
Tags: talk tcp steganography steven-j.-murdoch-tags chaos-communication-congress initial-sequence-number clock-skew
September 06, 2012
9:57
[Video] Syscall proxying fun and applications
» ‎ SecDocs

Tags: exploiting
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk is about how using syscall proxying technique for envolved attacks or other distributed applications. It includes source code examples like shellcodes, tools and a poc rootkit using this technique. This talk will be submited first at 0sec, a private security event we organize in switzerland in october. Since long time hackers are searching way to execute code on hosts through different types of vulnerabilities. The shellcode is one of the master part of a successfull exploitation. Making reliable exploit working in the wild with "universal" payload is the goal of every exploit writer. Syscall proxying is a technique which was introduced by Maximiliano Caceres (CORE SDI) which can provide a real remote interface to the host's kernel. The goal is writing universal "agents" to create all you can imagine locally but running it remotly. The best part of the syscall proxying technique is the attacker tools are locally stored but remotely executed through the payload. During this talk Casek will introduce this technique and his own implementation of syscall proxy shellcodes and tools. Different type of payloads, a library, tools and a proof of concept lightweight rootkit will be presented. He will discuss exploiting vulnerabilities with this goal: exploiting, privilege escalation if needed, rootkiting (remotly infecting processes or patching on the fly the kernel), covering traces etc... all in one time.
Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples
9:57
[Slides] Syscall proxying fun and applications
» ‎ SecDocs

Tags: exploiting
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk is about how using syscall proxying technique for envolved attacks or other distributed applications. It includes source code examples like shellcodes, tools and a poc rootkit using this technique. This talk will be submited first at 0sec, a private security event we organize in switzerland in october. Since long time hackers are searching way to execute code on hosts through different types of vulnerabilities. The shellcode is one of the master part of a successfull exploitation. Making reliable exploit working in the wild with "universal" payload is the goal of every exploit writer. Syscall proxying is a technique which was introduced by Maximiliano Caceres (CORE SDI) which can provide a real remote interface to the host's kernel. The goal is writing universal "agents" to create all you can imagine locally but running it remotly. The best part of the syscall proxying technique is the attacker tools are locally stored but remotely executed through the payload. During this talk Casek will introduce this technique and his own implementation of syscall proxy shellcodes and tools. Different type of payloads, a library, tools and a proof of concept lightweight rootkit will be presented. He will discuss exploiting vulnerabilities with this goal: exploiting, privilege escalation if needed, rootkiting (remotly infecting processes or patching on the fly the kernel), covering traces etc... all in one time.
Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples
September 05, 2012
21:28
[Audio] Syscall proxying fun and applications
» ‎ SecDocs

Tags: exploiting
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: This talk is about how using syscall proxying technique for envolved attacks or other distributed applications. It includes source code examples like shellcodes, tools and a poc rootkit using this technique. This talk will be submited first at 0sec, a private security event we organize in switzerland in october. Since long time hackers are searching way to execute code on hosts through different types of vulnerabilities. The shellcode is one of the master part of a successfull exploitation. Making reliable exploit working in the wild with "universal" payload is the goal of every exploit writer. Syscall proxying is a technique which was introduced by Maximiliano Caceres (CORE SDI) which can provide a real remote interface to the host's kernel. The goal is writing universal "agents" to create all you can imagine locally but running it remotly. The best part of the syscall proxying technique is the attacker tools are locally stored but remotely executed through the payload. During this talk Casek will introduce this technique and his own implementation of syscall proxy shellcodes and tools. Different type of payloads, a library, tools and a proof of concept lightweight rootkit will be presented. He will discuss exploiting vulnerabilities with this goal: exploiting, privilege escalation if needed, rootkiting (remotly infecting processes or patching on the fly the kernel), covering traces etc... all in one time.
Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples
21:28
[Video] Media System Deployment using Python
» ‎ SecDocs

Authors: Ulrich von Zadow
Tags: technology
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: Using Python, a large variety of media-oriented systems can be scripted with very little effort. The talk will explore the available libraries for 2d and 3d graphics, video and sound and describe real-world experiences in deploying these systems. Multimedia on linux has made great progress. A few years ago, video support was very limited, low-latency-audio was impossible, getting jitter-free performance was a nightmare and fonts were rendered with a quality that made any designer cringe. This has changed. One language that has been used successfully in many multimedia systems is python. The talk will look at what is required to set up a multimedia system with python. While the focus will be on installations in public or semi-public areas (museums, showrooms, the c-base), many of the techniques can be used in other areas as well. Most of the talk will cover Linux-based systems, with some references to the possibilities of Mac OS X systems.
Tags: talk video python mac-os ulrich-von-zadow chaos-communication-congress system-deployment mac-os-x
21:28
[Audio] Media System Deployment using Python
» ‎ SecDocs

Authors: Ulrich von Zadow
Tags: technology
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: Using Python, a large variety of media-oriented systems can be scripted with very little effort. The talk will explore the available libraries for 2d and 3d graphics, video and sound and describe real-world experiences in deploying these systems. Multimedia on linux has made great progress. A few years ago, video support was very limited, low-latency-audio was impossible, getting jitter-free performance was a nightmare and fonts were rendered with a quality that made any designer cringe. This has changed. One language that has been used successfully in many multimedia systems is python. The talk will look at what is required to set up a multimedia system with python. While the focus will be on installations in public or semi-public areas (museums, showrooms, the c-base), many of the techniques can be used in other areas as well. Most of the talk will cover Linux-based systems, with some references to the possibilities of Mac OS X systems.
Tags: talk system python mac-os ulrich-von-zadow chaos-communication-congress system-deployment mac-os-x
21:28
[Video] Peer-to-peer under the hood
» ‎ SecDocs

Authors: David Göthberg
Tags: P2P
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: About p2p-algorithms for fully distributed, totally serverless, fully scalable peer-to-peer systems. Not about specific p2p-softwares. This will only be a very brief overview of p2p-algorithms. This talk is about p2p-algorithms for fully distributed, totally serverless, fully scalable, globally searchable, robust, efficient peer-to-peer systems. These algorithms make it possible to make millions or even billions of computers work together in an organised manner without any central servers, without any computer being a boss over the others. We can now make applications such as filesharing, chat, instant messaging, Internet telephoning, radio and TV (sent from a single home user computer to a billion nodes), distributed calculation systems and many more applications. Since this talk is rather short we will not talk about specific p2p-softwares, encryption, stealth or anonymity. But we will mention some never before published stuff. The talk will be held by David Göthberg who has researched p2p-algorithms since 1997 and full time since the year 2000. Before that he used to work with Internet communication and computer security in embedded systems. (Internet in cars and other machinery.) David has now finished his research and is now working on building a p2p-programming library. So that other programmers can build advanced p2p applications easily, without having to spend years on research first. David's p2p-programming library will be available free of charge for anyone making free software. If you want more information from David before or after the congress take a look at www.pjort.com/projects/ or chat with "Mole2" in the channel #p2p-hackers on the IRC-network irc.freenode.net.
Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers
6:48
[Video] Lightning Talks Day 1
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
6:48
[Slides] Peer-to-peer under the hood
» ‎ SecDocs

Authors: David Göthberg
Tags: P2P
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: About p2p-algorithms for fully distributed, totally serverless, fully scalable peer-to-peer systems. Not about specific p2p-softwares. This will only be a very brief overview of p2p-algorithms. This talk is about p2p-algorithms for fully distributed, totally serverless, fully scalable, globally searchable, robust, efficient peer-to-peer systems. These algorithms make it possible to make millions or even billions of computers work together in an organised manner without any central servers, without any computer being a boss over the others. We can now make applications such as filesharing, chat, instant messaging, Internet telephoning, radio and TV (sent from a single home user computer to a billion nodes), distributed calculation systems and many more applications. Since this talk is rather short we will not talk about specific p2p-softwares, encryption, stealth or anonymity. But we will mention some never before published stuff. The talk will be held by David Göthberg who has researched p2p-algorithms since 1997 and full time since the year 2000. Before that he used to work with Internet communication and computer security in embedded systems. (Internet in cars and other machinery.) David has now finished his research and is now working on building a p2p-programming library. So that other programmers can build advanced p2p applications easily, without having to spend years on research first. David's p2p-programming library will be available free of charge for anyone making free software. If you want more information from David before or after the congress take a look at www.pjort.com/projects/ or chat with "Mole2" in the channel #p2p-hackers on the IRC-network irc.freenode.net.
Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers
6:48
[Audio] Peer-to-peer under the hood
» ‎ SecDocs

Authors: David Göthberg
Tags: P2P
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: About p2p-algorithms for fully distributed, totally serverless, fully scalable peer-to-peer systems. Not about specific p2p-softwares. This will only be a very brief overview of p2p-algorithms. This talk is about p2p-algorithms for fully distributed, totally serverless, fully scalable, globally searchable, robust, efficient peer-to-peer systems. These algorithms make it possible to make millions or even billions of computers work together in an organised manner without any central servers, without any computer being a boss over the others. We can now make applications such as filesharing, chat, instant messaging, Internet telephoning, radio and TV (sent from a single home user computer to a billion nodes), distributed calculation systems and many more applications. Since this talk is rather short we will not talk about specific p2p-softwares, encryption, stealth or anonymity. But we will mention some never before published stuff. The talk will be held by David Göthberg who has researched p2p-algorithms since 1997 and full time since the year 2000. Before that he used to work with Internet communication and computer security in embedded systems. (Internet in cars and other machinery.) David has now finished his research and is now working on building a p2p-programming library. So that other programmers can build advanced p2p applications easily, without having to spend years on research first. David's p2p-programming library will be available free of charge for anyone making free software. If you want more information from David before or after the congress take a look at www.pjort.com/projects/ or chat with "Mole2" in the channel #p2p-hackers on the IRC-network irc.freenode.net.
Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers
6:48
[Audio] Lightning Talks Day 1
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: There are also loads of reasons for attending the lightning talks (there is a 1-hour block of those each day at 22C3, with 10 talks in a row). It’s entertaining. You get to learn about a lot of different subjects in a short time. And even if one particular speaker is boring: hey, it will be over in just 5 minutes and a new topic will begin. But what is a lightning talk? It’s a 5-minute talk you (for reasons of your own) don’t feel like doing as a full 1-hour presentation. Maybe the topic is too obscure. Maybe the research you want to present is still too much in progress. Maybe you just want to talk about a detail you noticed on the way to the congress. Maybe you have a cool software or hardware hack you need helpers for and just want to drop the name of your project. Maybe you got the idea for doing a talk at the congress itself and the deadline for the call for papers is long gone… There are really loads of reasons why you should do a lightning talk. Just be short and sweet. After 5 minutes, you will be cut off and it’s the next speaker’s turn.
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack
September 04, 2012
3:39
[Video] W3C on Mobile, CSS, Multimodal and more
» ‎ SecDocs

Authors: Bert Bos
Tags: web
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: W3C is developing several new Web technologies and modules for existing technologies, many of which have to do with the requirements of new, mobile devices. This talk will look at a few of them. W3C has some 50 working groups. Some of them work on guidelines or "best practice," but many of them write specifications for new technology. Looking at what those groups are developing should give a good idea of what W3C and its members expect to happen on the Web in the next couple of years. This talk will describe a few of the developments, with a special focus on delivering Web content on mobile devices. Some of the expected topics are CSS level 3, Compound Documents, EMMA, XHTML2, and "binary XML."
Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies
September 03, 2012
21:38
[Slides] W3C on Mobile, CSS, Multimodal and more
» ‎ SecDocs

Authors: Bert Bos
Tags: web
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: W3C is developing several new Web technologies and modules for existing technologies, many of which have to do with the requirements of new, mobile devices. This talk will look at a few of them. W3C has some 50 working groups. Some of them work on guidelines or "best practice," but many of them write specifications for new technology. Looking at what those groups are developing should give a good idea of what W3C and its members expect to happen on the Web in the next couple of years. This talk will describe a few of the developments, with a special focus on delivering Web content on mobile devices. Some of the expected topics are CSS level 3, Compound Documents, EMMA, XHTML2, and "binary XML."
Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies
21:38
[Paper] W3C on Mobile, CSS, Multimodal and more
» ‎ SecDocs

Authors: Bert Bos
Tags: web
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: W3C is developing several new Web technologies and modules for existing technologies, many of which have to do with the requirements of new, mobile devices. This talk will look at a few of them. W3C has some 50 working groups. Some of them work on guidelines or "best practice," but many of them write specifications for new technology. Looking at what those groups are developing should give a good idea of what W3C and its members expect to happen on the Web in the next couple of years. This talk will describe a few of the developments, with a special focus on delivering Web content on mobile devices. Some of the expected topics are CSS level 3, Compound Documents, EMMA, XHTML2, and "binary XML."
Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies
21:38
[Audio] W3C on Mobile, CSS, Multimodal and more
» ‎ SecDocs

Authors: Bert Bos
Tags: web
Event: Chaos Communication Congress 22th (22C3) 2005
Abstract: W3C is developing several new Web technologies and modules for existing technologies, many of which have to do with the requirements of new, mobile devices. This talk will look at a few of them. W3C has some 50 working groups. Some of them work on guidelines or "best practice," but many of them write specifications for new technology. Looking at what those groups are developing should give a good idea of what W3C and its members expect to happen on the Web in the next couple of years. This talk will describe a few of the developments, with a special focus on delivering Web content on mobile devices. Some of the expected topics are CSS level 3, Compound Documents, EMMA, XHTML2, and "binary XML."
Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies
September 02, 2012
21:46
[Video] Camp Network Review
» ‎ SecDocs

Authors: Elisa Jasinska Maxim Salomon Niels Bakker
Tags: network
Event: Chaos Communication Camp 2007
Abstract: An introduction into the structure and design of the camp network - featuring a description of hardware setup and focusing on the Backbone Network infrastructure and Wireless LAN. Building a high-demand outdoor network in less than one week is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before Camp doors open. The Camp network concept is based on the experiences of the last Congresses. So this talk will show you why network is the way it is. Focus of this talk is network from access layer to the backbone and our Wireless LAN. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk network Hardware lan elisa-jasinska maxim-salomon-niels-bakker camp-network chaos-communication-camp backbone-network video-camp
21:46
[Slides] Camp Network Review
» ‎ SecDocs

Authors: Elisa Jasinska Maxim Salomon Niels Bakker
Tags: network
Event: Chaos Communication Camp 2007
Abstract: An introduction into the structure and design of the camp network - featuring a description of hardware setup and focusing on the Backbone Network infrastructure and Wireless LAN. Building a high-demand outdoor network in less than one week is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before Camp doors open. The Camp network concept is based on the experiences of the last Congresses. So this talk will show you why network is the way it is. Focus of this talk is network from access layer to the backbone and our Wireless LAN. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk network Hardware lan elisa-jasinska maxim-salomon-niels-bakker camp-network chaos-communication-camp backbone-network usage-profile
10:19
[Video] Swedish analysis of Nazi crypto TTYs
» ‎ SecDocs

Authors: Sven Moritz Hallberg
Tags: cryptography
Event: Chaos Communication Camp 2007
Abstract: This talk will describe how a team of Swedish cryptanalysts broke the electromechanical cryptographic teleprinter "Siemens & Halske T52" which was used by the Germans during World War II for "important" traffic. It contained a stream cipher implementation much more sophisticated than the substitution engine of the well-known Enigma. The talk will focus on reconstructing how the Swedes, specifically the key figure of Arne Beurling, could have gotten the ideas for breaking the cipher -- a process about which next to no historical accounts exist. The machine called Enigma, widely famous for being used by German armies during World War II to secretly (or so they hoped) communicate among troops, was a field device. It was portable, simple to operate, as well as relatively cheap to produce, containing neither electrical motors nor any coding/decoding assembly. It was, however, not the only crypto device employed by the Germans. The Siemens & Halske T52 (in its several variants), commonly referred to as the Geheim- or G-Schreiber (German for "secretly-writer"), was a teleprinter with integrated encryption/decryption facility. It was cryptographically superior to the Enigma and, by its nature, much more sophisticated in terms of its electro-mechanical engineering. Due to the latter, it was also much bulkier, weighing no less than 100kg, excluding the transport case. Therefore it was used as a stationary unit, primarily by the German air force, navy, and for diplomatic purposes. In total, about 600 units were in operation. From April 1940, Swedish authorities gained access to large quantities of T52-encrypted telegraph traffic. With Norway just invaded and significant parts of Finland already surrendered to Russia, the Swedes were obviously interested in the plaintexts and, having been quite successful at breaking Russian and French crypto already, promptly tried their luck in deciphering the German messages. The initial successfull cryptanalysis was done in only a matter of weeks by a scientist named Arne Beurling with next to no knowledge but the mere basics of teleprinter technology and a bunch of ciphertext intercepts. Unfortunately he refused to talk about the details of how he actually broke the cipher. This talk will try to reconstruct a possible sequence of ideas that could have led to the eventual breaking of the code. Thus it tries to shed some light on the "magical" work of a cryptanalyst.
Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske
10:19
[Slides] Swedish analysis of Nazi crypto TTYs
» ‎ SecDocs

