Slashdot Mirror

IPv6 is still not nearly as "polished" as IPv4. Talk at the 27th Chaos Communication Congress in Berlin: "Recent advances in IPv6 insecurities" in about 4 hours. The talk is in English, a live stream available.

Dr Steven Murdoch (Cambridge) presents: "Chip and PIN is Broken" Vulnerabilities in the EMV Protocol
https://events.ccc.de/congress/2010/Fahrplan/events/4211.en.html

Have fun take-downing them :-)

Steven J. Murdoch is going to be at the 27th Chaos Communication Congress which will be held in Berlin from 27th to 30th of December 2010. The linked page has links to a BBC news video and the details of the attack. Streams and video archives of the talks at 27C3 will be available here.

Steven J. Murdoch is going to be at the 27th Chaos Communication Congress which will be held in Berlin from 27th to 30th of December 2010. The linked page has links to a BBC news video and the details of the attack. Streams and video archives of the talks at 27C3 will be available here.

Build one yourself for a small fraction of the price. It's been done.

Or go the commercial route. Who needs micros~1?

You'll probably burn the card and destroy the microwave. There's a gadget called "RFID zapper", though, which destroys RFID tags leaving the card or passport intact: Link

Opentracker is the software behind many public trackers. The people behind this software project gave a talk at the 24th Chaos Communication Congress in 2007. There is a video recording of this talk (in German). (The talk is titled "Tracker fahrn". It's a play on words: "Trecker" is pronounced like "tracker" and means "tractor", hence the picture.)

In the talk they explained the basics of the Bittorrent protocol, how their project came to be and what they learned writing and running a high throughput open tracker (denis.stalker.h3q.com). Comments about their experience with XS4ALL at 33 minutes - hilarious; how the PirateBay tracker switched to Opentracker at 43 minutes; but watch the whole thing.

See the 26th Chaos Communications Congress: Fuzzing the Phone in your Phone. http://events.ccc.de/congress/2009/Fahrplan/events/3507.en.html

You should investigate further since this kind of throttling is probably illegal in the European Union (read European Union \subset EU). In germany, the Chaos Computer Club would be happy to investigate this. You probably have a similar association, too.

Maybe it is because of Flashs superior internal design or because of Flash's superior Garbage collection...

Although this ruling is what us IT guys would expect from any reasonable court, the fact of the matter is that judges know shit. The Chaos Computer Club worked their asses off providing expertise to the court, while also mobilizing the German IT scene and putting out pressure on opposing (governmental) parties. This is their success and I salute them. Guess I should get around to finally apply for membership myself...

There has been a very interesting talk about this (and other aspects of WikiLeaks) at 26C3.

If you want to know the insights http://media.ccc.de/browse/congress/2009/26c3-3709-en-legic_prime_obscurity_in_depth.html

I could explain it, but why not watch their presentation that they gave a couple weeks ago at CCC and actually understand what they're talking about firsthand.
Presentation page, big mp4 video, torrent.

Good-quality copies of the talks are now available at the web site. Look for 26c3-3654-en-gsm_srsly.mp4.

Slides from Karsten's presentation at the CCC.

The A5/1 cracking project.

The slides are here and A5/1 and A5/3 are encryption algorithms.

Except Mac OS X kernel is not a microkernel. The following talk given a few years back, even though slightly out of date when it comes to discussing 64 bit support in the kernel, is still relevant

http://chaosradio.ccc.de/24c3_m4v_2303.html

GSM only authenticates one way, not both, so it is almost ideal setup for man in the middle attacks. One of the presentations at last year's CCC, the 25C3 covered this, but you can find plenty of older and newer material on it elsewhere.

Any GSM phone-based payment system has some big challenges. GPRS could be better, since you can then run something behind SSL or SSH. However, even then, when it comes to money, the designers must design the system on the assumption that the network is insecure, perhaps even the endpoints.

Sure, at least to some extent. See this paper for more information. Why?

Because they are running Siemens base stations and for that Harald started OpenBSC. Both projects are under GPL and are in close contact as far as I know.

Harald had a talk at 25C3 about their project, and were running a small setup there in the basement. AFAIK, because all frequencies are sold in Germany - there should be at least one for independent testing, but they sold all to the telcos - maybe that's why they are running the larger test in the Netherlands now.

Ok, I'll bite.

