The 33rd Chaos Communication Congress (33C3) in Hamburg is over – and it was (again) a great conference. In this post I list the talks that I liked most with a short teaser for the talk to allow you to decide yourself whether you want to watch the video of the talk yourself. Generally, all talks at #33c3 are recorded and are available online. Inside the Fahrplan page for each talk, often additional information (e.g. slides, further information, etc.) are listed and linked.
Here are all the information you need to relive 33c3:
- Program: Fahrplan of 33C3
- Background Information: 33C3 Event Blog
- Video/audio recordings: C3TV (talks are usually available in English, German and French language inside the same video)
My personal highlights of this years Chaos Communication Congress (CCC) are the following (in no particular order):
- Decoding the LoRa PHY
- Shining some light on the Amazon Dash button
- Recount 2016: An Uninvited Security Audit of the U.S. Presidential Election
- The (a bit overdramatized) approach to get (some) US states to recount the votes cast electronically in the 2016 US presidential election to answer the question whether the election has been rigged (or not). Quite interesting talk with not too much technical content – and the outcome is that the election is unlikely to have been rigged.
- Links: Fahrplan / Recording
- Where in the World Is Carmen Sandiego?
- Lockpicking in the IoT
- A very nice overview on how to attack IoT Devices (Bluetooth-based smart locks in this case) and which attack vectors exist and how those can be exploited. The talk shows, that eventually all locks are not completely secure but actually the end result is somehow better than expected.
- Links: Fahrplan / Recording
- Console Hacking 2016
- Marcans story of how he got Gentoo Linux running on the Sony Playstation 4 with a very detailed overview over the hardware architecture and which (interesting) decisions Sony took. Interestingly, he does not really talk about the security problems he used to break out of the FreeBSD-based Sony system as he claims that this is a simple task.
- Links: Fahrplan / Recording
- Shut Up and Take My Money!
- Software Defined Emissions
- A(nother) technical view onto the Dieselgate Volkswagen scandal giving more details onto how to extract the software from an automotive ECU and how to analyze the software. Felix also looks at another car from Opel and finds very similar mechanisms to Volkswagen, whereas Opel of course claims not to employ a cheat device. The last third of the talks has some length, you might want to skip over them.
- Links: Fahrplan / Recording
- Wheel of Fortune
- A compressed overview over the quality of pseudo random number generators on embedded systems (which are often used for crypto operations e.g. generation of keys). The take away is, that entropy on embedded systems is often a problem and that some popular OSes are doing it wrong.
- Links: Fahrplan / Recording
- Dissecting modern (3G/4G) cellular modems
- A breakdown of software running inside a modern MDM9615-based Quectel 3G/4G modem with many interesting revelations (including the fact, that Linux runs inside the module and that the architecture is ridiculously complex / inefficient in some areas) and some experiences with GPL violations. Very good for future projects will likely be the relative openness of the modem for modifications and Harald kind of announced that he might be working on a completely FOSS userland for that chip.
- Links: Fahrplan / Recording
- A look into the Mobile Messaging Black Box
- This talk is twofold: On the one hand, the two presenters give a very detailed introduction into messaging and cryptography. On the other hand, they provide a detailed look into the popular but closed-source Threema mobile messaging application including the release of a reimplementation of the protocol on an open-surce library for speaking the protocol.
- Links: Fahrplan / Recording
- Dieselgate – A year later
- A somewhat entertaining overview over what has happened in the Volkswagen Dieselgate scandal since last years 32C3. While the talk is entertaining and the presenter claims that some other companies are as bad as Volkswagen with regards to emission cheating, he actually only picks on Volkswagen and fails to put this properly into perspective.
- Links: Fahrplan / Recording
- SpiegelMining – Reverse Engineering von Spiegel-Online (German)
- David has collected > 700000 (versions of) articles on Spiegel Online over more than 2 years and extracted different features from this significant set of data. In this fun and entertaining talk he presents what you can learn about SPON based on this data set including company-internal relationships and the focus of SPONs articles.
- Links: Fahrplan / Recording