Authors: Sven Moritz Hallberg
Tags: cryptography
Event: Chaos Communication Camp 2007
Abstract: This talk will describe how a team of Swedish cryptanalysts broke the electromechanical cryptographic teleprinter "Siemens & Halske T52" which was used by the Germans during World War II for "important" traffic. It contained a stream cipher implementation much more sophisticated than the substitution engine of the well-known Enigma. The talk will focus on reconstructing how the Swedes, specifically the key figure of Arne Beurling, could have gotten the ideas for breaking the cipher -- a process about which next to no historical accounts exist. The machine called Enigma, widely famous for being used by German armies during World War II to secretly (or so they hoped) communicate among troops, was a field device. It was portable, simple to operate, as well as relatively cheap to produce, containing neither electrical motors nor any coding/decoding assembly. It was, however, not the only crypto device employed by the Germans. The Siemens & Halske T52 (in its several variants), commonly referred to as the Geheim- or G-Schreiber (German for "secretly-writer"), was a teleprinter with integrated encryption/decryption facility. It was cryptographically superior to the Enigma and, by its nature, much more sophisticated in terms of its electro-mechanical engineering. Due to the latter, it was also much bulkier, weighing no less than 100kg, excluding the transport case. Therefore it was used as a stationary unit, primarily by the German air force, navy, and for diplomatic purposes. In total, about 600 units were in operation. From April 1940, Swedish authorities gained access to large quantities of T52-encrypted telegraph traffic. With Norway just invaded and significant parts of Finland already surrendered to Russia, the Swedes were obviously interested in the plaintexts and, having been quite successful at breaking Russian and French crypto already, promptly tried their luck in deciphering the German messages. The initial successfull cryptanalysis was done in only a matter of weeks by a scientist named Arne Beurling with next to no knowledge but the mere basics of teleprinter technology and a bunch of ciphertext intercepts. Unfortunately he refused to talk about the details of how he actually broke the cipher. This talk will try to reconstruct a possible sequence of ideas that could have led to the eventual breaking of the code. Thus it tries to shed some light on the "magical" work of a cryptanalyst.
Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske
September 01, 2012
21:43
[Paper] Swedish analysis of Nazi crypto TTYs
» ‎ SecDocs

Authors: Sven Moritz Hallberg
Tags: cryptography
Event: Chaos Communication Camp 2007
Abstract: This talk will describe how a team of Swedish cryptanalysts broke the electromechanical cryptographic teleprinter "Siemens & Halske T52" which was used by the Germans during World War II for "important" traffic. It contained a stream cipher implementation much more sophisticated than the substitution engine of the well-known Enigma. The talk will focus on reconstructing how the Swedes, specifically the key figure of Arne Beurling, could have gotten the ideas for breaking the cipher -- a process about which next to no historical accounts exist. The machine called Enigma, widely famous for being used by German armies during World War II to secretly (or so they hoped) communicate among troops, was a field device. It was portable, simple to operate, as well as relatively cheap to produce, containing neither electrical motors nor any coding/decoding assembly. It was, however, not the only crypto device employed by the Germans. The Siemens & Halske T52 (in its several variants), commonly referred to as the Geheim- or G-Schreiber (German for "secretly-writer"), was a teleprinter with integrated encryption/decryption facility. It was cryptographically superior to the Enigma and, by its nature, much more sophisticated in terms of its electro-mechanical engineering. Due to the latter, it was also much bulkier, weighing no less than 100kg, excluding the transport case. Therefore it was used as a stationary unit, primarily by the German air force, navy, and for diplomatic purposes. In total, about 600 units were in operation. From April 1940, Swedish authorities gained access to large quantities of T52-encrypted telegraph traffic. With Norway just invaded and significant parts of Finland already surrendered to Russia, the Swedes were obviously interested in the plaintexts and, having been quite successful at breaking Russian and French crypto already, promptly tried their luck in deciphering the German messages. The initial successfull cryptanalysis was done in only a matter of weeks by a scientist named Arne Beurling with next to no knowledge but the mere basics of teleprinter technology and a bunch of ciphertext intercepts. Unfortunately he refused to talk about the details of how he actually broke the cipher. This talk will try to reconstruct a possible sequence of ideas that could have led to the eventual breaking of the code. Thus it tries to shed some light on the "magical" work of a cryptanalyst.
Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske
August 31, 2012
21:50
[Video] The A5 Cracking Project
» ‎ SecDocs

Authors: David Hulton Joshua Lackey
Tags: GSM
Event: Chaos Communication Camp 2007
Abstract: A lot of work has been done on coding together GSM support for GNU Radio and now the next question is how to get past the A5 over-the-air encryption. In this talk we will present the GNU Radio software we've thrown together which let you monitor unencrypted GSM traffic and will go over the various published attacks on A5. The primary goal of this talk is to present our findings on building a practical and feasible A5/1 cracker that can decrypt GSM communications in a reasonable amount of time. First, this presentation will present the code that has been developed for capturing GSM traffic and how you can use it on your GNU Radio hardware. Then we'll provide a brief overview of the GSM protocols, encryption, and the past attacks on GSM, and what you can really do once you're able to start sniffing GSM packets. The other half of the talk will focus on our A5/1 cracking project and on our current findings on attacking A5/1. Many different attacks on A5/1 have been published, but most of them haven't been extremely practical. For our purposes, the known-plaintext attacks weren't as appealing as the ciphertext-only attacks so we try to focus only on these attacks. Additionally, attacks that require more than a few months to pre-compute or a day or two to reverse a key take too long for our purposes and seem impractical. We would also like to ideally implement this attack fully passively, mostly for legal reasons, but it isn't required. Because of these requirements, we mostly focus on time-space tradeoff attacks since they can be pre-computed ahead of time and possibly using FPGAs. Some of the most promising attacks include implementing the ciphertext-only attack published by Barkan, Biham, and Keller and other variations that essentially build a rainbowtable for reversing parts of A5/1. We have also found that FPGAs have the potential of being able to brute force the A5/1 keyspace in a reasonable timeframe so we will also present on the feasibility and the amount of hardware required to brute force the keyspace in different scenarios. The hope is that this talk will present a technical perspective on current state of GSM security and fuel a discussion on what's to come. Now that anyone with a GNU Radio board is able to start checking out GSM traffic, what does that mean to us and our privacy? Is it possible that there are a whole new set of vulnerabilities down at the lower protocol layers? What sort of useful things can we do now? At what point are we breaking the law? A lot of these questions should be answered now that software defined radio's are becoming more prevalent. Bring your thinking caps and join in on our discussion!
Tags: talk radio gnu david-hulton joshua-lackey gsm chaos-communication-camp gsm-traffic
August 30, 2012
21:49
[Video] Antivirus (In)Security
» ‎ SecDocs

Authors: Sergio Alvarez
Tags: antivirus
Event: Chaos Communication Camp 2007
Abstract: Nowadays Antivirus Software are the larger defense deployed in corporations and final user desktops (mail servers, file servers, http and ftp internet gateways, workstations, etc) and their engines are reused in the IPSs that the same vendors develop. This talk will be about the findings and lessons learned while targeting the antivirus software that most of companies and users use. The talk will focus mainly in the type of bugs found (stack based buffer overflows, heap overflows, integer issues, uninitialized variables, traversals, etc) and the techniques used to find them.
Tags: talk antivirus Software sergio-alvarez chaos-communication-camp mail-servers security-authors
21:49
[Slides] Antivirus (In)Security
» ‎ SecDocs

Authors: Sergio Alvarez
Tags: antivirus
Event: Chaos Communication Camp 2007
Abstract: Nowadays Antivirus Software are the larger defense deployed in corporations and final user desktops (mail servers, file servers, http and ftp internet gateways, workstations, etc) and their engines are reused in the IPSs that the same vendors develop. This talk will be about the findings and lessons learned while targeting the antivirus software that most of companies and users use. The talk will focus mainly in the type of bugs found (stack based buffer overflows, heap overflows, integer issues, uninitialized variables, traversals, etc) and the techniques used to find them.
Tags: talk antivirus Software sergio-alvarez chaos-communication-camp mail-servers security-authors
21:49
[Slides] Trojans, A Reality Check
» ‎ SecDocs

Authors: Toralv Dirro
Tags: malware trojan
Event: Chaos Communication Camp 2007
Abstract: This talk focuses on the various trojans the we actually see being used against companies and individuals in the world. It will show the real threats, how they work, what the real impact is. The talk will include screenshots from dropzones and practical demos, possibly as video clips. Today there is a lot of hype around some new proof-of-concept technology or around politically motivated trojans, etc. This talk will deliver a reality check, give an idea what kind of malware the McAfee Research organisation is actually seeing to be used in the real world and show how the diffent trojans work, what the impact is. The material used are internal statistics of the various threats sent to oder discovered by us, some more detailed analysis to make functionality more transparent and some demo's screenshots, etc. This talk will not advertise any products from us or anyone else. Instead of that short examples of various technologies will be used to discuss of that may help or why it fails.
Tags: malware talk reality trojans chaos-communication-camp internal-statistics idea-what-kind
21:49
[Video] 23C3 Network Review
» ‎ SecDocs

Tags: network
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: An Introduction into the structure and design of the congress network - featuring a description of hardware setup and focusing on the Backbone Network infrastructure and Wireless LAN. Building a high-demand network in less than 72hrs is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before congress doors open. 23c3 network concept is based on the experiences of the last congresses So this talk will show you, why network is the way it is. Focus of this talk is wired network from access layer to the backbone and our Wireless LAN. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk network congress lan chaos-communication-congress backbone-network usage-profile
August 29, 2012
21:32
[Audio] 23C3 Network Review
» ‎ SecDocs

Tags: network
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: An Introduction into the structure and design of the congress network - featuring a description of hardware setup and focusing on the Backbone Network infrastructure and Wireless LAN. Building a high-demand network in less than 72hrs is a job that requires sufficient planning in advance. It starts with organizing hardware that is capable to serve the usage profile of about 2342 power-users and ends in asking providers to contribute in upstream connectivity. This talk will give you an outline of what the NOC people do - beginning month before congress doors open. 23c3 network concept is based on the experiences of the last congresses So this talk will show you, why network is the way it is. Focus of this talk is wired network from access layer to the backbone and our Wireless LAN. It intends to give network administrators a brief overview of our approach to meet all requirements.
Tags: talk network congress lan chaos-communication-congress backbone-network usage-profile
August 26, 2012
21:46
[Video] CSRF, the Intranet and You
» ‎ SecDocs

Authors: Justus Winter Martin Johns
Tags: CSRF
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: A detailed introduction to Cross Site Request Forgery. This talk presents the fundamental cause of this vulnerability class and examples of potential attack consequences. The second half of the talk is devoted to avoiding and countering CSRF: Implementing CSRF proof session handling, transparent retrofitting of legacy applications and methods for client side protection. Cross Site Request Forgery (CSRF, a.k.a. Session Riding) attacks are public at least since 2001. However this class of web application vulnerabilities is rather obscure compared to attack vectors like Cross Site Scripting or SQL Injection. As the trend towards web applications continues and an increasing number of local programs and appliances like firewalls rely on web based frontends, the attack surface for CSRF grows continuously. While being is some cases as dangerous as e.g. Cross Site Scripting, CSRF vulnerabilities are often regarded as negligible. Moreover, this vulnerability class is often simply unknown to some web application developers. Many misconceptions on countering CSRF exist because of this obscurity. The talk will not only show how to avoid XSRF but also how NOT to do it. Furthermore, most presentations on CSRF only address attacks on cookie based session management. This talk will also cover attacks on http authentication, client side SSL and IP/Mac based access control. CSRF is an attack that targets the user rather than the web application. As long as web applications do not take measures to protect their users against this threat, it is important to investigate possibilities to implement client side mechanisms. This talk will cover a new anti-CSRF Firefox Extension, which is currently under development as well as "RequestRodeo" - a client side proxy, which was, to the best of our knowledge, the first client-side solution for protection against XSRF attacks.
Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy
21:46
[Slides] CSRF, the Intranet and You
» ‎ SecDocs

Authors: Justus Winter Martin Johns
Tags: CSRF
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: A detailed introduction to Cross Site Request Forgery. This talk presents the fundamental cause of this vulnerability class and examples of potential attack consequences. The second half of the talk is devoted to avoiding and countering CSRF: Implementing CSRF proof session handling, transparent retrofitting of legacy applications and methods for client side protection. Cross Site Request Forgery (CSRF, a.k.a. Session Riding) attacks are public at least since 2001. However this class of web application vulnerabilities is rather obscure compared to attack vectors like Cross Site Scripting or SQL Injection. As the trend towards web applications continues and an increasing number of local programs and appliances like firewalls rely on web based frontends, the attack surface for CSRF grows continuously. While being is some cases as dangerous as e.g. Cross Site Scripting, CSRF vulnerabilities are often regarded as negligible. Moreover, this vulnerability class is often simply unknown to some web application developers. Many misconceptions on countering CSRF exist because of this obscurity. The talk will not only show how to avoid XSRF but also how NOT to do it. Furthermore, most presentations on CSRF only address attacks on cookie based session management. This talk will also cover attacks on http authentication, client side SSL and IP/Mac based access control. CSRF is an attack that targets the user rather than the web application. As long as web applications do not take measures to protect their users against this threat, it is important to investigate possibilities to implement client side mechanisms. This talk will cover a new anti-CSRF Firefox Extension, which is currently under development as well as "RequestRodeo" - a client side proxy, which was, to the best of our knowledge, the first client-side solution for protection against XSRF attacks.
Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy
12:07
[Audio] CSRF, the Intranet and You
» ‎ SecDocs

Authors: Justus Winter Martin Johns
Tags: CSRF
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: A detailed introduction to Cross Site Request Forgery. This talk presents the fundamental cause of this vulnerability class and examples of potential attack consequences. The second half of the talk is devoted to avoiding and countering CSRF: Implementing CSRF proof session handling, transparent retrofitting of legacy applications and methods for client side protection. Cross Site Request Forgery (CSRF, a.k.a. Session Riding) attacks are public at least since 2001. However this class of web application vulnerabilities is rather obscure compared to attack vectors like Cross Site Scripting or SQL Injection. As the trend towards web applications continues and an increasing number of local programs and appliances like firewalls rely on web based frontends, the attack surface for CSRF grows continuously. While being is some cases as dangerous as e.g. Cross Site Scripting, CSRF vulnerabilities are often regarded as negligible. Moreover, this vulnerability class is often simply unknown to some web application developers. Many misconceptions on countering CSRF exist because of this obscurity. The talk will not only show how to avoid XSRF but also how NOT to do it. Furthermore, most presentations on CSRF only address attacks on cookie based session management. This talk will also cover attacks on http authentication, client side SSL and IP/Mac based access control. CSRF is an attack that targets the user rather than the web application. As long as web applications do not take measures to protect their users against this threat, it is important to investigate possibilities to implement client side mechanisms. This talk will cover a new anti-CSRF Firefox Extension, which is currently under development as well as "RequestRodeo" - a client side proxy, which was, to the best of our knowledge, the first client-side solution for protection against XSRF attacks.
Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy
August 24, 2012
21:31
[Video] Rootkits as Reversing Tools
» ‎ SecDocs

Authors: Alan Bradley
Tags: reverse engineering rootkit
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk will cover two rootkits used as reverse engineering tools, one rootkit support library, one IDA plugin, and talk setup material. The talk itself will be given over VOIP and VNC running over the Tor network to demonstrate a proof of concept on anonymous public speech. This talk will present Tron, an extension of the Shadow Walker memory cloaker technique. Tron is a kernel driver who can cloak userland memory, and provides an API that allows the user to cloak arbitrary process memory, set permissions, signal changes of trust, conceal DLLs, and read/write hidden memory. An accompanying IDA plugin that uses this API to conceal software breakpoints will be discussed, and Another Debugger Hiding Driver, or ADHD will be presented as well. While these tools have many legitimate uses from malware analysis to legal reverse engineering and program modding, it is possible that Tron in particular can be used as a component of a "copyright circumvention device", which renders it prohibited by the USA DMCA. For this reason, but more so out of a desire to demonstrate a "proof of concept" for how to anonymously speak publicly, the speaker will be giving the talk over VOIP and VNC relayed through the Tor network. In addition to taking questions over VOIP, the speaker will also be briefly available on IRC afterwords for questions + discussion about Tron, reverse engineering, and the speech setup.
Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver
21:31
[Paper] Rootkits as Reversing Tools
» ‎ SecDocs

Authors: Alan Bradley
Tags: reverse engineering rootkit
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk will cover two rootkits used as reverse engineering tools, one rootkit support library, one IDA plugin, and talk setup material. The talk itself will be given over VOIP and VNC running over the Tor network to demonstrate a proof of concept on anonymous public speech. This talk will present Tron, an extension of the Shadow Walker memory cloaker technique. Tron is a kernel driver who can cloak userland memory, and provides an API that allows the user to cloak arbitrary process memory, set permissions, signal changes of trust, conceal DLLs, and read/write hidden memory. An accompanying IDA plugin that uses this API to conceal software breakpoints will be discussed, and Another Debugger Hiding Driver, or ADHD will be presented as well. While these tools have many legitimate uses from malware analysis to legal reverse engineering and program modding, it is possible that Tron in particular can be used as a component of a "copyright circumvention device", which renders it prohibited by the USA DMCA. For this reason, but more so out of a desire to demonstrate a "proof of concept" for how to anonymously speak publicly, the speaker will be giving the talk over VOIP and VNC relayed through the Tor network. In addition to taking questions over VOIP, the speaker will also be briefly available on IRC afterwords for questions + discussion about Tron, reverse engineering, and the speech setup.
Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver
21:31
[Audio] Rootkits as Reversing Tools
» ‎ SecDocs