Well considering they were the first to genetically modify plants, you can stop wondering.

This is incorrect, first you are talking about commercial uses, and not genetically modification in general. Second, Calgene were the first to commercially produce genetically modified food (Flavr Savr). Later they were bought by Monsanto, which is not that a big contribution by Monsanto.

However, even if that particular company had never done a single beneficial thing for anyone, your argument is fallacious.

Not much of a argument you bring here. I accept that one could argue that some genetically modified plants have some benefits overall, but I personally have a hard time to see them, after removing the whole PR-bullshit that surrounds them. I think there are good arguments that they are in the end mostly only beneficial to the companies that sell them. This is however open for discussion.

A dirty trick that is still around in even the newest X86 processors and causing problems for hardware engineers and has security implications. The first xbox was hacked partially because of the A20 gate (pdf description of vulnerability) and maybe Intel will stop using the A20 gate in the upcoming Nehalem generation.

The Chaos Computer Club made a "FreedomStick" for journalists traveling to China to cover the Olympics. It includes software that automatically uses firefox+tor etc.. More Info Here: http://chinesewall.ccc.de/index-en.html

Actually, I think we're seeing a bit of a comeback. Hackerspaces are mushrooming around the world. (I like to believe the talk at the 24th Chaos Computer Congress in December 2007, Building a Hacker Space, helped provide impetus to this movement.) I also believe DIY culture is on the rise again, as spearheaded by Make.

So I'd say it's not so much that hacking is dying off rather than being handed over to the new generation, which has its own interests.

If you have a board which is supported by Coreboot (formerly known as LinuxBIOS), you can put your own Linux kernel and initial ram disk into the flash, or a variety of boot loaders. The possibility of a hypervisor in the flash chip and lots of technical details are mentioned in this presentation by Peter Stuge at 25c3 (25th Chaos Communication Congress). Includes a demo of booting from power on to a shell in 5 seconds:

http://ftp.ccc.de/congress/25c3/video_h264_720x576/25c3-2970-en-coreboot_beyond_the_final_frontier.mp4

Some people might think these are attractive because the signal can't be intercepted as easily as wifi. However Powerlinecommunications hacking seems to be moving on nicely http://events.ccc.de/congress/2008/Fahrplan/events/2901.en.html . My understanding is that it's sometimes possible to pick up signal leaking from other users in the building.

Not too long ago, this MD5 crack allowed a trusted SSL CA cert to be created.

Although it's not "in the wild", the listed steps are such that pretty much anybody can do the same thing today. Plus, the actual hack required using real, live CA servers, and not just lab systems.

Our Cheney is Schäuble, by the way. Mix Cheney's mind with that of some Gestapo-leader with an obsession for control, add a wheelchair, some hair and an evil look, remove some fat, and you got him. All he needs is a fluffy cat and an iron glove (or better a SS-Totenkopfstaffel glove).

Well, a least SSchäuble made his finger print available to the public, so you and I can use it in our biometric passport. Just follow these simple steps to personalize your biometric passport with the finger prints of your political hero.

Our Cheney is Schäuble, by the way. Mix Cheney's mind with that of some Gestapo-leader with an obsession for control, add a wheelchair, some hair and an evil look, remove some fat, and you got him. All he needs is a fluffy cat and an iron glove (or better a SS-Totenkopfstaffel glove).

Well, a least SSchäuble made his finger print available to the public, so you and I can use it in our biometric passport. Just follow these simple steps to personalize your biometric passport with the finger prints of your political hero.

I studied CS at FU-Berlin, the program can be quite demanding, but it's very good. Some courses are taught in English, and in those courses you can write the exams in either German or English. If you're just going to spend a semester abroad, you may be able to get away with taking all your courses in English. You'll inevitably need to learn some German though, if only for social life (even though many people are fluent in English), but the effort may well be worth it. There is also a welcoming Linux geek society at the faculty. Oh, and Berlin is a very nice city. There's the typical tourist attractions, but also a large and very active hacking community which naturally provides lots of entertainment for CS students (projects such as the CCC, freifunk, C-base, bootlab). Beware -- many students have been known to end up stranded in these communities. Check here for information about application procedures for students from abroad.

At the 24th Chaos Communication Congress there was a lecture about this topic: Programming DNA http://events.ccc.de/congress/2007/Fahrplan/events/2329.en.html (links to torrents on the page).

