#!/bin/blog

January 2, 2010

C3 for absolute beginners

Filed under: Egoblogging — Tags: , , , — martin @ 8:49 pm

After months-long constant prodding by my dear friend and colleague G., I attended 2009’s 26th Chaos Communication Congress (26C3) last week. A first-time C3 visit for me.

Because of family reasons, I was only able to arrive on the second day around noon. This caused unexpected problems regarding the acquisition of a ticket for me, but thanks to the tireless effort of another valued colleague (B.), I got my ticket on day 2 and everything was fine.

Day 2

Day 2 (which was the first for G. and me) was dominated by our attempts to find our way around BCC, the Berlin Conference Center. Pressured by B., the first talk we attended was “A part time scientists’ perspective of getting to the moon“. I was the first one from our little group to walk out of this after about 15 minutes, due to the bad english and the constant presentation issues.

After lunch (around 15:00), we went to see the big Fefe show event “Vier Fäuste für ein Halleluja“, which was fairly funny. It must have been that afternoon that I registered my GSM phone on the congress network, which worked without any problems whatsoever. Somewhat later, we discovered the “Lounge” in the basement next to the Hackcenter, where we spent all of the early evening. Lots of cool music. G. had a few smokes and I achieved a new high score at FlightControl on the iPhone. ;-)

Exciting Tales of Journalists Getting Spied on, Arrested and Deported” at 23:00 was entertaining, but my impression was that it didn’t quite live up to the expectations of the audience. After the second round of “Hacker Jeopardy“, we left the venue and went back to the Hotel. After some hanging around in the lobby, everyone was in bed at three in the morning.

Day 3

Got up early after far too few hours of sleep, but due to fuzzy coordination with the others and spending too much time for breakfast, missed the 11:30 CCC retrospective for 2009. Went to see “Vom Kreationismus zum Kollektivismus“, a great talk about creationism, which was unfortunately timed rather badly. As far as I’m concerned, time was up before the speaker was able to reach a palpable conclusion.

Next in the same room was “Kunstfreiheit statt Hackerparagraph“. A great subject, entirely wasted. About one-third of the audience left the room during the talk, which was quite embarassing.

After lunch, we attended the “Lost Cosmonauts” talk, which was somewhat puzzling. Being about “Critical Thinking”, I started to expect the speaker to sell us his version of the truth, to later reveal how he had fooled us. Unfortunately, this was not the case and the conclusion was that one point of the “lost cosmonauts” story was mostly caused by a faulty translation. Honestly: Where’s the beef, sir?

The next talk, ““Yes We Can’t!” – on kleptography and cryptovirology“, is a highly interesting topic. In plain english, it was about how computer criminals utilize cryptographic techniques. Unfortunately, it was presented in a very boring, academic way, with crypto-theoretic formula talk that didn’t do the subject any justice at all. Also, the slides were in desperate need of an overhaul as they contained an excessive amount of references to floppy-disk vintage computing. Give this subject to the “Tales of Journalists” guy from Day 2 and everyone in the room will have a great time. I left about 20 minutes before the end of the talk.

After dinner, we absolutely had to get into Room 1 for the big Fefe and Kaminsky shows that were to follow later that evening. We were late for Bre Pettis’ talk about “Peanut Butter and Plastic: Industrial Revolution“, but happened to be in a small group that the brilliant Nick Farr allowed into the room to stand on the side until the end of Bre’s Talk.

We stood through the “Fnord Retrospective 2009” as well, and were able to grab two great seats for Dan Kaminsky’s “Black ops of PKI” talk. Dan’s talk was stellar, as it detailed a number of serious flaws in the practical application of SSL that I had already encountered in my work for a client. This was downright marvellous, as I had never heard someone speak out these issues outside my work environment. I really had a hard time believing that this was actually happening and sat through a few passages of the talk with a dropped jaw.

We skipped the game show event that day and everyone went to bed early.

Day 4

Day 4 was departure day. We only attended one talk before we left, and that that was “Wikipedia – Wegen Irrelevanz gelöscht” about the German Wikipedia’s deletion policy, which was somewhat nightmarish. I was surprised to see Usenet-style flame warfare adopted in a real life setting. Quite a few facepalms there, with more than one person from the auditorium asking unrelated feisty questions.

Conclusion

As you’ve seen, there have been a number of talks I was dissatisfied with. However, this has been more than made up by Dan Kaminsky, who confirmed my SSL troubles and gave me an impression of how deeply SSL and X.509 are really flawed.