Authors: Alan Bradley
Tags: reverse engineering rootkit
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk will cover two rootkits used as reverse engineering tools, one rootkit support library, one IDA plugin, and talk setup material. The talk itself will be given over VOIP and VNC running over the Tor network to demonstrate a proof of concept on anonymous public speech. This talk will present Tron, an extension of the Shadow Walker memory cloaker technique. Tron is a kernel driver who can cloak userland memory, and provides an API that allows the user to cloak arbitrary process memory, set permissions, signal changes of trust, conceal DLLs, and read/write hidden memory. An accompanying IDA plugin that uses this API to conceal software breakpoints will be discussed, and Another Debugger Hiding Driver, or ADHD will be presented as well. While these tools have many legitimate uses from malware analysis to legal reverse engineering and program modding, it is possible that Tron in particular can be used as a component of a "copyright circumvention device", which renders it prohibited by the USA DMCA. For this reason, but more so out of a desire to demonstrate a "proof of concept" for how to anonymously speak publicly, the speaker will be giving the talk over VOIP and VNC relayed through the Tor network. In addition to taking questions over VOIP, the speaker will also be briefly available on IRC afterwords for questions + discussion about Tron, reverse engineering, and the speech setup.
Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver
August 22, 2012
21:53
[Video] Advanced Attacks Against PocketPC Phones
» ‎ SecDocs

Authors: Collin Mulliner
Tags: PocketPC
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Smart phones are the new favorite target of many attackers. Also most current attacks are harmless, since these mostly rely on user mistake or lack of better knowledge. Current attacks are mostly based on logic errors rather then code inject and often are only found by accident. The talk will show some real attacks against smart phones and the kind of vulnerability analysis which lead to their discovery. This talk is about a security analysis of the PocketPC MMS (Multimedia Messaging Service) client. We will start with some background information about some older attacks against mobile phones. In the next step we will introduce to PocketPC-based phones and their security. Further we will introduce to the Multimedia Messaging Service. Here we will show how it works and how MMS messages look like under the microscope. In the main part we analyze the PocketPC MMS client and build a fuzzer for it. Since we want avoid costs by sending real MMS messages we build our own virtual mms system and make PocketPC believe that this is the real thing. In the end we will present the bugs and vulnerabilities we found, including the methods for exploiting them such as how to build your own MMS-client. So far I planned to release all information that I have kept back at defcon (exploit code, mms-client, etc...).
Tags: talk mms pocketpc collin-mulliner chaos-communication-congress mms-multimedia-messaging-service multimedia-messaging-service
21:53
[Audio] Advanced Attacks Against PocketPC Phones
» ‎ SecDocs

Authors: Collin Mulliner
Tags: PocketPC
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Smart phones are the new favorite target of many attackers. Also most current attacks are harmless, since these mostly rely on user mistake or lack of better knowledge. Current attacks are mostly based on logic errors rather then code inject and often are only found by accident. The talk will show some real attacks against smart phones and the kind of vulnerability analysis which lead to their discovery. This talk is about a security analysis of the PocketPC MMS (Multimedia Messaging Service) client. We will start with some background information about some older attacks against mobile phones. In the next step we will introduce to PocketPC-based phones and their security. Further we will introduce to the Multimedia Messaging Service. Here we will show how it works and how MMS messages look like under the microscope. In the main part we analyze the PocketPC MMS client and build a fuzzer for it. Since we want avoid costs by sending real MMS messages we build our own virtual mms system and make PocketPC believe that this is the real thing. In the end we will present the bugs and vulnerabilities we found, including the methods for exploiting them such as how to build your own MMS-client. So far I planned to release all information that I have kept back at defcon (exploit code, mms-client, etc...).
Tags: talk mms pocketpc collin-mulliner chaos-communication-congress mms-multimedia-messaging-service multimedia-messaging-service
August 11, 2012
21:56
[Video] A Case Against C++
» ‎ SecDocs

Authors: Felix von Leitner
Tags: C / C++
Event: Chaos Communication Camp 2007
Abstract: The selling points for C++ are mostly focused on how it supposedly makes it easier to write code. This talk will argue that it is much more important to make code easy to read, and in that respect C++ is a huge regression compared to C. The talk is mostly from the perspective of a professional code auditor. The point of the talk is to get people to think about how others (and themselves!) will have to read and understand the code in the future. This point is also true for other programming languages, so this is not just about C++ bashing, it is about showing what coding style is good for future generations and which will just get you in trouble. The examples will mostly be C++, obviously, but people from other programming languages might learn a thing or two from the talk, too.
Tags: talk code point c.--the felix-von-leitner chaos-communication-camp future-generations
21:56
[Video] GPS-Trackers
» ‎ SecDocs

Authors: Marvin Mauersberger
Tags: GPS
Event: Chaos Communication Camp 2007
Abstract: This talk gives a detailed overview on the state of the art of GPS tracking system (aka. location bugs), how they work and how to find and defeat them. GPS based tracking of peoples, cars and things is quickly becoming a real threat to personal privacy. Trackers are now cheap and easy to build and deliver high position accuracy and real-time transmission if desired. Low-power electronics and modern battery technology combined result in tracking systems that can live for weeks and months hidden in your car, motorbike or even backpack, transmitting your moves and whereabouts unknown to you to unfriendly people. The talk describes how GPS trackers work, how and where they are usually hidden, how you can find them (by physical search and other means) and what you can do against them. We will also briefly cover GPS chips in mobile phones and tracking by mobile phones in general.
Tags: talk video gps marvin-mauersberger chaos-communication-camp gps-trackers low-power-electronics
21:56
[Slides] A Case Against C++
» ‎ SecDocs

Authors: Felix von Leitner
Tags: C / C++
Event: Chaos Communication Camp 2007
Abstract: The selling points for C++ are mostly focused on how it supposedly makes it easier to write code. This talk will argue that it is much more important to make code easy to read, and in that respect C++ is a huge regression compared to C. The talk is mostly from the perspective of a professional code auditor. The point of the talk is to get people to think about how others (and themselves!) will have to read and understand the code in the future. This point is also true for other programming languages, so this is not just about C++ bashing, it is about showing what coding style is good for future generations and which will just get you in trouble. The examples will mostly be C++, obviously, but people from other programming languages might learn a thing or two from the talk, too.
Tags: talk code point c.--the felix-von-leitner chaos-communication-camp future-generations
August 10, 2012
14:34
[Video] Console Hacking 2006
» ‎ SecDocs

Authors: Felix Domke
Tags: games
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: "Next Generation" gaming consoles should not be limited to games, they have powerful hardware which we want to exploit for our needs. The talk gives a hardware overview of each of the 3 consoles, an overview of their security systems, as well as an update on hacking the Xbox 360, which has been on the market for about a year. The Microsoft Xbox 360, the Sony Playstation 3 and the Nintendo Wii belong to the seventh generation of gaming consoles, having GHz-class CPUs and hundreds of megabytes of RAM. While the Xbox 360 has been released roughly a year ago, and some hacking has already gone on, the Playstation 3 and the Wii will only be released in November 2006, so they will be brand-new at the time of the talk. Usual news sources focus on the features useful for gaming - this talk of course will focus on what we hackers really need. It evaluates possible attack points to execute homebrew code and professional operating systems. For the two systems that have just been released, you certainly cannot expect a working hack, but the basics of the security system will be explained, and it will be compared to existing systems implemented by previous consoles.
Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii
14:29
[Paper] Console Hacking 2006
» ‎ SecDocs

Authors: Felix Domke
Tags: games
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: "Next Generation" gaming consoles should not be limited to games, they have powerful hardware which we want to exploit for our needs. The talk gives a hardware overview of each of the 3 consoles, an overview of their security systems, as well as an update on hacking the Xbox 360, which has been on the market for about a year. The Microsoft Xbox 360, the Sony Playstation 3 and the Nintendo Wii belong to the seventh generation of gaming consoles, having GHz-class CPUs and hundreds of megabytes of RAM. While the Xbox 360 has been released roughly a year ago, and some hacking has already gone on, the Playstation 3 and the Wii will only be released in November 2006, so they will be brand-new at the time of the talk. Usual news sources focus on the features useful for gaming - this talk of course will focus on what we hackers really need. It evaluates possible attack points to execute homebrew code and professional operating systems. For the two systems that have just been released, you certainly cannot expect a working hack, but the basics of the security system will be explained, and it will be compared to existing systems implemented by previous consoles.
Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii
14:28
[Audio] Console Hacking 2006
» ‎ SecDocs

Authors: Felix Domke
Tags: games
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: "Next Generation" gaming consoles should not be limited to games, they have powerful hardware which we want to exploit for our needs. The talk gives a hardware overview of each of the 3 consoles, an overview of their security systems, as well as an update on hacking the Xbox 360, which has been on the market for about a year. The Microsoft Xbox 360, the Sony Playstation 3 and the Nintendo Wii belong to the seventh generation of gaming consoles, having GHz-class CPUs and hundreds of megabytes of RAM. While the Xbox 360 has been released roughly a year ago, and some hacking has already gone on, the Playstation 3 and the Wii will only be released in November 2006, so they will be brand-new at the time of the talk. Usual news sources focus on the features useful for gaming - this talk of course will focus on what we hackers really need. It evaluates possible attack points to execute homebrew code and professional operating systems. For the two systems that have just been released, you certainly cannot expect a working hack, but the basics of the security system will be explained, and it will be compared to existing systems implemented by previous consoles.
Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii
August 06, 2012
15:15
[Video] Hackerspaces
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Hackerspaces are community-run places where you can meet, work on projects, organize events and workshops, or just generally hang out with other hackers. More and more of those open spaces are being created all the time. Some of them are more than a decade old already, some just started out recently, and yet others might become a reality soon. Building and running a Hacker Lab is a tough thing. This is a talk about problems encountered, and lessons learnt. In this talk you'll see pictures and hear stories from Hacklabs around the world. Some of them old, some of them new, some big, some small, some squatted, and some of them even government funded, and what problems they've encountered, and how they've dealt with them. These stories are meant to inspire, and convey the mindset and organizational structure some of those hackerspaces have learned, to build and foster their community.
Tags: talk video Hackerspaces chaos-communication-congress 23th open-spaces
15:08
[Audio] Hackerspaces
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Hackerspaces are community-run places where you can meet, work on projects, organize events and workshops, or just generally hang out with other hackers. More and more of those open spaces are being created all the time. Some of them are more than a decade old already, some just started out recently, and yet others might become a reality soon. Building and running a Hacker Lab is a tough thing. This is a talk about problems encountered, and lessons learnt. In this talk you'll see pictures and hear stories from Hacklabs around the world. Some of them old, some of them new, some big, some small, some squatted, and some of them even government funded, and what problems they've encountered, and how they've dealt with them. These stories are meant to inspire, and convey the mindset and organizational structure some of those hackerspaces have learned, to build and foster their community.
Tags: talk Hackerspaces audio chaos-communication-congress 23th open-spaces
August 01, 2012
11:51
[Video] Hacking a Country: FOSS in India
» ‎ SecDocs

Authors: Atul Chitnis
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk is about the growth of Free Software in India. It includes an overview of how Free Software has spread not only within the industry but also with in the Government and Education. Includes examples of Indian innovation based on Free Software, including the Simputer. Atul Chitnis has promoted Free and Open Source Software (FOSS) and driven community initiatives in India since the mid 1990s. In this talk, he presents an overview of these activities, from pushing a million Linux CDs into the country via the PCQuest Linux Initiative, engaging the community with industry and government through participation in large scale events, to the founding of Asia's best known and most successful FOSS event series (FOSS.IN, formerly known as "Linux Bangalore"). He also presents samples of his current work, which includes the opening of technologies associated with the Simputer, whose future he now guides as part of his work at Geodesic Information Systems. His talk will include demonstrations of the technologies involved. Finally, he will explain some of the "social hacks" he has resorted to over the years to force the FOSS community, the Indian government and the industry to get talking to each other, and will summarize the direction and future of FOSS not only India but in Asia.
Tags: talk free Software foss india asia bangalore chaos-communication-congress social-hacks open-source-software
11:45
[Slides] Hacking a Country: FOSS in India
» ‎ SecDocs

Authors: Atul Chitnis
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk is about the growth of Free Software in India. It includes an overview of how Free Software has spread not only within the industry but also with in the Government and Education. Includes examples of Indian innovation based on Free Software, including the Simputer. Atul Chitnis has promoted Free and Open Source Software (FOSS) and driven community initiatives in India since the mid 1990s. In this talk, he presents an overview of these activities, from pushing a million Linux CDs into the country via the PCQuest Linux Initiative, engaging the community with industry and government through participation in large scale events, to the founding of Asia's best known and most successful FOSS event series (FOSS.IN, formerly known as "Linux Bangalore"). He also presents samples of his current work, which includes the opening of technologies associated with the Simputer, whose future he now guides as part of his work at Geodesic Information Systems. His talk will include demonstrations of the technologies involved. Finally, he will explain some of the "social hacks" he has resorted to over the years to force the FOSS community, the Indian government and the industry to get talking to each other, and will summarize the direction and future of FOSS not only India but in Asia.
Tags: talk free Software foss india asia bangalore chaos-communication-congress social-hacks open-source-software
11:45
[Audio] Hacking a Country: FOSS in India
» ‎ SecDocs

Authors: Atul Chitnis
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk is about the growth of Free Software in India. It includes an overview of how Free Software has spread not only within the industry but also with in the Government and Education. Includes examples of Indian innovation based on Free Software, including the Simputer. Atul Chitnis has promoted Free and Open Source Software (FOSS) and driven community initiatives in India since the mid 1990s. In this talk, he presents an overview of these activities, from pushing a million Linux CDs into the country via the PCQuest Linux Initiative, engaging the community with industry and government through participation in large scale events, to the founding of Asia's best known and most successful FOSS event series (FOSS.IN, formerly known as "Linux Bangalore"). He also presents samples of his current work, which includes the opening of technologies associated with the Simputer, whose future he now guides as part of his work at Geodesic Information Systems. His talk will include demonstrations of the technologies involved. Finally, he will explain some of the "social hacks" he has resorted to over the years to force the FOSS community, the Indian government and the industry to get talking to each other, and will summarize the direction and future of FOSS not only India but in Asia.
Tags: talk free Software foss india asia bangalore chaos-communication-congress social-hacks open-source-software
July 31, 2012
14:47
[Video] We don't trust voting computers
» ‎ SecDocs

Authors: Rop Gonggrijp
Tags: election
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk covers the dutch campaign against unverifiable voting on computers, which is part of a growing movement world-wide to reject these computers. Successes in Ireland and (surprise) the US seem to indicate that media, law-makers and the general public are beginning to wake up. For far too long The Netherlands have been the European capital of 'black-box style' electronic voting. It was time someone challenged Nedap, the leading manufacturer of unverifiable voting "machines" in Europe, in their own country. The talk very briefly describes the international situation with regard to electronic Voting, with emphasis on European history and events. It then describes the dutch campaign that was set up this year. I will talk about the results of the FOIA (IFG) requests we made, the results of our lobbying as well as highlight some of the media attention we got. We need help: I will also try to motivate you, the listener, to become active against unverifiable e-Voting in/on your own country, bundesland, weblog, city, province, university or wherever else you can. We can win this one. And we must: either democracy destroys black-box voting or it will eventually destroy democracy.
Tags: talk voting dutch europe ireland the-netherlands chaos-communication-congress election-event black-box-voting
14:35
[Audio] We don't trust voting computers
» ‎ SecDocs

Authors: Rop Gonggrijp
Tags: election
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: This talk covers the dutch campaign against unverifiable voting on computers, which is part of a growing movement world-wide to reject these computers. Successes in Ireland and (surprise) the US seem to indicate that media, law-makers and the general public are beginning to wake up. For far too long The Netherlands have been the European capital of 'black-box style' electronic voting. It was time someone challenged Nedap, the leading manufacturer of unverifiable voting "machines" in Europe, in their own country. The talk very briefly describes the international situation with regard to electronic Voting, with emphasis on European history and events. It then describes the dutch campaign that was set up this year. I will talk about the results of the FOIA (IFG) requests we made, the results of our lobbying as well as highlight some of the media attention we got. We need help: I will also try to motivate you, the listener, to become active against unverifiable e-Voting in/on your own country, bundesland, weblog, city, province, university or wherever else you can. We can win this one. And we must: either democracy destroys black-box voting or it will eventually destroy democracy.
Tags: talk voting dutch europe ireland the-netherlands chaos-communication-congress election-event black-box-voting
July 24, 2012
12:46
[Video] How To Design A Decent User Interface
» ‎ SecDocs

Authors: Corinna Habets
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Prepare to be brainwashed! This talk wants you to switch from the developer's perspective to that of an average user to design better UIs. Let's face it, there's a lot of 'hard to use'-software out there. Worse, we're among those who program it. If we now consider that for average users the UI practically _is_ the application (i.e. as much as we may wish to, they don't care whether it's programmed well, only if they can use it) this is a catastrophe. Instead of empowering users, software often leaves them frustrated. This talk wants nothing less than to change your view on software and the way you develop it. The talk will introduce 'user-centered' design and show you how to: Know the user - Know the task - Act accordingly! Disclaimer: This presentation is neither about whether qt or fltk is better, nor about the fancying-up of GUIs.
Tags: talk Software user corinna-habets chaos-communication-congress user-centered-design fltk
12:33
[Paper] How To Design A Decent User Interface
» ‎ SecDocs

Authors: Corinna Habets
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Prepare to be brainwashed! This talk wants you to switch from the developer's perspective to that of an average user to design better UIs. Let's face it, there's a lot of 'hard to use'-software out there. Worse, we're among those who program it. If we now consider that for average users the UI practically _is_ the application (i.e. as much as we may wish to, they don't care whether it's programmed well, only if they can use it) this is a catastrophe. Instead of empowering users, software often leaves them frustrated. This talk wants nothing less than to change your view on software and the way you develop it. The talk will introduce 'user-centered' design and show you how to: Know the user - Know the task - Act accordingly! Disclaimer: This presentation is neither about whether qt or fltk is better, nor about the fancying-up of GUIs.
Tags: talk Software user corinna-habets chaos-communication-congress user-centered-design fltk
12:33
[Slides] How To Design A Decent User Interface
» ‎ SecDocs