Biometrics are foolish.

Today, if someone gets your credit card information, they can make charges in your name. To resolve this, you inform your credit card company that someone is fraudulently using you card. Typically they'll just nix the charges and issue you a new card with a new number.

Throw in biometrics:
Someone gets your biometric information, they can make charges in your name. To resolve this, you inform your biometric-enhanced credit card company company that someone is fraudulently using you biometric information. They just nix the charges and issue you new...fingerprints?

So biometrics do go a long way toward fraud prevention. However, if it actually does occur, you're utterly and permanently fucked.

Citizen Engineer only has one episode out so far, and looks like it's going to be mostly hardhacking, but it's definitely not dumbed-down.

On the other hand, if you're looking for a serious discussion on the future of tech with a stronger grip on reality than Popular Science, try MIT's LabCast videos, with footage of working prototypes.

Citizen Engineer only has one episode out so far, and looks like it's going to be mostly hardhacking, but it's definitely not dumbed-down.

On the other hand, if you're looking for a serious discussion on the future of tech with a stronger grip on reality than Popular Science, try MIT's LabCast videos, with footage of working prototypes.

Citizen Engineer only has one episode out so far, and looks like it's going to be mostly hardhacking, but it's definitely not dumbed-down.

On the other hand, if you're looking for a serious discussion on the future of tech with a stronger grip on reality than Popular Science, try MIT's LabCast videos, with footage of working prototypes.

2. Whats the point of the frigging fingerprint?
Who has got the both tha equipemnt and the right to check it?

There is no point in fingerprints. mcwidget summed it up nicely. The biggest problem with the fingerprints is that they are so easy to forge / fake .
Now imagine what could happened if someone could duplicate the ID card and forge the fingerprints.

https://events.ccc.de/camp/2007/Fahrplan/attachments/1348-Camp07-NetworkStats.pdf (the line had at least 300MBit for 1800 attendees ) Hope Number Six had a 45mb uplink, but only 10mb was used due to a bad cable connection and roughly 3000 attendees straight from network operator from the convention) someone can contact dragorn on nycwireless.net or watch the closing ceremonies of the last hope for the specs this year

Reminds me of the early 90's when the Chaos Computer Club had its own radio show (I don't know if are still on air). They had this game were you could win a price if you were the first to call a number which was given to the listeners in DTMF tones. Since this show was in the late evening I don't want to know how many people got it wrong and woke someone with a similar number. But usually it only took a minute for someone to figure out the real number with the help of an Amiga (sound cards were not that common in the PC world back then and the Amiga came with all the software you needed for this purpose)

IIRC the game was inspired by a prior show in which they called someone of relative hacker fame and forgot to silence the mic while dialing, thereby disclosing his number unintentionally...

I'm pretty sure that it's possible to just glue new fingerprints on your fingers before showing up for the fingerprinting, although doing it in a way which would not be obvious looks quite a bit more difficult.

An Introduction to Traffic Analysis (see slide nr. 9)

An Introduction to Traffic Analysis (see slide nr. 9)

It isn't a "would be" implemented. It's already done. Basically, there is no way to prevent your ISP from altering your traffic, because everything that comes over the wire passes through them. You have no way of telling whether the ads served on a website are the ads that that website sold or whether the ISP inserted them without controlling both ends of the communication.

Dan Kaminsky developed a method to detect this kind of tampering , which at least can prevent ISPs from hiding the fact that they're doing this. It's in the second half of this talk, from last year: http://events.ccc.de/congress/2007/Fahrplan/events/2393.en.html

...that this kidn of system relies on the goodwill of its users. No matter how complicated you make the system, someone's bound to mess with it some time.

Great. So now somebody has an incentive to cut off my fingers.

During World War II the Swedes intercepted German traffic from Norway to Germany proper going over Swedish territory, and broke the T-52 encryption to listen in to what they were up to. I don't think that the Germans ever had a clue.

During the video, an amateur theater company did also get imaginative about the use for CCTVs.

Related story: London 2006, Meet London 1984.

It is quite easy - here is a video (german)

It is quite easy - here is a video (german)

Indeed, that was part of the famous talk "Sie haben das Recht zu schweigen" (Download) (meaning something like "you have the right to be silent") at the 23C3.