The wireless LAN was working okay for me most of the time. I had registered a spare mobile phone with the local GSM network, which worked surprisingly well, including DECT interoperation, call-out, call-in and SMS. Other than the few hundred people in the Hackcenter, I opted not to use the 26C3 as a cheap opportunity for re-stocking my pr0n collection. I regret that we missed to pay a visit to C-Base. Also, it’s a shame that I failed to meet a few of my Twitter followers despite them being in the same building as me.

(On the other hand, I had an interesting encounter at the chinese fast food place over at the train station. I asked Melle about this t-shirt, but he wasn’t able to explain it quickly to me. Seconds later, an unknown lady from the other side of the table discretely handed me her iPhone with this XKCD cartoon loaded. Nice. Yes, the chinese restaurant was that crowded with CCC people.)

See you next December at 27C3, folks. :-)

April 18, 2008

Der Inside-Job

Filed under: Security — Tags: , — martin @ 10:06 pm

$KUNDE hielt heute mit der Freitagnachmittags-Bierflasche in der Hand eine bewegende Rede ans Volk, an deren Rande er betonte, daß er jedem aus seiner bunten Beratertruppe, der sich auf “Hackerkongressen” aufhält, während gegen seine Infrastruktur irgendwelche Angriffe gefahren werden, auf der Stelle Hausverbot erteilen wird.

Später habe ich dann erfahren, daß ein ehemaliger freier Mitarbeiter des Ladens, kein pickliger Jüngling, sondern ein Kollege im gestandenen Mannesalter (ich durfte ihn vor seinem Abschied noch kurz kennenlernen), es tatsächlich geschafft hat, mit seinem Insiderwissen vom 24. Chaos Communication Congress aus eine Webserverfarm des Kunden auszuknipsen, für deren Inbetriebnahme er zuständig gewesen war. Daraufhin kam die Welt zum Stillstand und wegen der Urlaubssaison war niemand zu erreichen, so daß die Website einen Tag lang offline war. Der Experte, der am meisten über die Serverfarm wußte und sie wieder auf die Beine hätte stellen können, war der Angreifer ja immerhin selbst, und der weilte auf Urlaub in Berlin.

Anschließend hat er alles zugegeben, als “Penetration Test” deklariert und zu seiner Verteidigung vorgebracht, daß der dämliche ISP des Kunden überreagiert habe und das alles doch nur Spaß und Spiel war. (Die Story ist plausibel und ich hatte sie bereits aus anderer Richtung schonmal so ähnlich gehört.)

Oh, verdammt.

1) Hat er als Insider das Vertrauen seiner Kundschaft nicht nur mißbraucht, sondern diese auch noch vorsätzlich geschädigt.
2) Wie das technisch aussah, spielt dabei eigentlich keine Rolle. Wenn er Sicherheitsprobleme kennt, sollte er sie nicht exploiten, sondern fixen. Das ist seine Pflicht.
3) Ist der CCC, der noch nie ein “Chaos-Club” war und sich derzeit notgedrungen vom “Computer-Club” zur techniklastigen Bürgerrechtsorganisation umzubauen scheint, in den Augen dieses Kunden eine kriminelle Chaosgruppe. Wie aus dem dümmsten Klischeebaukasten der Achtziger, und das auch noch verständlicherweise.
4) Hat er dafür gesorgt, daß Personen aus dem CCC-Umfeld bei diesem Kunden nun unter Generalverdacht stehen.

Das schlimme ist nicht, daß er das ganze rumerzählt hat, sondern das schlimme ist, daß er es getan hat. Wirklich eine grandiose Leistung. Eines Hackers ist das nicht würdig.

February 22, 2008

Controller pulen

Filed under: Hardware — Tags: , — martin @ 10:29 pm

Ich war heute dreieinhalb Stunden mit dem Auto unterwegs. Genug für zwei Podcasts von Chaosradio Express. Der erste, aktuelle, ging über Hubschrauber und kann getrost als “bizarr” beschrieben werden.

Der andere Podcast jedoch, über Microcontroller und ein paar Wochen alt, war eine echte Wohltat. Ein Hacker namens fd0 von lochraster.org berichtete da derart leidenschaftlich über seine ersten Schritte und mittlerweile beträchtliche Erfahrung mit Atmel-Microcontrollern, daß es wirklich Spaß gemacht hat, zuzuhören. Da möchte man am liebsten direkt den Lötkolben rausholen, eine Großbestellung bei Reichelt aufgeben und den Assembler anwerfen. Klasse!

(Während ich mir den Assembler noch zutrauen würde, bin ich in Sachen Elektronik aber leider ein völliger Ausfall. Schade.)

Blog at WordPress.com.