Authors: Corinna Habets
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Prepare to be brainwashed! This talk wants you to switch from the developer's perspective to that of an average user to design better UIs. Let's face it, there's a lot of 'hard to use'-software out there. Worse, we're among those who program it. If we now consider that for average users the UI practically _is_ the application (i.e. as much as we may wish to, they don't care whether it's programmed well, only if they can use it) this is a catastrophe. Instead of empowering users, software often leaves them frustrated. This talk wants nothing less than to change your view on software and the way you develop it. The talk will introduce 'user-centered' design and show you how to: Know the user - Know the task - Act accordingly! Disclaimer: This presentation is neither about whether qt or fltk is better, nor about the fancying-up of GUIs.
Tags: talk Software user corinna-habets chaos-communication-congress user-centered-design fltk
12:32
[Audio] How To Design A Decent User Interface
» ‎ SecDocs

Authors: Corinna Habets
Tags: technology
Event: Chaos Communication Congress 23th (23C3) 2006
Abstract: Prepare to be brainwashed! This talk wants you to switch from the developer's perspective to that of an average user to design better UIs. Let's face it, there's a lot of 'hard to use'-software out there. Worse, we're among those who program it. If we now consider that for average users the UI practically _is_ the application (i.e. as much as we may wish to, they don't care whether it's programmed well, only if they can use it) this is a catastrophe. Instead of empowering users, software often leaves them frustrated. This talk wants nothing less than to change your view on software and the way you develop it. The talk will introduce 'user-centered' design and show you how to: Know the user - Know the task - Act accordingly! Disclaimer: This presentation is neither about whether qt or fltk is better, nor about the fancying-up of GUIs.
Tags: talk Software user corinna-habets chaos-communication-congress user-centered-design fltk
July 20, 2012
21:47
[Video] I know who you clicked last summer
» ‎ SecDocs

Authors: Svenja Schröder
Tags: intelligence social social engineering
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: This talk introduces some techniques of social network analysis and graph theory. It aims at using simple approaches for getting interesting facts about networks. I will use the data of a popular community to demonstrate some of the techniques. 'I'm not stalking, I'm just investigating' - Who hasn't ever heard this sentence from one of their friends? Whether it concerns connecting people and interest groups or item recommendations - most of the possibilities of the WWW today are based on the idea of networking. MySpace, Facebook or its German counterpart StudiVZ, just to name a few, are very popular communities these days, which aim at connecting people. All of those communities can be modelled as social networks allowing an automatic analysis to reveal interesting facts. In this talk I would like to introduce some of the technologies one could use to analyze such a network. While the list of algorithms and approaches is long, I want to emphasize on the things one can find out even using simple techniques. In order to do so, I will work on some data collected from a popular community to show some possibilities of analyzing.
Tags: talk network analysis chaos-communication-congress list-of-algorithms german-counterpart
July 19, 2012
21:26
[Slides] I know who you clicked last summer
» ‎ SecDocs

Authors: Svenja Schröder
Tags: intelligence social social engineering
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: This talk introduces some techniques of social network analysis and graph theory. It aims at using simple approaches for getting interesting facts about networks. I will use the data of a popular community to demonstrate some of the techniques. 'I'm not stalking, I'm just investigating' - Who hasn't ever heard this sentence from one of their friends? Whether it concerns connecting people and interest groups or item recommendations - most of the possibilities of the WWW today are based on the idea of networking. MySpace, Facebook or its German counterpart StudiVZ, just to name a few, are very popular communities these days, which aim at connecting people. All of those communities can be modelled as social networks allowing an automatic analysis to reveal interesting facts. In this talk I would like to introduce some of the technologies one could use to analyze such a network. While the list of algorithms and approaches is long, I want to emphasize on the things one can find out even using simple techniques. In order to do so, I will work on some data collected from a popular community to show some possibilities of analyzing.
Tags: talk network analysis chaos-communication-congress list-of-algorithms german-counterpart
21:26
[Audio] I know who you clicked last summer
» ‎ SecDocs

Authors: Svenja Schröder
Tags: intelligence social social engineering
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: This talk introduces some techniques of social network analysis and graph theory. It aims at using simple approaches for getting interesting facts about networks. I will use the data of a popular community to demonstrate some of the techniques. 'I'm not stalking, I'm just investigating' - Who hasn't ever heard this sentence from one of their friends? Whether it concerns connecting people and interest groups or item recommendations - most of the possibilities of the WWW today are based on the idea of networking. MySpace, Facebook or its German counterpart StudiVZ, just to name a few, are very popular communities these days, which aim at connecting people. All of those communities can be modelled as social networks allowing an automatic analysis to reveal interesting facts. In this talk I would like to introduce some of the technologies one could use to analyze such a network. While the list of algorithms and approaches is long, I want to emphasize on the things one can find out even using simple techniques. In order to do so, I will work on some data collected from a popular community to show some possibilities of analyzing.
Tags: talk network analysis chaos-communication-congress list-of-algorithms german-counterpart
July 18, 2012
21:27
[Audio] One Token to Rule Them All
» ‎ SecDocs

Authors: Luke Jennings
Tags: Windows
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: The defense techniques employed by large software manufacturers are getting better. This is particularly true of Microsoft who have improved the security of the software they make tremendously since their Trustworthy Computing initiative. Gone are the days of being able to penetrate any Microsoft system by firing off the RPC-DCOM exploit. The consequence of this is that post-exploitation has become increasingly important in order to "squeeze all the juice" out of every compromised system. Windows access tokens are integral to Microsoft's concept of single sign-on in an active directory environment. Compromising a system that has privileged tokens can allow for both local and domain privilege escalation. This talk aims to demonstrate just how devastating attacks of this form can be and introduces a new, open-source tool for penetration testers that provides powerful post-exploitation options for abusing tokens found residing on compromised systems. The functionality of this tool is also provided as a Meterpreter module for the Metasploit Framework to allow its use to be combined with the existing power of Metasploit. In addition, a complete methodology will be given for its use in penetration testing. This will include identifying tokens that can be used to access an otherwise secure target and then locating other systems that may house those tokens. A new vulnerability will also be revealed that appears to have been silently patched by Microsoft. The impact of this vulnerability is that privileged tokens can be found on systems long after the corresponding users have logged off. The talk will focus on introducing the audience to the concept of windows access tokens and how they are utilised within windows with a particular focus on their importance within windows forest/domain environments. The talk will then move on to demonstrate how their functionality can be abused for powerful post-exploitation options, culminating in a live demo of my tool being used to escalate privileges significantly after system compromises both locally and across a domain. Interesting, important and unexpected nuances of how these tokens behave will then be discussed to demonstrate how risk could be unknowingly exposed even by those who think they already have a grasp of these issues. The talk will then move focus towards the advantages of combining these techniques with the existing post-exploitation focussed meterpreter, which comes with the metasploit framework. Another live demo will then be given, showing how these techniques can be utilised from within a meterpreter session after having exploited a system with metasploit. The focus of the talk will then be shifted again to discuss how systems housing tokens with desirable privileges can be located on large networks, such that penetration attempts can be focussed on these. A live demo will be given of how this can achieved with my tool and then it will be discussed how these techniques can be incorporated into standard penetration testing methodologies such that it will often be possible to expose gaping holes in networks that would have otherwise been considered relatively secure. Finally, defence strategies will be dicussed in order for the audience to understand how best to defend themselves against these attacks.
Tags: talk microsoft system luke-jennings chaos-communication-congress open-source-tool trustworthy-computing-initiative
July 08, 2012
21:35
[Video] The history of guerilla knitting
» ‎ SecDocs

Authors: Rose White
Tags: social
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: "Guerrilla knitting" has a couple of meanings in the knitting community - to some, it merely means knitting in public, while to others, it means creating public art by knitted means. Contemporary knitters feel very clever for coming up with edgy language to describe their knitting, but the truth is that for decades there have been knitters and other textile artists who are at least as punk rock as today's needle-wielders. This talk will cover the vibrant history of contemporary knitting, with a focus on projects that will make you say, "Wow, that's knitted?" Feel free to bring knitting projects to the talk - let's get some public knitting going on at the conference!
Tags: talk video history rose-white chaos-communication-congress knitting-projects vibrant-history
July 07, 2012
21:56
[Audio] The history of guerilla knitting
» ‎ SecDocs

Authors: Rose White
Tags: social
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: "Guerrilla knitting" has a couple of meanings in the knitting community - to some, it merely means knitting in public, while to others, it means creating public art by knitted means. Contemporary knitters feel very clever for coming up with edgy language to describe their knitting, but the truth is that for decades there have been knitters and other textile artists who are at least as punk rock as today's needle-wielders. This talk will cover the vibrant history of contemporary knitting, with a focus on projects that will make you say, "Wow, that's knitted?" Feel free to bring knitting projects to the talk - let's get some public knitting going on at the conference!
Tags: talk audio history rose-white chaos-communication-congress knitting-projects vibrant-history
June 30, 2012
21:57
[Video] Toying with barcodes
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: barcode
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: The talk focuses on 1D and 2D barcode applications with interference possibilities for the ordinary citizen. Ever wondered what is in these blocks of squares on postal packages, letters and tickets? Playing with them might have interesting effects, reaching from good old fun to theft and severe impact. Barcodes have been around for ages, but most of the time were used as simple tags with a number. The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous. The talk gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world. This is going to be fun, tool release included.
Tags: talk fun barcode felix chaos-communication-congress barcode-applications 2d-barcodes
21:57
[Audio] Toying with barcodes
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: barcode
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: The talk focuses on 1D and 2D barcode applications with interference possibilities for the ordinary citizen. Ever wondered what is in these blocks of squares on postal packages, letters and tickets? Playing with them might have interesting effects, reaching from good old fun to theft and severe impact. Barcodes have been around for ages, but most of the time were used as simple tags with a number. The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous. The talk gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world. This is going to be fun, tool release included.
Tags: talk fun barcode felix chaos-communication-congress barcode-applications 2d-barcodes
21:57
[Slides] Toying with barcodes
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: barcode
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: The talk focuses on 1D and 2D barcode applications with interference possibilities for the ordinary citizen. Ever wondered what is in these blocks of squares on postal packages, letters and tickets? Playing with them might have interesting effects, reaching from good old fun to theft and severe impact. Barcodes have been around for ages, but most of the time were used as simple tags with a number. The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous. The talk gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world. This is going to be fun, tool release included.
Tags: talk fun barcode felix chaos-communication-congress barcode-applications 2d-barcodes
June 27, 2012
21:54
[Video] To be or I2P
» ‎ SecDocs

Authors: Jens Kubieziel
Tags: privacy
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: I2P is a message-based anonymizing network. It builds a virtual network between the communication endpoints. This talk will introduce the technical details of I2P and show some exemplary applications. I2P has a different approach than most other known anonymous applications. Maybe you know about the anonymisation network Tor. Here you have central directory servers, onion routers (relaying traffic), onion proxies (send and receive data from the user) and other software roles within the network. I2P calls every software a router and it can send and receive data for the user as well as relay traffic for other users. Furthermore I2P uses no central server for distributing information about routers. You'll get the information from I2P's network database. This is a pair of algorithms which share the network metadata. The routers participate in the Kademlia algorithm. It is derived from distributed hash table. My talk will tell you in detail how I2P work, what roles routers, gateways, netDb etc. plays. Furthermore I'll show differences and similarities to other anonymizing networks e. g. Tor and introduce some exemplary applications.
Tags: talk network communication jens-kubieziel authors tor chaos-communication-congress communication-endpoints onion-routers
21:54
[Audio] To be or I2P
» ‎ SecDocs

Authors: Jens Kubieziel
Tags: privacy
Event: Chaos Communication Congress 24th (24C3) 2007
Abstract: I2P is a message-based anonymizing network. It builds a virtual network between the communication endpoints. This talk will introduce the technical details of I2P and show some exemplary applications. I2P has a different approach than most other known anonymous applications. Maybe you know about the anonymisation network Tor. Here you have central directory servers, onion routers (relaying traffic), onion proxies (send and receive data from the user) and other software roles within the network. I2P calls every software a router and it can send and receive data for the user as well as relay traffic for other users. Furthermore I2P uses no central server for distributing information about routers. You'll get the information from I2P's network database. This is a pair of algorithms which share the network metadata. The routers participate in the Kademlia algorithm. It is derived from distributed hash table. My talk will tell you in detail how I2P work, what roles routers, gateways, netDb etc. plays. Furthermore I'll show differences and similarities to other anonymizing networks e. g. Tor and introduce some exemplary applications.
Tags: talk network communication jens-kubieziel authors tor chaos-communication-congress communication-endpoints onion-routers
June 05, 2012
21:29
[Audio] The Ultimate Commodore 64 Talk
» ‎ SecDocs

Authors: Michael Steil
Tags: retrocomputing
Event: Chaos Communication Congress 25th (25C3) 2008
Abstract: Retrocomputing is cool as never before. People play C64 games in emulators and listen to SID music, but few people know much about the C64 architecture. This talk attempts to communicate "everything about the C64" to the listener, including its internals and quirks, as well as the tricks that have been used in the demoscene, trying to revive the spirit of times when programmers counted clock cycles and hardware limitations were seen as a challenge.
Tags: audio talk ultimate michael-steil sid chaos-communication-congress spirit-of-times sid-music
June 02, 2012
8:24
[Video] Data Mining Your City
» ‎ SecDocs

Authors: Steph Alarcon
Tags: data mining
Event: Chaos Communication Camp 2011
Abstract: Philadelphia (USA) recently launched an initiative to open up tons of city records and municipal data. This talk will review some of the things people are using it for, and show how open city data is useful to many kinds of people. Philadelphia (USA) recently launched an initiative to open up tons of city records and municipal data. By the time Camp rolls around, there will have been several hackathons and programs in Philadelphia using this newly available data, from a GIS firm to journalists to (probably) participants in Random Hacks of Kindness. This talk will give a snapshot of how Philadelphians are using and benefiting from this data, what apps are coming out of it, how it helps citizens and city government alike. If disadvantages are found they will also be discussed along, with some of the concerns that prevented the data from being available before. Hopefully this talk will provide ideas for people in other places who want to use data to make their cities better, stronger, more just, more liveable/bikeable/walkable, and more fun all around. Information will come from my own participation in organizing Philadelphia's contribution to Random Hacks of Kindness in June, possibly another city--oriented hackathon the next weekend with partners from Seattle, WA, and from interviews with organizers and coders from other events using open city data.
Tags: talk city mining steph-alarcon philadelphia seattle usa chaos-communication-camp philadelphia-usa time-camp
8:13
[Slides] Data Mining Your City
» ‎ SecDocs

Authors: Steph Alarcon
Tags: data mining
Event: Chaos Communication Camp 2011
Abstract: Philadelphia (USA) recently launched an initiative to open up tons of city records and municipal data. This talk will review some of the things people are using it for, and show how open city data is useful to many kinds of people. Philadelphia (USA) recently launched an initiative to open up tons of city records and municipal data. By the time Camp rolls around, there will have been several hackathons and programs in Philadelphia using this newly available data, from a GIS firm to journalists to (probably) participants in Random Hacks of Kindness. This talk will give a snapshot of how Philadelphians are using and benefiting from this data, what apps are coming out of it, how it helps citizens and city government alike. If disadvantages are found they will also be discussed along, with some of the concerns that prevented the data from being available before. Hopefully this talk will provide ideas for people in other places who want to use data to make their cities better, stronger, more just, more liveable/bikeable/walkable, and more fun all around. Information will come from my own participation in organizing Philadelphia's contribution to Random Hacks of Kindness in June, possibly another city--oriented hackathon the next weekend with partners from Seattle, WA, and from interviews with organizers and coders from other events using open city data.
Tags: talk city mining steph-alarcon philadelphia seattle usa chaos-communication-camp philadelphia-usa time-camp
May 28, 2012
21:47
[Video] There's Gold in Them Circuit Boards
» ‎ SecDocs

Authors: Steph Alarcon
Tags: ecology
Event: Chaos Communication Camp 2011
Abstract: Everything we do as technologists depends on the critical minerals from which our devices are made. Recycling junk electronics is no longer just the right thing to do, it's the smart thing to do. Everything we do as technologists depends on the critical minerals from which our devices are made. From iron, aluminum and plastic, to gold, coltan and rare earth metals impact, these raw materials affect the availability and price of the electronics we use all the time. What happens at the end of their useful lives? By now, the problems with electronic waste are well known: Recycling is difficult and expensive, and exportation of junk electronics from rich to poor nations incentivizes informal recycling that is incredibly dangerous to workers and harmful to the environment. But with extreme monopolization of certain mineral markets, particularly China's domination of the rare earths market, recycling has ceased to be simply a good thing to do, and now provides an economic hedge against volatile commodities markets. This talk will be an update of a talk I gave at The Next Hope (July, 2010, New York City, link below) and will outline the e-waste problem and how both regulations and materials innovation in places like the EU and Japan have put them ahead of the manufacturing curve, with special emphasis on rare earth elements. Any specific questions from economics to chemistry that are sent in advance, will be researched and answered the best I can. I work at a research university so there are lots of smart people to ask. A draft of my capstone paper is available if you'd like to take a closer look at how I approach the topic. Please note that the paper linked below is a draft...the final draft is due May 3, after the deadline for talk submissions! Talk image is courtesy of Greenpeace.
Tags: thing talk recycling steph-alarcon japan new-york-city chaos-communication-camp rare-earth-metals rare-earth-elements
21:47
[Slides] There's Gold in Them Circuit Boards
» ‎ SecDocs

Authors: Steph Alarcon
Tags: ecology
Event: Chaos Communication Camp 2011
Abstract: Everything we do as technologists depends on the critical minerals from which our devices are made. Recycling junk electronics is no longer just the right thing to do, it's the smart thing to do. Everything we do as technologists depends on the critical minerals from which our devices are made. From iron, aluminum and plastic, to gold, coltan and rare earth metals impact, these raw materials affect the availability and price of the electronics we use all the time. What happens at the end of their useful lives? By now, the problems with electronic waste are well known: Recycling is difficult and expensive, and exportation of junk electronics from rich to poor nations incentivizes informal recycling that is incredibly dangerous to workers and harmful to the environment. But with extreme monopolization of certain mineral markets, particularly China's domination of the rare earths market, recycling has ceased to be simply a good thing to do, and now provides an economic hedge against volatile commodities markets. This talk will be an update of a talk I gave at The Next Hope (July, 2010, New York City, link below) and will outline the e-waste problem and how both regulations and materials innovation in places like the EU and Japan have put them ahead of the manufacturing curve, with special emphasis on rare earth elements. Any specific questions from economics to chemistry that are sent in advance, will be researched and answered the best I can. I work at a research university so there are lots of smart people to ask. A draft of my capstone paper is available if you'd like to take a closer look at how I approach the topic. Please note that the paper linked below is a draft...the final draft is due May 3, after the deadline for talk submissions! Talk image is courtesy of Greenpeace.
Tags: thing talk recycling steph-alarcon japan new-york-city chaos-communication-camp rare-earth-metals rare-earth-elements
May 21, 2012
21:34
[Video] Hacking DNA
» ‎ SecDocs

Authors: Marc Juul
Tags: science
Event: Chaos Communication Camp 2011
Abstract: Genetic modification is getting cheaper and biohackers are making it more accessible. This talk outlines the state of DIYbio and institutional synthetic biology; current challenges in biological programming and why you should be hacking biology. The technology to program biological self-replicating machines is here now. Synthetic biologists are reverse-engineering living cells and building bio-compilers that will facilitate abstract design of complex genetic programs. This talk will show how such a genetic program can be written using freely available parts and design tools. How the DNA can be synthesized, assembled, inserted into a cell culture and the result debugged. The tools to accomplish this exist in two spaces: The wetlab (biological) and the drylab (software). Wetlab access continues to be a limiting factor in participation by the wider community of citizen scientists, hackers and makers. Access restrictions both technological and legal are not foreign to hackers, and biohackers are currently facing obstacles such as GMO laws, expensive lab equipment and restricted access to materials, yet DIYbio groups around the world are building labs, acquiring expertise and making this technology available to everyone. This talk gives an overview of the gap in capabilities between professional labs and DIYbio labs, how it can be overcome, and the unique challenges of biosafety, ethics and intellectual property in biology.
Tags: talk biology access marc-juul diybio chaos-communication-camp citizen-scientists professional-labs
21:34
[Slides] Hacking DNA
» ‎ SecDocs

Authors: Marc Juul
Tags: science
Event: Chaos Communication Camp 2011
Abstract: Genetic modification is getting cheaper and biohackers are making it more accessible. This talk outlines the state of DIYbio and institutional synthetic biology; current challenges in biological programming and why you should be hacking biology. The technology to program biological self-replicating machines is here now. Synthetic biologists are reverse-engineering living cells and building bio-compilers that will facilitate abstract design of complex genetic programs. This talk will show how such a genetic program can be written using freely available parts and design tools. How the DNA can be synthesized, assembled, inserted into a cell culture and the result debugged. The tools to accomplish this exist in two spaces: The wetlab (biological) and the drylab (software). Wetlab access continues to be a limiting factor in participation by the wider community of citizen scientists, hackers and makers. Access restrictions both technological and legal are not foreign to hackers, and biohackers are currently facing obstacles such as GMO laws, expensive lab equipment and restricted access to materials, yet DIYbio groups around the world are building labs, acquiring expertise and making this technology available to everyone. This talk gives an overview of the gap in capabilities between professional labs and DIYbio labs, how it can be overcome, and the unique challenges of biosafety, ethics and intellectual property in biology.
Tags: talk biology access marc-juul diybio chaos-communication-camp citizen-scientists professional-labs
May 14, 2012
21:51
[Audio] Having fun with RTP
» ‎ SecDocs

Tags: VoIP
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: A lot of people are interested and involved in voice over IP security. Most of the effort is concentrated on the security of the signalling protocols. This talk is focussing on the security of the voice part involved in todays voice over IP world. It is the result of the questions that I had to ask myself while i was debugging audio quality problems of customers and implementing a RTP stack from scratch. The talk gives an introduction on the shortcomings of the Realtime Transport Protocol (RTP), how systems attempt to work around them and how they introduce security vulnerabilites. A few short demonstrations will give an idea on how they can be exploited in the real world (denial of service, man in the middle attacks, call redirection). The last part of the talk will discuss some solutions to fix those vulnerabilities.
Tags: talk security rtp chaos-communication-congress security-vulnerabilites transport-protocol
14:41
[Video] Having fun with RTP
» ‎ SecDocs

Tags: VoIP
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: A lot of people are interested and involved in voice over IP security. Most of the effort is concentrated on the security of the signalling protocols. This talk is focussing on the security of the voice part involved in todays voice over IP world. It is the result of the questions that I had to ask myself while i was debugging audio quality problems of customers and implementing a RTP stack from scratch. The talk gives an introduction on the shortcomings of the Realtime Transport Protocol (RTP), how systems attempt to work around them and how they introduce security vulnerabilites. A few short demonstrations will give an idea on how they can be exploited in the real world (denial of service, man in the middle attacks, call redirection). The last part of the talk will discuss some solutions to fix those vulnerabilities.
Tags: talk security rtp chaos-communication-congress security-vulnerabilites transport-protocol
14:24
[Slides] Having fun with RTP
» ‎ SecDocs

Tags: VoIP
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: A lot of people are interested and involved in voice over IP security. Most of the effort is concentrated on the security of the signalling protocols. This talk is focussing on the security of the voice part involved in todays voice over IP world. It is the result of the questions that I had to ask myself while i was debugging audio quality problems of customers and implementing a RTP stack from scratch. The talk gives an introduction on the shortcomings of the Realtime Transport Protocol (RTP), how systems attempt to work around them and how they introduce security vulnerabilites. A few short demonstrations will give an idea on how they can be exploited in the real world (denial of service, man in the middle attacks, call redirection). The last part of the talk will discuss some solutions to fix those vulnerabilities.
Tags: talk security rtp chaos-communication-congress security-vulnerabilites transport-protocol
May 08, 2012
21:50
[Video] Cybernetics for the Masses
» ‎ SecDocs

Authors: Lepht Anonym
Tags: science robotics
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: Lightning talk on biohacking, complete with cyborg speaker, implant demonstrations, and knowledge of how to hack your own perception of electromagnetic radiation for approximately thirty Euros. A talk on what's become my specialty - biohacking, or meathacking, whatever you wanna call it. I've got a full set of home-brewed implants, a subdermal RFID, a sort of cult on the Internet plus things like proven designs for cheap EM sensory nodes, experimental verification of that shit I'm claiming, etc. I have videos of procedures, photos of what I've been doing and the like, and will happily make gory slides for all to see. Can do demos of the EM nodes and RFID chip as well. I want to talk about the grinder movement - underground biohacking - it's my life. Thus, my article in H+ Magazine: "A call to arms for biohackers".
Tags: talk rfid call chaos-communication-congress electromagnetic-radiation experimental-verification
21:50
[Video] Lightning Talks - Day 4
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk! Whatever you do - please practise it, and don't be boring. Or else. You have been warned!
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects
21:50
[Audio] Cybernetics for the Masses
» ‎ SecDocs

Authors: Lepht Anonym
Tags: science robotics
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: Lightning talk on biohacking, complete with cyborg speaker, implant demonstrations, and knowledge of how to hack your own perception of electromagnetic radiation for approximately thirty Euros. A talk on what's become my specialty - biohacking, or meathacking, whatever you wanna call it. I've got a full set of home-brewed implants, a subdermal RFID, a sort of cult on the Internet plus things like proven designs for cheap EM sensory nodes, experimental verification of that shit I'm claiming, etc. I have videos of procedures, photos of what I've been doing and the like, and will happily make gory slides for all to see. Can do demos of the EM nodes and RFID chip as well. I want to talk about the grinder movement - underground biohacking - it's my life. Thus, my article in H+ Magazine: "A call to arms for biohackers".
Tags: talk rfid call chaos-communication-congress electromagnetic-radiation experimental-verification
April 29, 2012
21:35
[Video] Lightning Talks - Day 3
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk!
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects
21:35
[Audio] Lightning Talks - Day 3
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk!
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects

April 27, 2012
5:30
From LOW to PWNED [3] JBoss/Tomcat server-status
» ‎ Carnal0wnage
Several (tm) months back I did my talk on "From LOW to PWNED" at hashdays and BSides Atlanta.

The slides were published here and the video from hashdays is here, no video for BSides ATL.

I consistently violate presentation zen and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway.

Post [3] JBoss/Tomcat server-status

There have been some posts/exploits/modules on hitting up unprotected jboss and tomcat servers.

http://www.nruns.com/_downloads/Whitepaper-Hacking-jBoss-using-a-Browser.pdf
http://carnal0wnage.attackresearch.com/2009/11/hacking-unprotected-jboss-jmx-console.html
http://www.notsosecure.com/folder2/2009/10/27/hacking-jboss-with-jmx-console/
http://goohackle.com/jboss-security-vulnerability-jmx-management-console/

http://www.metasploit.com/modules/exploit/multi/http/jboss_maindeployer
http://www.metasploit.com/modules/exploit/multi/http/tomcat_mgr_deploy

Sometimes even though the deployer functionality is password protected the sever-status may not be.

/web-console/status?full=true

/manager/status/all

LOW?

This can be useful to find:
- Lists of applications
- Recent URL's accessed
- Find hidden services/apps
- Enabled servlets
- owned stuff :-)
Finding 0wned stuff is always fun let's see
Looking at the list of applications list one that doesnt look normal (zecmd)
Following that down leads us to zecmd.jsp that is a jsp shell

If you are interested in zecmd.jsp and jboss worm it comes from --> this is a good write up as well as this OWASP preso https://www.owasp.org/images/a/a9/OWASP3011_Luca.pdf
thoughts?
-CG

Tags: talk nbsp tomcat atlanta owasp security-vulnerability bsides Pentesting
April 19, 2012
13:21
From LOW to PWNED [0] Intro
» ‎ Carnal0wnage

Several (tm) months back I did my talk on "From LOW to PWNED" at hashdays and BSides Atlanta.

The slides were published here and the video from hashdays is here, no video for BSides ATL.

I consistently violate presentation zen and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway.

Post [0] Intro/The point of the talk (sorry no pics of msf or courier new font in this one):

I had several points (I think...maybe all the same point...whatever)

1. We tend to have an over reliance on vulnerability scanners to tell us everything that is vulnerable. To be honest I have been guilty of this myself. Most of us probably have a for a variety of reasons, time, experience, level of effort required/paid for, etc. This over reliance on scanners has lead to a "no highs" == "secure environment". Most of us know this is not *always* the case and the point of the talk was to show some examples were medium and low vulnerabilities have led to a further exploitation or impact that I would consider "high" or above. Whether you call them chained exploits, magic, or the natural evolution of taking multiple smaller vulnerabilities and turning them into a significant exploit or opportunity its becoming more normal/common to have to go this route.

2. Given the "no highs" == "secure environment" mentality some clients have been conditioned that anything that is not a high is not exploitable and therefore not a priority for fixing (sometimes ever). This of course is not the outcome most people would recommend. Nevertheless some people take that approach.

3. How many IDS/IPS signatures exist for low and medium vulns and how often do we ignore/disable those? Feedback welcome here.

4. Clients should pay attention to low/medium vulns as much as they do high+ vulns and in turn pentesters/VA people/security teams should also pay attention to low/medium vulns. Does that mean ever SSLv2 enabled should be full out emergency? Hell no, but *someone* needs to be able to vet that those low/medium findings cant be turned into something more.

5. Keep in a human in the mix. Tools/scanner are great for automating tasks but I don't think we are there yet with the technology of taking multiple less severe vulnerabilities and turning them into something significant. Bottom line, the scanner wont find all your ownable stuff, you need a person(s) to do this.

Thoughts?

-CG

Tags: talk nbsp medium atlanta vulnerability-scanners natural-evolution bsides

April 18, 2012
21:27
[Slides] Recent advances in IPv6 insecurities
» ‎ SecDocs

Authors: Marc Heuse
Tags: IPv6
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: New protocol features have been proposed and implemented in the last 5 years and ISPs are now slowly starting to deploy IPv6. This talk starts with a brief summary of the issues presented five years ago, and then expands on the new risks. Discovered implemention security issues in Windows 7/2008, Linux and Cisco will be shown too. Comes with a GPL'ed toolkit: thc-ipv6 Five years have past since my initial talk on IPv6 insecurities at the CCC Congress. New protocol features have been proposed and implemented since then and ISPs are now slowly starting to deploy IPv6. Few changes have led to a better security of the protocol, several increase the risk instead. This talk starts with a brief summary of the issues presented 5 years ago, and then expands on the new risks especially in multicast scenarios. As an add-on, discovered implemention security issues in Windows 7/2008, Linux and Cisco will be shown too. Lets hope patches are out until the conference, if not - they had enough time. All accompanied with GPL'ed tools to and a library: the new thc-ipv6 package. rewritten, expanded, enhanced.
Tags: talk ipv protocol marc-heuse chaos-communication-congress protocol-features
April 16, 2012
21:41
[Video] Hacking smart phones
» ‎ SecDocs

Authors: Ilja van Sprundel
Tags: phone
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: There's been a fair bit written and presented about smartphone's, and yet, when it comes to the attack surface of the operating systems running on them, and the applications running on top of those, much still has to be explorer. This talk will dive a bit deeper into that attack surface. This talk will take a look at the smart phone attack surface, only from and end-to-end point of view. the baseband type stuff and things owned by the telco's will not be covered. Basically, it'll cover 5 major areas: identifying operating systems (through for example the user-agent with mms) identifying entrypoints identifying trust boundaries identifying bugs exploiting bugs There has been a fair amount of cellphone and smartphone reseach done in the past, and yet, when it comes to attack surface, we've barely scratched the surface. SMS alone allows for a dozen or so different types of messages, there's mms, all sorts of media codecs are build into smart phones. The entrypoints can be roughly categorized as: primary entypoints: - zero-click remote attacks over default communication network (sms, mms, ...) secondary entrypoints: - zero-click remote attacks over non-default communication network (email, ...) tertiary entrypoints: - proximity attacks (wifi, bluetooth, irda, mitm wifi connection, ...) - not-zero click remote attacks (e.g. start application XYZ and connect to my evil server) The main focus in this talk will be on the primary entrypoints, however some of the secondary and tertiary entrypoints will be talked about aswell, in particular irda, since unlike bluetooth and wifi, very little security research has ever been done with irda, which on itself is weird, since after less than a day of poking around it became quite clear most irda stacks are pretty weak (as a hilarious irda sidenote which got me started to look at idra, one should read the following microsoft bulletin http://www.microsoft.com/technet/security/bulletin/ms01-046.mspx). once's the interesting entrypoints for various smartphones are explored the talk will dive into some of the trust boundaries on different smartphones, things their sandboxes allow, things they don't, wether or not it's documented and wether or not the documentation is actually accurate. in the spirit of keeping the best for last, some of the bugs discovered during the smartphone research will be discussed, both the details of them, as well as the pains the speaker had to go through to make exploits for them.
Tags: talk irda surface chaos-communication-congress evil-server sidenote
21:41
[Audio] Hacking smart phones
» ‎ SecDocs

Authors: Ilja van Sprundel
Tags: phone
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: There's been a fair bit written and presented about smartphone's, and yet, when it comes to the attack surface of the operating systems running on them, and the applications running on top of those, much still has to be explorer. This talk will dive a bit deeper into that attack surface. This talk will take a look at the smart phone attack surface, only from and end-to-end point of view. the baseband type stuff and things owned by the telco's will not be covered. Basically, it'll cover 5 major areas: identifying operating systems (through for example the user-agent with mms) identifying entrypoints identifying trust boundaries identifying bugs exploiting bugs There has been a fair amount of cellphone and smartphone reseach done in the past, and yet, when it comes to attack surface, we've barely scratched the surface. SMS alone allows for a dozen or so different types of messages, there's mms, all sorts of media codecs are build into smart phones. The entrypoints can be roughly categorized as: primary entypoints: - zero-click remote attacks over default communication network (sms, mms, ...) secondary entrypoints: - zero-click remote attacks over non-default communication network (email, ...) tertiary entrypoints: - proximity attacks (wifi, bluetooth, irda, mitm wifi connection, ...) - not-zero click remote attacks (e.g. start application XYZ and connect to my evil server) The main focus in this talk will be on the primary entrypoints, however some of the secondary and tertiary entrypoints will be talked about aswell, in particular irda, since unlike bluetooth and wifi, very little security research has ever been done with irda, which on itself is weird, since after less than a day of poking around it became quite clear most irda stacks are pretty weak (as a hilarious irda sidenote which got me started to look at idra, one should read the following microsoft bulletin http://www.microsoft.com/technet/security/bulletin/ms01-046.mspx). once's the interesting entrypoints for various smartphones are explored the talk will dive into some of the trust boundaries on different smartphones, things their sandboxes allow, things they don't, wether or not it's documented and wether or not the documentation is actually accurate. in the spirit of keeping the best for last, some of the bugs discovered during the smartphone research will be discussed, both the details of them, as well as the pains the speaker had to go through to make exploits for them.
Tags: talk irda surface chaos-communication-congress evil-server sidenote
April 14, 2012
21:33
[Video] Automatic Identification of Cryptographic Primitives in Software
» ‎ SecDocs

Authors: Felix Gröbert
Tags: cryptography
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: In this talk I demonstrate our research and the implementation of methods to detect cryptographic algorithms and their parameters in software. Based on our observations on cryptographic code, I will point out several inherent characteristics to design signature-based and generic identification methods. Using dynamic binary instrumentation, we record instructions of a program during runtime and create a fine-grained trace. We implement a trace analysis tool, which also provides methods to reconstruct high-level information from a trace, for example control flow graphs or loops, to detect cryptographic algorithms and their parameters. With the results of this work, encrypted data, sent by a malicious program for example, may be decrypted and used by an analyst to gain further insight on the behavior of the analyzed binary executable. Applications include de-DRM'ing, security auditing, and malware C&C analysis. After the talk we will demonstrate the functionality with a ransomware which uses cryptographic primitives and release the implementation to the public.
Tags: talk identification Software felix-grbert control-flow-graphs chaos-communication-congress cryptographic-primitives
21:33
[Slides] Automatic Identification of Cryptographic Primitives in Software
» ‎ SecDocs

Authors: Felix Gröbert
Tags: cryptography
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: In this talk I demonstrate our research and the implementation of methods to detect cryptographic algorithms and their parameters in software. Based on our observations on cryptographic code, I will point out several inherent characteristics to design signature-based and generic identification methods. Using dynamic binary instrumentation, we record instructions of a program during runtime and create a fine-grained trace. We implement a trace analysis tool, which also provides methods to reconstruct high-level information from a trace, for example control flow graphs or loops, to detect cryptographic algorithms and their parameters. With the results of this work, encrypted data, sent by a malicious program for example, may be decrypted and used by an analyst to gain further insight on the behavior of the analyzed binary executable. Applications include de-DRM'ing, security auditing, and malware C&C analysis. After the talk we will demonstrate the functionality with a ransomware which uses cryptographic primitives and release the implementation to the public.
Tags: talk identification Software felix-grbert control-flow-graphs chaos-communication-congress cryptographic-primitives
21:33
[Audio] Automatic Identification of Cryptographic Primitives in Software
» ‎ SecDocs

Authors: Felix Gröbert
Tags: cryptography
Event: Chaos Communication Congress 27th (27C3) 2010
Abstract: In this talk I demonstrate our research and the implementation of methods to detect cryptographic algorithms and their parameters in software. Based on our observations on cryptographic code, I will point out several inherent characteristics to design signature-based and generic identification methods. Using dynamic binary instrumentation, we record instructions of a program during runtime and create a fine-grained trace. We implement a trace analysis tool, which also provides methods to reconstruct high-level information from a trace, for example control flow graphs or loops, to detect cryptographic algorithms and their parameters. With the results of this work, encrypted data, sent by a malicious program for example, may be decrypted and used by an analyst to gain further insight on the behavior of the analyzed binary executable. Applications include de-DRM'ing, security auditing, and malware C&C analysis. After the talk we will demonstrate the functionality with a ransomware which uses cryptographic primitives and release the implementation to the public.
Tags: talk identification Software felix-grbert control-flow-graphs chaos-communication-congress cryptographic-primitives
March 31, 2012
21:29
[Video] Behind the scenes of a C64 demo
» ‎ SecDocs

Tags: retrocomputing
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: C64 "demos" were the root of the whole demo-scene-thing and they are still the main force keeping the C64 alive today. Audiovisual pleasure, still pushing hardware limits, still exploring different ways of expression. But what is typically happening inside the machine when you watch a demo? What effort is needed to entertain the audience? This talk will give you an inside look at the steps taken for the award winning demo "Error 23" given first hand by one of its main programmers. This talk extends previous talks and documentation about the Commodore 64 and its demo effects by adding real-life challenges and experiences to it. What were the basic ideas? What obstacles were on the way? How did they get solved? 6502 assembly knowledge is really not required, some general understanding about assembly and low-level computing will be useful, though (think of stack, timer, cycles...). This isn't about theory, this is for real ;)
Tags: talk assembly demo chaos-communication-congress demo-effects c64-demo
21:29
[Audio] Behind the scenes of a C64 demo
» ‎ SecDocs

Tags: retrocomputing
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: C64 "demos" were the root of the whole demo-scene-thing and they are still the main force keeping the C64 alive today. Audiovisual pleasure, still pushing hardware limits, still exploring different ways of expression. But what is typically happening inside the machine when you watch a demo? What effort is needed to entertain the audience? This talk will give you an inside look at the steps taken for the award winning demo "Error 23" given first hand by one of its main programmers. This talk extends previous talks and documentation about the Commodore 64 and its demo effects by adding real-life challenges and experiences to it. What were the basic ideas? What obstacles were on the way? How did they get solved? 6502 assembly knowledge is really not required, some general understanding about assembly and low-level computing will be useful, though (think of stack, timer, cycles...). This isn't about theory, this is for real ;)
Tags: talk assembly demo chaos-communication-congress demo-effects c64-demo
March 25, 2012
21:46
[Video] Ooops I hacked my PBX
» ‎ SecDocs

Tags: PBX VoIP
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk is cautionary tale about developers forgetting to remove debug interfaces from finished products and the need of repetitive system reviews. A midrange PBX systems (non web) configuration interface is used as an example of what flaws you can actually find in commercial systems. The Idea behind this talk is to give you an idea what can happen when developers do not audit their code on regular basis. It is not meant to make anybody laugh at another ones stupidity but as a reminder what could happen to YOU if you're a developer. As an example of what could possibly go wrong, a problem in the way the configuration interface is authenticating its administrators on a PBX is used. It is about dissecting a proprietary TCP/IP based protocol used to configure telephones with system integration through the PBX and unexpectedly finding a flaw which not only allows to modify configuration of phones but also manipulate the PBX. The even bigger oversight was that all communication is possible without using any authentication. It is also a little bit about protocol design and some (false) assumptions still made when when preparing an impending product launch. But for the sake of honesty: No names and no brands will be given, the talk is based upon a true example but because of responsible disclosure procedures not all information will be released to the public.
Tags: talk configuration pbx chaos-communication-congress disclosure-procedures false-assumptions
21:46
[Slides] Ooops I hacked my PBX
» ‎ SecDocs

Tags: PBX VoIP
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk is cautionary tale about developers forgetting to remove debug interfaces from finished products and the need of repetitive system reviews. A midrange PBX systems (non web) configuration interface is used as an example of what flaws you can actually find in commercial systems. The Idea behind this talk is to give you an idea what can happen when developers do not audit their code on regular basis. It is not meant to make anybody laugh at another ones stupidity but as a reminder what could happen to YOU if you're a developer. As an example of what could possibly go wrong, a problem in the way the configuration interface is authenticating its administrators on a PBX is used. It is about dissecting a proprietary TCP/IP based protocol used to configure telephones with system integration through the PBX and unexpectedly finding a flaw which not only allows to modify configuration of phones but also manipulate the PBX. The even bigger oversight was that all communication is possible without using any authentication. It is also a little bit about protocol design and some (false) assumptions still made when when preparing an impending product launch. But for the sake of honesty: No names and no brands will be given, the talk is based upon a true example but because of responsible disclosure procedures not all information will be released to the public.
Tags: talk configuration pbx chaos-communication-congress disclosure-procedures false-assumptions
21:46
[Audio] Ooops I hacked my PBX
» ‎ SecDocs

Tags: PBX VoIP
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk is cautionary tale about developers forgetting to remove debug interfaces from finished products and the need of repetitive system reviews. A midrange PBX systems (non web) configuration interface is used as an example of what flaws you can actually find in commercial systems. The Idea behind this talk is to give you an idea what can happen when developers do not audit their code on regular basis. It is not meant to make anybody laugh at another ones stupidity but as a reminder what could happen to YOU if you're a developer. As an example of what could possibly go wrong, a problem in the way the configuration interface is authenticating its administrators on a PBX is used. It is about dissecting a proprietary TCP/IP based protocol used to configure telephones with system integration through the PBX and unexpectedly finding a flaw which not only allows to modify configuration of phones but also manipulate the PBX. The even bigger oversight was that all communication is possible without using any authentication. It is also a little bit about protocol design and some (false) assumptions still made when when preparing an impending product launch. But for the sake of honesty: No names and no brands will be given, the talk is based upon a true example but because of responsible disclosure procedures not all information will be released to the public.
Tags: talk configuration pbx chaos-communication-congress disclosure-procedures false-assumptions

March 23, 2012
10:15
Cardboard framed tricopter
» ‎ Hack a Day

Talk about reducing the costs of a build, this tricopter uses cardboard as a frame and has one less motor than its quadcopter relatives. There are almost no details other than those shared in the video after the break so we’re just going to guess based on what we see (feel free to share your [...]
Tags: talk tricopter cardboard relatives misc hacks

March 22, 2012
15:00
[remote exploits] - Google Talk gtalk:// Deprecated Uri Handler Parameter Injection
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

[remote exploits] - Google Talk gtalk:// Deprecated Uri Handler Parameter Injection
Tags: google talk gtalk uri exploits

0:00
Vuln: Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability
» ‎ SecurityFocus Vulnerabilities

Google Talk '/gaiaserver' Parameter Information Disclosure Vulnerability
Tags: google talk gaiaserver information-disclosure-vulnerability

March 21, 2012
5:12
Google Talk Deprecated Handler Parameter Injection
» ‎ Packet Storm Security Exploits

Google Talk suffers from a gtalk:// deprecated URI handler /gaiaserver parameter injection vulnerability.
Tags: handler google talk uri gtalk vulnerability

5:12
Google Talk Deprecated Handler Parameter Injection
» ‎ Packet Storm Security Recent Files

Google Talk suffers from a gtalk:// deprecated URI handler /gaiaserver parameter injection vulnerability.
Tags: handler google talk uri gtalk vulnerability

5:12
Google Talk Deprecated Handler Parameter Injection
» ‎ Packet Storm Security Misc. Files

Google Talk suffers from a gtalk:// deprecated URI handler /gaiaserver parameter injection vulnerability.
Tags: handler google talk uri gtalk vulnerability

March 11, 2012
22:41
[Video] Data Mining the Israeli Census
» ‎ SecDocs

Authors: Yuval Adam
Tags: data mining
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: The entire Israeli civil registry database has been leaked to the internet several times over the past decade. In this talk, we examine interesting data that can be mined and extracted from such database. Additionally, we will review the implications of such data being publicly available in light of the upcoming biometric database. The Israeli census database has been freely available on the Internet since 2001. The database has been illegally leaked due to incompetent data security policies in the Ministry of Interior of Israel, which is responsible for the management of the Israeli census. The data available includes all personal data of every Israeli citizen: name, ID number, date and location of birth, address, phone number and marital status, as well as linkage to parents and spouses. In this talk we discuss various statistics, trends and anomalies that such data provides us with insight to. Personal details will obviously be left out of the talk, though it is important to note that any person who wishes to retrieve such details can easily do so. We will end the talk with a discussion about upcoming and relevant privacy issues in light of Israel's soon-to-be biometric database.
Tags: talk database census yuval-adam-tags israel chaos-communication-congress citizen-name census-database
22:41
[Slides] Data Mining the Israeli Census
» ‎ SecDocs

Authors: Yuval Adam
Tags: data mining
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: The entire Israeli civil registry database has been leaked to the internet several times over the past decade. In this talk, we examine interesting data that can be mined and extracted from such database. Additionally, we will review the implications of such data being publicly available in light of the upcoming biometric database. The Israeli census database has been freely available on the Internet since 2001. The database has been illegally leaked due to incompetent data security policies in the Ministry of Interior of Israel, which is responsible for the management of the Israeli census. The data available includes all personal data of every Israeli citizen: name, ID number, date and location of birth, address, phone number and marital status, as well as linkage to parents and spouses. In this talk we discuss various statistics, trends and anomalies that such data provides us with insight to. Personal details will obviously be left out of the talk, though it is important to note that any person who wishes to retrieve such details can easily do so. We will end the talk with a discussion about upcoming and relevant privacy issues in light of Israel's soon-to-be biometric database.
Tags: talk database census yuval-adam-tags israel chaos-communication-congress citizen-name census-database
22:41
[Audio] Data Mining the Israeli Census
» ‎ SecDocs

Authors: Yuval Adam
Tags: data mining
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: The entire Israeli civil registry database has been leaked to the internet several times over the past decade. In this talk, we examine interesting data that can be mined and extracted from such database. Additionally, we will review the implications of such data being publicly available in light of the upcoming biometric database. The Israeli census database has been freely available on the Internet since 2001. The database has been illegally leaked due to incompetent data security policies in the Ministry of Interior of Israel, which is responsible for the management of the Israeli census. The data available includes all personal data of every Israeli citizen: name, ID number, date and location of birth, address, phone number and marital status, as well as linkage to parents and spouses. In this talk we discuss various statistics, trends and anomalies that such data provides us with insight to. Personal details will obviously be left out of the talk, though it is important to note that any person who wishes to retrieve such details can easily do so. We will end the talk with a discussion about upcoming and relevant privacy issues in light of Israel's soon-to-be biometric database.
Tags: talk database census yuval-adam-tags israel chaos-communication-congress citizen-name census-database
22:41
[Video] Eating in the Anthropocene
» ‎ SecDocs

Authors: Cathrine Kramer Zack Denfeld
Tags: hacking
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Over the last few years hackers have begun to take a larger interest in food, gastronomy and agriculture. For many in the community the ability to create DIY molecular gastronomy hardware and recipes is an obvious entry point. This talk extends some of these early investigations beyond the kitchen and the chemical properties of food by looking at specific cultivars, food technology organizations, and connections between food systems, ecosystems and planetary change. Part 1 of the talk explores some of the more bizarre and interesting biotechnologies and genomes that make up the human food system on planet earth, including Chinese Space Potatoes, Mutagenic Grapefruits and Glowing Sushi. Pat 2 of the talk presents ideas of food system redesign particularly relevant to hackers and food explorers: utopian cuisines, resilient biotechnologies and eaters as agents of selection. In Part 3 we provide access to resources and propose interesting projects for black hat food hackers, DIY BIO foodies, and prospective food security researchers, such as mining the IAEA's database of radiation breeding, eating things that weren't meant to be eaten and defending agricultural biodiversity. By introducing less known stories from the history of food and technology, and providing access to resources we hope to get more hackers curious about exploring, questioning and redesigning our human food systems.
Tags: talk gastronomy food zack-denfeld chaos-communication-congress molecular-gastronomy agricultural-biodiversity
22:41
[Slides] Eating in the Anthropocene
» ‎ SecDocs

Authors: Cathrine Kramer Zack Denfeld
Tags: hacking
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Over the last few years hackers have begun to take a larger interest in food, gastronomy and agriculture. For many in the community the ability to create DIY molecular gastronomy hardware and recipes is an obvious entry point. This talk extends some of these early investigations beyond the kitchen and the chemical properties of food by looking at specific cultivars, food technology organizations, and connections between food systems, ecosystems and planetary change. Part 1 of the talk explores some of the more bizarre and interesting biotechnologies and genomes that make up the human food system on planet earth, including Chinese Space Potatoes, Mutagenic Grapefruits and Glowing Sushi. Pat 2 of the talk presents ideas of food system redesign particularly relevant to hackers and food explorers: utopian cuisines, resilient biotechnologies and eaters as agents of selection. In Part 3 we provide access to resources and propose interesting projects for black hat food hackers, DIY BIO foodies, and prospective food security researchers, such as mining the IAEA's database of radiation breeding, eating things that weren't meant to be eaten and defending agricultural biodiversity. By introducing less known stories from the history of food and technology, and providing access to resources we hope to get more hackers curious about exploring, questioning and redesigning our human food systems.
Tags: talk gastronomy food zack-denfeld chaos-communication-congress molecular-gastronomy agricultural-biodiversity
22:41
[Audio] Eating in the Anthropocene
» ‎ SecDocs

Authors: Cathrine Kramer Zack Denfeld
Tags: hacking
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Over the last few years hackers have begun to take a larger interest in food, gastronomy and agriculture. For many in the community the ability to create DIY molecular gastronomy hardware and recipes is an obvious entry point. This talk extends some of these early investigations beyond the kitchen and the chemical properties of food by looking at specific cultivars, food technology organizations, and connections between food systems, ecosystems and planetary change. Part 1 of the talk explores some of the more bizarre and interesting biotechnologies and genomes that make up the human food system on planet earth, including Chinese Space Potatoes, Mutagenic Grapefruits and Glowing Sushi. Pat 2 of the talk presents ideas of food system redesign particularly relevant to hackers and food explorers: utopian cuisines, resilient biotechnologies and eaters as agents of selection. In Part 3 we provide access to resources and propose interesting projects for black hat food hackers, DIY BIO foodies, and prospective food security researchers, such as mining the IAEA's database of radiation breeding, eating things that weren't meant to be eaten and defending agricultural biodiversity. By introducing less known stories from the history of food and technology, and providing access to resources we hope to get more hackers curious about exploring, questioning and redesigning our human food systems.
Tags: talk gastronomy food zack-denfeld chaos-communication-congress molecular-gastronomy agricultural-biodiversity

March 09, 2012
15:01
[Vijay Kumar's] TED talk on the state of quadcopter research
» ‎ Hack a Day

[Vijay Kumar] is a professor at the University of Pennsylvania and the director of the GRASP lab where research centering around autonomous quadcopters is being met with great success. If you were intrigued by the video demonstrations seen over the last few years, you won’t want to miss the TED talk [Dr. Kumar] recently gave [...]
Tags: talk research state ted dr.-kumar vijay-kumar grasp-lab video-demonstrations robots hacks

March 08, 2012
21:41
[Video] What is in a name?
» ‎ SecDocs

Authors: Christoph Engemann
Tags: biometric identity management
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Starting with the history of birth-registration an overview on the historical regimes of naming and identifying people from the 15th to the 20th century is given. the talk will show examples of the different identity media through time and their standardization with the rise of the Westphalian nation state and the subsequent developments after the French Revolution and during the 20th century. The goal of the talk is to show the complexity of the phenomenon of personal names and their media and the need for an informed debate on who and how naming and identification in the digital age is achieved. In July 2011 Google opened the social network named Google+, immediately spawning a fierce debate about its real-name policy barring users from opening accounts with pseudonyms. Just a few days later Facebooks Vice President Randi Zuckerberg echoed Google's sentiment, asserting: “(…) anonymity on the Internet has to go away.” Finally in early August Germanys minister of the interior demanded an end of anonymity on the Internet. My proposed talk is not concerned with the relation of anonymity and pseudonymity and free speech, discrimination and empowerment that dominated the ‘real-name’ “nymwars” on the internet. Instead it seeks to de-familiarize the notion of the ‘real name’ by exposing central aspects of the media-history of names, situating personal names in relation to the development of statehood and capitalism between the 1500 and the 2000s. I thus will outline the history and function of birth-registration as introduced in the wake of the reformation in 1543 and its subsequent secularization during the rise of the Westaphalian nation state. This includes an overview of the international standardization of both identity papers and personal naming regimes during the 19th century in the context of post-1789 development of statehood and colonization. Moving to the 2oth century I will provide examples of the development and standardization of the passport-system after WWI, and conclude my talk with a synopsis of administrative digital identity vision of the early nineties. The goal of the talk is first de-familiarize the notion of the personal-name by showing its complex historical and material background, secondly to contextualize the current developments of digital identity regimes (Neuer Personalausweis, Google+, NSTIC etc) within the larger and longer-term developments of statehood and capitalist societies. Thirdly my talk will show that a name never was ones own but always an intersection of administrative, media-technical and personal interventions and as such is currently becoming a contested phenomenon again, requiring an informed debate about what is in a name. Duration 40 mins, presentation style will be slides and accompanying talk, discussion afterwards.
Tags: talk name identity christoph-engemann chaos-communication-congress anonymity-on-the-internet international-standardization
March 07, 2012
21:42
[Slides] What is in a name?
» ‎ SecDocs

Authors: Christoph Engemann
Tags: biometric identity management
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Starting with the history of birth-registration an overview on the historical regimes of naming and identifying people from the 15th to the 20th century is given. the talk will show examples of the different identity media through time and their standardization with the rise of the Westphalian nation state and the subsequent developments after the French Revolution and during the 20th century. The goal of the talk is to show the complexity of the phenomenon of personal names and their media and the need for an informed debate on who and how naming and identification in the digital age is achieved. In July 2011 Google opened the social network named Google+, immediately spawning a fierce debate about its real-name policy barring users from opening accounts with pseudonyms. Just a few days later Facebooks Vice President Randi Zuckerberg echoed Google's sentiment, asserting: “(…) anonymity on the Internet has to go away.” Finally in early August Germanys minister of the interior demanded an end of anonymity on the Internet. My proposed talk is not concerned with the relation of anonymity and pseudonymity and free speech, discrimination and empowerment that dominated the ‘real-name’ “nymwars” on the internet. Instead it seeks to de-familiarize the notion of the ‘real name’ by exposing central aspects of the media-history of names, situating personal names in relation to the development of statehood and capitalism between the 1500 and the 2000s. I thus will outline the history and function of birth-registration as introduced in the wake of the reformation in 1543 and its subsequent secularization during the rise of the Westaphalian nation state. This includes an overview of the international standardization of both identity papers and personal naming regimes during the 19th century in the context of post-1789 development of statehood and colonization. Moving to the 2oth century I will provide examples of the development and standardization of the passport-system after WWI, and conclude my talk with a synopsis of administrative digital identity vision of the early nineties. The goal of the talk is first de-familiarize the notion of the personal-name by showing its complex historical and material background, secondly to contextualize the current developments of digital identity regimes (Neuer Personalausweis, Google+, NSTIC etc) within the larger and longer-term developments of statehood and capitalist societies. Thirdly my talk will show that a name never was ones own but always an intersection of administrative, media-technical and personal interventions and as such is currently becoming a contested phenomenon again, requiring an informed debate about what is in a name. Duration 40 mins, presentation style will be slides and accompanying talk, discussion afterwards.
Tags: talk name identity christoph-engemann chaos-communication-congress anonymity-on-the-internet international-standardization
21:42
[Audio] What is in a name?
» ‎ SecDocs

Authors: Christoph Engemann
Tags: biometric identity management
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: Starting with the history of birth-registration an overview on the historical regimes of naming and identifying people from the 15th to the 20th century is given. the talk will show examples of the different identity media through time and their standardization with the rise of the Westphalian nation state and the subsequent developments after the French Revolution and during the 20th century. The goal of the talk is to show the complexity of the phenomenon of personal names and their media and the need for an informed debate on who and how naming and identification in the digital age is achieved. In July 2011 Google opened the social network named Google+, immediately spawning a fierce debate about its real-name policy barring users from opening accounts with pseudonyms. Just a few days later Facebooks Vice President Randi Zuckerberg echoed Google's sentiment, asserting: “(…) anonymity on the Internet has to go away.” Finally in early August Germanys minister of the interior demanded an end of anonymity on the Internet. My proposed talk is not concerned with the relation of anonymity and pseudonymity and free speech, discrimination and empowerment that dominated the ‘real-name’ “nymwars” on the internet. Instead it seeks to de-familiarize the notion of the ‘real name’ by exposing central aspects of the media-history of names, situating personal names in relation to the development of statehood and capitalism between the 1500 and the 2000s. I thus will outline the history and function of birth-registration as introduced in the wake of the reformation in 1543 and its subsequent secularization during the rise of the Westaphalian nation state. This includes an overview of the international standardization of both identity papers and personal naming regimes during the 19th century in the context of post-1789 development of statehood and colonization. Moving to the 2oth century I will provide examples of the development and standardization of the passport-system after WWI, and conclude my talk with a synopsis of administrative digital identity vision of the early nineties. The goal of the talk is first de-familiarize the notion of the personal-name by showing its complex historical and material background, secondly to contextualize the current developments of digital identity regimes (Neuer Personalausweis, Google+, NSTIC etc) within the larger and longer-term developments of statehood and capitalist societies. Thirdly my talk will show that a name never was ones own but always an intersection of administrative, media-technical and personal interventions and as such is currently becoming a contested phenomenon again, requiring an informed debate about what is in a name. Duration 40 mins, presentation style will be slides and accompanying talk, discussion afterwards.
Tags: talk name identity christoph-engemann chaos-communication-congress anonymity-on-the-internet international-standardization
March 04, 2012
3:43
[Audio] What is WhiteIT and what does it aim for?
» ‎ SecDocs

Authors: Christian Bahls
Tags: law
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk will be about the WhiteIT project, initiated by Mr Schünemann, German Minister of Interior in the state of Lower Saxony. The WhiteIT project is concerned with combating the online-distribution of child abuse material. WhiteIT tries to develop tools and processes to cooperatively suppress the disemination and (re-)distribution of said material. During the Talk the lecturer will try to encourage some open source intelligence. So please consider bringing a laptop, netbook or tablet with you to help gather and collect certain informations right away. Being involved with the WhiteIT project, the lecturer will use this opportunity to speak freely about his concerns regarding certain aspects of the endeavour. The talk will try to explain some of the projects aims as well as technical tools and processes developed and why he thinks this also concerns you as well. Although the talk will mainly be concerned with WhiteIT and its members, it will also be of concern for other nationals as there are some global players involved. The Talk will be somewhat interactive asking you to crowdsource certain information that the lecturer could not get hold off, so please bring a laptop, netbook or tablet with you to be able access a wiki/etherpad.
Tags: talk whiteit project christian-bahls mr-schnemann lower state-of-lower-saxony chaos-communication-congress open-source-intelligence
3:42
[Slides] What is WhiteIT and what does it aim for?
» ‎ SecDocs

Authors: Christian Bahls
Tags: law
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk will be about the WhiteIT project, initiated by Mr Schünemann, German Minister of Interior in the state of Lower Saxony. The WhiteIT project is concerned with combating the online-distribution of child abuse material. WhiteIT tries to develop tools and processes to cooperatively suppress the disemination and (re-)distribution of said material. During the Talk the lecturer will try to encourage some open source intelligence. So please consider bringing a laptop, netbook or tablet with you to help gather and collect certain informations right away. Being involved with the WhiteIT project, the lecturer will use this opportunity to speak freely about his concerns regarding certain aspects of the endeavour. The talk will try to explain some of the projects aims as well as technical tools and processes developed and why he thinks this also concerns you as well. Although the talk will mainly be concerned with WhiteIT and its members, it will also be of concern for other nationals as there are some global players involved. The Talk will be somewhat interactive asking you to crowdsource certain information that the lecturer could not get hold off, so please bring a laptop, netbook or tablet with you to be able access a wiki/etherpad.
Tags: talk whiteit project christian-bahls mr-schnemann lower state-of-lower-saxony chaos-communication-congress open-source-intelligence
3:41
[Video] What is WhiteIT and what does it aim for?
» ‎ SecDocs

Authors: Christian Bahls
Tags: law
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: This talk will be about the WhiteIT project, initiated by Mr Schünemann, German Minister of Interior in the state of Lower Saxony. The WhiteIT project is concerned with combating the online-distribution of child abuse material. WhiteIT tries to develop tools and processes to cooperatively suppress the disemination and (re-)distribution of said material. During the Talk the lecturer will try to encourage some open source intelligence. So please consider bringing a laptop, netbook or tablet with you to help gather and collect certain informations right away. Being involved with the WhiteIT project, the lecturer will use this opportunity to speak freely about his concerns regarding certain aspects of the endeavour. The talk will try to explain some of the projects aims as well as technical tools and processes developed and why he thinks this also concerns you as well. Although the talk will mainly be concerned with WhiteIT and its members, it will also be of concern for other nationals as there are some global players involved. The Talk will be somewhat interactive asking you to crowdsource certain information that the lecturer could not get hold off, so please bring a laptop, netbook or tablet with you to be able access a wiki/etherpad.
Tags: talk whiteit project christian-bahls mr-schnemann lower state-of-lower-saxony chaos-communication-congress open-source-intelligence

January 01, 2012
9:27
Web Hosting Talk Needs To Update
» ‎ Packet Storm Security Headlines

Web Hosting Talk Needs To Update
Tags: talk hosting web

November 29, 2011
20:09
StoryBoard Quick 6 Stack Buffer Overflow
» ‎ Packet Storm Security Recent Files

StoryBoard Quick version 6 suffers from a file format stack buffer overflow. This was demonstrated at Ruxcon 2011 in the Hacking Hollywood talk. Included in this archive are the advisory, a proof of concept and a Metasploit module.
Tags: talk hacking ruxcon hollywood storyboard-quick stack-buffer buffer-overflow

September 23, 2011
14:06
[Paper] Social Networking Special Ops: Extending data visualization tools for faster Pwnage
» ‎ SecDocs

Authors: Chris Sumner
Tags: intelligence social social engineering
Event: Black Hat USA 2010
Abstract: If you’re ever in a position when you need to pwn criminals via social networks or see where Tony Hawk likes to hide skateboards around the world, this talk is for you. The talk is delivered in two parts, both of which are intended to shine a fun light on visual social network analysis. The first part introduces how you can extend the powerful data visualization tool, Maltego to speed up and automate the data mining and analysis of social networks. I’ll show how I analyzed skateboard legend, Tony Hawk’s twitter hunt and highlight how you could use the same techniques to set up your very own backyard miniature ECHELON. The second part illustrates how these techniques have been used to enumerate a 419 scam, infiltrate the scammers social network and expose deeper, more sinister links to organized crime. I focus specifically on Twitter and Facebook, demonstrating how you can graphically map and analyze social relationships using the Twitter API's, publicly available Facebook profiles, screen scraping and some clunky regex.
Tags: talk visualization twitter chris-sumner tony-hawk usa data-visualization-tools data-visualization-tool special-ops
14:05
[Slides] Social Networking Special Ops: Extending data visualization tools for faster Pwnage
» ‎ SecDocs

Authors: Chris Sumner
Tags: intelligence social social engineering
Event: Black Hat USA 2010
Abstract: If you’re ever in a position when you need to pwn criminals via social networks or see where Tony Hawk likes to hide skateboards around the world, this talk is for you. The talk is delivered in two parts, both of which are intended to shine a fun light on visual social network analysis. The first part introduces how you can extend the powerful data visualization tool, Maltego to speed up and automate the data mining and analysis of social networks. I’ll show how I analyzed skateboard legend, Tony Hawk’s twitter hunt and highlight how you could use the same techniques to set up your very own backyard miniature ECHELON. The second part illustrates how these techniques have been used to enumerate a 419 scam, infiltrate the scammers social network and expose deeper, more sinister links to organized crime. I focus specifically on Twitter and Facebook, demonstrating how you can graphically map and analyze social relationships using the Twitter API's, publicly available Facebook profiles, screen scraping and some clunky regex.
Tags: talk visualization twitter chris-sumner tony-hawk usa data-visualization-tools data-visualization-tool special-ops
September 22, 2011
13:47
[Paper] Hacking Oracle From Web Apps
» ‎ SecDocs

Authors: Sumit Siddharth
Tags: Oracle
Event: Black Hat USA 2010
Abstract: This talk will focus on exploiting SQL injections in web applications with oracle back-end and will discuss all old/new techniques. The talk will target Oracle 9i,10g and 11g (R1 and R2) It is widely considered that the impact of SQL Injection in web apps with Oracle back-end is limited to extraction of data with the privileges of user mentioned in connection string. Oracle database does not offer hacker friendly functionalities such as openrowset or xp_cmdshell for privilege escalation and O.S code execution. Further, as Oracle by design do not support execution of multiple query in single SQL statement, the exploitation is further restricted. The Talk will highlight attack vector to achieve privilege escalation (from Scott to SYS) and O.S code execution, all by exploiting Oracle SQL injections from web applications. As a number of organizations move to compliances like PCI thereby ensuring that the Card data is always stored encrypted with the private key never stored inside the database. The talk will focus on what hackers are doing in the wild to bypass these and to obtain clear text card data when its only stored encrypted or even when its never stored at all.
Tags: talk oracle web scott o.s siddharth-tags usa code-execution oracle-sql oracle-9i
September 20, 2011
11:15
[Paper] Malware Freak Show 2010: The Client-Side Boogaloo
» ‎ SecDocs

Authors: Jibran Ilyas Nicholas J. Percoco
Tags: malware cybercrime malware analysis
Event: Black Hat USA 2010
Abstract: We had a busy year. We investigated over 200 incidents in 24 different countries. We ended up collecting enough malware freaks [samples] to fill up Kunstkammer a few times over. Building upon last year's DEFCON talk, we want to dive deeper and bring you the most interesting samples from around the world - including one that made international headlines and the rest we're positive no one's ever seen before (outside of us and the kids who wrote them). This talk will bring you 4 new freaks and 4 new victims including: a Sports Bar in Miami, Online Adult Toy Store, US Defense Contractor, and an International VoiP Provider. The malware we are going to demo are very advanced pieces of software written by very skilled developers. The complexity in their propagation, control channels, anti-forensic techniques and data exporting properties will be very interesting to anyone interested in this topic.
Tags: talk year malware nicholas-j.-percoco usa miami adult-toy-store skilled-developers freak-show
11:15
[Slides] Malware Freak Show 2010: The Client-Side Boogaloo
» ‎ SecDocs

Authors: Jibran Ilyas Nicholas J. Percoco
Tags: malware cybercrime malware analysis
Event: Black Hat USA 2010
Abstract: We had a busy year. We investigated over 200 incidents in 24 different countries. We ended up collecting enough malware freaks [samples] to fill up Kunstkammer a few times over. Building upon last year's DEFCON talk, we want to dive deeper and bring you the most interesting samples from around the world - including one that made international headlines and the rest we're positive no one's ever seen before (outside of us and the kids who wrote them). This talk will bring you 4 new freaks and 4 new victims including: a Sports Bar in Miami, Online Adult Toy Store, US Defense Contractor, and an International VoiP Provider. The malware we are going to demo are very advanced pieces of software written by very skilled developers. The complexity in their propagation, control channels, anti-forensic techniques and data exporting properties will be very interesting to anyone interested in this topic.
Tags: talk year malware nicholas-j.-percoco usa miami adult-toy-store skilled-developers freak-show

September 15, 2011
8:20
Where have you been!?
» ‎ Carnal0wnage

I've been busy... :-(

But i do have some upcoming conference speaking engagements coming up.

So. If you are heading to BruCon

catch me and Joe McCray talk about Pentesting High Security Environments.

If you are heading to DerbyCon

Catch me and Rob Fuller talk about The Dirty Little Secrets They Didn’t Teach You In Pentesting Class

Lastly, if you'll be in Switzerland for Hashdays

You can catch me talk about From Low to Pwned.

I'll also be giving a talk at the Management workshop on Information Operations for Management (sorry the info isn't on the site yet but should be here https://www.hashdays.ch/management-session.html at some point).

I'm sure there will be more stuff in November/December its just not scheduled yet.
Tags: talk management Pentesting joe-mccray rob-fuller switzerland dirty-little-secrets security-environments speaking-engagements carnal0wnage

May 25, 2011
0:02
Robots Develop Language To Talk To Each Other
» ‎ Packet Storm Security Headlines

Robots Develop Language To Talk To Each Other
Tags: robots talk language
May 17, 2011
18:51
Cisco Shoots Down Talk Of Phone Flaws
» ‎ Packet Storm Security Headlines

Cisco Shoots Down Talk Of Phone Flaws
Tags: talk phone down cisco-shoots cisco

April 15, 2011
12:19
Feel like we do with a bass guitar talk box
» ‎ Hack a Day

Hacker [Dino Segovis] wrote in to share the latest hack from his HackAWeek series, and this time around he has constructed a talk box for his bass guitar. Providing you are old enough, you probably remember when the talk box made its way into mainstream music, on the “Frampton Comes Alive” album. The concept of [...]
Tags: talk box bass dino-segovis guitar-talk mainstream-music frampton musical hacks

March 24, 2011
21:50
RSA Won't Talk? Assume SecurID Is Broken
» ‎ Packet Storm Security Headlines

RSA Won't Talk? Assume SecurID Is Broken
Tags: rsa assume talk
March 08, 2011
16:59
Charlie Miller And Dino Dai Zovi Talk Apple Security
» ‎ Packet Storm Security Headlines

Charlie Miller And Dino Dai Zovi Talk Apple Security
Tags: talk dino-dai-zovi charlie-miller apple-security apple

February 09, 2011
11:03
Ossmann talks about Ubertooth at Schmoocon
» ‎ Hack a Day

[Michael Ossmann's] talk from Schmoocon about his open source Bluetooth test tool called Ubertooth is now available to watch online. The video really fills in the gaps from the first time we looked at the project, as he covers why he took on the challenge, and what has happened since. He talks about how his [...]
Tags: talk ubertooth schmoocon michael-ossmann test-tool gaps cons
February 04, 2011
10:35
The future of cyberattacks
» ‎ Hack a Day

[Dino A. Dai Zovi] gave a talk in the earlier part of 2010 where he shares his thoughts on the future of malicious exploits. You can watch it on Ustream and he’s also posted a set of slides (PDF) that goes along with it. We find the 48 minute video to be quite interested. Instead of [...]
Tags: talk part future dino-a.-dai-zovi cyberattacks exploits slides security hacks

November 16, 2010
14:04
[Video] Java Talk
» ‎ SecDocs

Authors: Brent Baldwin Robert Jason
Tags: Java
Event: PhreakNIC 13

Tags: video authors talk brent-baldwin-robert-jason-tags java java-event robert-jason baldwin
November 15, 2010
2:15
[Video] Panel Talk
» ‎ SecDocs

Tags: hacking
Event: PhreakNIC 13

Tags: video talk panel
October 25, 2010
21:11
[Slides] The Talk Talk
» ‎ SecDocs

Authors: Strom Carlson
Tags: speaking
Event: LayerOne 2008

Tags: authors talk tags strom-carlson strom slides
21:11
[Video] The Talk Talk
» ‎ SecDocs

Authors: Strom Carlson
Tags: speaking
Event: LayerOne 2008

Tags: video authors talk strom-carlson strom

August 23, 2010
0:00
Tech Talk - Net Neutrality Or Google Verizon Monopoly?
» ‎ Packet Storm Security Headlines

Tech Talk - Net Neutrality Or Google Verizon Monopoly?
Tags: net talk tech net-neutrality google monopoly
July 15, 2010
0:00
Talk On Chinese Cyber Army Pulled From Black Hat
» ‎ Packet Storm Security Headlines

Talk On Chinese Cyber Army Pulled From Black Hat
Tags: chinese talk cyber cyber-army black-hat

May 24, 2010
21:03
[Video] Hacking the Smartcard Chip
» ‎ SecDocs

Authors: Christopher Tarnovsky
Tags: microcontroller
Event: Black Hat DC 2010
Abstract: From start to finish, we will walk through how a current generation smartcard was successfully compromised. The talk will discuss everything that was required in the order the events took place. We will cram several months into an hour! PS- The talk will be very technical mixed hardware and software (60% hardware, 40% software).
Tags: talk smartcard Hardware christopher-tarnovsky chip authors black-hat
21:03
[Audio] Hacking the Smartcard Chip
» ‎ SecDocs

Authors: Christopher Tarnovsky
Tags: microcontroller
Event: Black Hat DC 2010
Abstract: From start to finish, we will walk through how a current generation smartcard was successfully compromised. The talk will discuss everything that was required in the order the events took place. We will cram several months into an hour! PS- The talk will be very technical mixed hardware and software (60% hardware, 40% software).
Tags: talk smartcard Hardware christopher-tarnovsky chip authors black-hat
May 23, 2010
21:02
[Slides] Hacking the Smartcard Chip
» ‎ SecDocs

Authors: Christopher Tarnovsky
Tags: microcontroller
Event: Black Hat DC 2010
Abstract: From start to finish, we will walk through how a current generation smartcard was successfully compromised. The talk will discuss everything that was required in the order the events took place. We will cram several months into an hour! PS- The talk will be very technical mixed hardware and software (60% hardware, 40% software).
Tags: talk smartcard Hardware christopher-tarnovsky chip authors black-hat slides
May 19, 2010
4:20
[Paper] Metasploit and Money
» ‎ SecDocs

Authors: H.D. Moore
Tags: Metasploit
Event: Black Hat DC 2010
Abstract: In 2008 Metasploit expanded from a community-run project to a corporate product managed by Rapid7. This talk focuses on the transition, the lessons learned during the acquisition process, the challenges of maintaining a community, and the latest improvements to the Metasploit Framework. The points covered in this talk are valuable for anyone building an open-source product, contemplating the purchase of one, or considering using an open source product to build a commercial application.
Tags: talk metasploit product h.d.-moore-tags metasploit-framework open-source-product d-moore
4:05
[Slides] 0-Knowledge Fuzzing
» ‎ SecDocs

Authors: Vincenzo Iozzo
Tags: fuzzing
Event: Black Hat DC 2010
Abstract: Nowadays fuzzing is a pretty common technique used both by attackers and software developers. Currently known techniques usually involve knowing the protocol/format that needs to be fuzzed and having a basic understanding of how the user input is processed inside the binary. In the past since fuzzing was little-used obtaining good results with a small amount of effort was possible. Today finding bugs requires digging a lot inside the code and the user-input as common vulnerabilies are already identified and fixed by developers. This talk will present an idea on how to effectively fuzz with no knowledge of the user-input and the binary. Specifically the talk will demonstrate how techniques like code coverage, data tainting and in-memory fuzzing allow to build a smart fuzzer with no need to instrument it.
Tags: talk knowledge code protocol-format coverage-data code-coverage
May 14, 2010
21:04
[Video] Exploiting Lawful Intercept to Wiretap the Internet
» ‎ SecDocs

Authors: Tom Cross
Tags: forensic network Cisco sniffer
Event: Black Hat DC 2010
Abstract: Many governments require telecommunications companies to provide interfaces that law enforcement can use to monitor their customer's communications. If these interfaces are poorly designed, implemented, or managed they can provide a backdoor for attackers to perform surveillance without lawful authorization. Most lawful intercept technology is proprietary and difficult to peer review. Fortunately, Cisco has published the core architecture of it's lawful intercept technology in an Internet Draft and a number of public configuration guides. This talk will review Cisco's architecture for lawful intercept from a security perspective. The talk will explain how a number of different weaknesses in its design coupled with publicly disclosed security vulnerabilities could enable a malicious person to access the interface and spy on communications without leaving a trace. The talk will explain what steps network operators need to take to protect this interface. The talk will also provide a set of recommendations for the redesign of the interface as well as SNMP authentication in general to better mitigate the security risks.
Tags: talk cisco intercept tom-cross intercept-technology core-architecture security-perspective
21:04
[Slides] Exploiting Lawful Intercept to Wiretap the Internet
» ‎ SecDocs

Authors: Tom Cross
Tags: forensic network Cisco sniffer
Event: Black Hat DC 2010
Abstract: Many governments require telecommunications companies to provide interfaces that law enforcement can use to monitor their customer's communications. If these interfaces are poorly designed, implemented, or managed they can provide a backdoor for attackers to perform surveillance without lawful authorization. Most lawful intercept technology is proprietary and difficult to peer review. Fortunately, Cisco has published the core architecture of it's lawful intercept technology in an Internet Draft and a number of public configuration guides. This talk will review Cisco's architecture for lawful intercept from a security perspective. The talk will explain how a number of different weaknesses in its design coupled with publicly disclosed security vulnerabilities could enable a malicious person to access the interface and spy on communications without leaving a trace. The talk will explain what steps network operators need to take to protect this interface. The talk will also provide a set of recommendations for the redesign of the interface as well as SNMP authentication in general to better mitigate the security risks.
Tags: talk cisco intercept tom-cross intercept-technology core-architecture security-perspective
21:04
[Paper] Exploiting Lawful Intercept to Wiretap the Internet
» ‎ SecDocs

Authors: Tom Cross
Tags: forensic network Cisco sniffer
Event: Black Hat DC 2010
Abstract: Many governments require telecommunications companies to provide interfaces that law enforcement can use to monitor their customer's communications. If these interfaces are poorly designed, implemented, or managed they can provide a backdoor for attackers to perform surveillance without lawful authorization. Most lawful intercept technology is proprietary and difficult to peer review. Fortunately, Cisco has published the core architecture of it's lawful intercept technology in an Internet Draft and a number of public configuration guides. This talk will review Cisco's architecture for lawful intercept from a security perspective. The talk will explain how a number of different weaknesses in its design coupled with publicly disclosed security vulnerabilities could enable a malicious person to access the interface and spy on communications without leaving a trace. The talk will explain what steps network operators need to take to protect this interface. The talk will also provide a set of recommendations for the redesign of the interface as well as SNMP authentication in general to better mitigate the security risks.
Tags: talk cisco intercept tom-cross intercept-technology core-architecture security-perspective
21:04
[Audio] Exploiting Lawful Intercept to Wiretap the Internet
» ‎ SecDocs

Authors: Tom Cross
Tags: forensic network Cisco sniffer
Event: Black Hat DC 2010
Abstract: Many governments require telecommunications companies to provide interfaces that law enforcement can use to monitor their customer's communications. If these interfaces are poorly designed, implemented, or managed they can provide a backdoor for attackers to perform surveillance without lawful authorization. Most lawful intercept technology is proprietary and difficult to peer review. Fortunately, Cisco has published the core architecture of it's lawful intercept technology in an Internet Draft and a number of public configuration guides. This talk will review Cisco's architecture for lawful intercept from a security perspective. The talk will explain how a number of different weaknesses in its design coupled with publicly disclosed security vulnerabilities could enable a malicious person to access the interface and spy on communications without leaving a trace. The talk will explain what steps network operators need to take to protect this interface. The talk will also provide a set of recommendations for the redesign of the interface as well as SNMP authentication in general to better mitigate the security risks.
Tags: talk cisco intercept tom-cross intercept-technology core-architecture security-perspective
March 27, 2010
3:43
[Slides] Catching DNS Tunnels with AI - A Talk About Artificial Intelligence, Geometry and Malicious Network Traffic
» ‎ SecDocs

Tags: DNS covert channel
Event: DEFCON 17

Tags: tunnels talk dns covert-channel artificial-intelligence network-traffic
February 11, 2010
21:14
[Video] Lightning Talks - Day 4
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 26th (26C3) 2009
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk! Whatever you do - please practise it, and don't be boring. Or else. You have been warned! :-P
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects
21:14
[Video] Lightning Talks - Day 1
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 26th (26C3) 2009
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk! Whatever you do - please practise it, and don't be boring. Or else. You have been warned! :-P
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects
21:14
[Video] Lightning Talks - Day 2
» ‎ SecDocs

Tags: hacking
Event: Chaos Communication Congress 26th (26C3) 2009
Abstract: 4 minutes for every speaker. Learn about the good, the bad, and the ugly - in software, hardware, projects, and more. Give a lightning fast talk about your favourite project, program, system - and thereby find people with the same interest to proceed and promote it. Alternatively - give us a good rant about something and give us some good reasons why it should die. ;) Get right at it, don't waste time by explaining too much, get the main points across, and then let us know how to contact you on the congress for a talk! Whatever you do - please practise it, and don't be boring. Or else. You have been warned! :-P
Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-projects
February 02, 2010
21:04
[Video] Defending the Poor
» ‎ SecDocs

Authors: Felix 'FX' Lindner
Tags: Rich Internet Applications Flash
Event: Chaos Communication Congress 26th (26C3) 2009
Abstract: The talk will discuss a class of in-the-wild malware and exploits, reasons for it's success as well as reasons why protecting against it in common ways is not effective. This will be done by examining the internals of the attacked subject. Following this, the second part of the talk will present an alternative protection mechanism, which the presenter believes prevents large parts of this class of attacks. The mechanisms and code to do this will be presented and released. The talk presents a simple but effective approach for securing Rich Internet Application (RIA) content before using it. Focusing on Adobe Flash content, the security threats presented by Flash movies are discussed, as well as their inner workings that allow such attacks to happen. Some of those details will make you laugh, some will make you wince. Based on the properties discussed, the idea behind the defense approach will be presented, as well as the code implementing it and the results of using it in the real world.
Tags: talk class flash ria felix rich-internet chaos-communication-congress applications-flash protection-mechanism

jetlib.sec » Tags » talk

Feeds

174 items tagged "talk"

Tags: decoder google talk recovering-passwords

Tags: decoder google talk recovering-passwords

Tags: decoder google talk recovering-passwords

Tags: decoder google talk recovering-passwords

Tags: decoder google talk recovering-passwords

Tags: decoder google talk recovering-passwords

Tags: audio talk hacking mark-lottor mark-will cellular-phones

Tags: talk win windows felix germany chaos-communication-congress time-comming walldorf-germany

Tags: talk win windows felix germany chaos-communication-congress time-comming walldorf-germany

Tags: talk security web laurent-oudot web-clients technical-security

Tags: talk security web laurent-oudot web-clients technical-security

Tags: talk goal communication chaos-communication-congress open-source-development workflow-issues

Tags: talk goal communication chaos-communication-congress open-source-development workflow-issues

Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile

Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile

Tags: talk congress network sebastian-werner-stefan-wahl chaos-communication-congress 21c3 usage-profile

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes

Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes

Tags: talk technology terminator julian-finn-oliver-moldenhauer chaos-communication-congress copy-protection-technology terminator-genes

Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory

Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory

Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory

Tags: talk allocator memory yves-younan robertson chaos-communication-congress memory-allocator heap-memory

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk tcp steganography steven-j.-murdoch-tags chaos-communication-congress initial-sequence-number clock-skew

Tags: talk tcp steganography steven-j.-murdoch-tags chaos-communication-congress initial-sequence-number clock-skew

Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples

Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples

Tags: talk syscall technique maximiliano-caceres chaos-communication-congress core-sdi source-code-examples

Tags: talk video python mac-os ulrich-von-zadow chaos-communication-congress system-deployment mac-os-x

Tags: talk system python mac-os ulrich-von-zadow chaos-communication-congress system-deployment mac-os-x

Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers

Tags: talk internet computer david-gthberg p-event david chaos-communication-congress mole2 central-servers

Tags: talk congress lightning chaos-communication-congress lightning-talks hardware-hack

Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies

Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies

Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies

Tags: talk css web bert-bos emma chaos-communication-congress new-web-technologies

Tags: talk network Hardware lan elisa-jasinska maxim-salomon-niels-bakker camp-network chaos-communication-camp backbone-network video-camp

Tags: talk network Hardware lan elisa-jasinska maxim-salomon-niels-bakker camp-network chaos-communication-camp backbone-network usage-profile

Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske

Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske

Tags: talk teleprinter crypto arne-beurling sven-moritz-hallberg norway russia finland chaos-communication-camp german-air-force siemens-halske

Tags: talk radio gnu david-hulton joshua-lackey gsm chaos-communication-camp gsm-traffic

Tags: talk antivirus Software sergio-alvarez chaos-communication-camp mail-servers security-authors

Tags: talk antivirus Software sergio-alvarez chaos-communication-camp mail-servers security-authors

Tags: malware talk reality trojans chaos-communication-camp internal-statistics idea-what-kind

Tags: talk network congress lan chaos-communication-congress backbone-network usage-profile

Tags: talk network congress lan chaos-communication-congress backbone-network usage-profile

Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy

Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy

Tags: talk web csrf winter-martin-johns-tags mac chaos-communication-congress web-application-developers client-side-proxy

Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver

Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver

Tags: talk memory engineering alan-bradley-tags walker ida tor usa chaos-communication-congress reverse-engineering-tools kernel-driver

Tags: talk mms pocketpc collin-mulliner chaos-communication-congress mms-multimedia-messaging-service multimedia-messaging-service

Tags: talk mms pocketpc collin-mulliner chaos-communication-congress mms-multimedia-messaging-service multimedia-messaging-service

Tags: talk code point c.--the felix-von-leitner chaos-communication-camp future-generations

Tags: talk video gps marvin-mauersberger chaos-communication-camp gps-trackers low-power-electronics

Tags: talk code point c.--the felix-von-leitner chaos-communication-camp future-generations

Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii

Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii

Tags: talk gaming xbox felix-domke chaos-communication-congress sony-playstation-3 nintendo-wii

Tags: talk video Hackerspaces chaos-communication-congress 23th open-spaces

Tags: talk Hackerspaces audio chaos-communication-congress 23th open-spaces

Tags: talk free Software foss india asia bangalore chaos-communication-congress social-hacks open-source-software