Summary of Lightning Talks Day 3 of 37th Chaos Communication Congress

• 0:01:01 Digital Integrity in Switzerland:

  • The concept of adding "digital integrity" to existing constitutional rights (physical and mental integrity) to ensure autonomy in the digital space.
  • Adopted in Geneva (94% yes) and Neuchâtel (95% yes) constitutions. Initiatives in Vaud, Jura, Basel, and Zurich.
  • Includes the right to be forgotten and the right to an offline life (government cannot force digital connectivity).

• 0:05:29 RDP Vulnerability on Windows for ARM:

  • Discovery of a DLL hijacking vulnerability in mstsc.exe (RDP client) on Windows for ARM in 2023.
  • Chaining DLL hijacking with format string vulnerabilities for remote code execution (RCE).
  • Microsoft confirmed and assigned CVE, marking the speaker's first Windows RCE.

• 0:10:06 Static Security Analysis Tools for Java:

  • Discussion of static code analysis tools for Java to identify security vulnerabilities (e.g., Log4Shell, goto fail).
  • Tools categorized by internal design and features (coding standards, bug lists, SBOM, secrets, API usage, cryptography, data flow analysis).
  • Examples: Error Prone (Google), CodeQL (GitHub), CogniCrypt (Fraunhofer).

• 0:15:44 FSFE vs Apple:

  • Free Software Foundation Europe (FSFE) is intervening in the Apple vs. European Commission litigation to defend the Digital Markets Act (DMA).
  • FSFE aims to prevent Apple from avoiding DMA obligations and protect free software against monopolistic control.
  • Other legal activities: legal advice for developers, organizing a legal expert network, and developing "REUSE Software."

• 0:20:59 Simulation Hypothesis and Quantum Mechanics:

  • Analysis of unplanned effects in video games (e.g., Super Mario, Doom) that resemble quantum mechanical effects (e.g., quantum tunneling, RNG).
  • The hypothesis that quantum mechanics might be an "unwanted effect" if our reality is a simulation.
  • Using old games to study quantum mechanics due to similarities in dynamics and mathematical connections.

• 0:26:50 CO2 Negative Energy Production:

  • Proposal to use wood as a CO2-negative energy source by partially burning it to create coal.
  • Burning wood releases energy for heating/electricity, while coal acts as a long-term carbon sink and fertilizer.
  • Ancient technology, potentially more efficient and profitable than other carbon capture methods.

• 0:32:07 Cellard: Detecting Fake Base Stations on iOS:

  • Cellard is an iOS app (available via TestFlight) that detects fake base stations (IMSI catchers) without requiring a jailbreak.
  • Uses a debug profile to access detailed cell information and packets, even with iOS lockdown mode.
  • Aims to uncover fake base station abuse through an opt-in study.

• 0:36:55 Inflatable Ferris (Rust Mascot):

  • Building a large inflatable Ferris (Rust mascot) for the Rust assembly using PVC foil and an iron.
  • Tips for welding PVC, adding LEDs, and using a projector for pattern tracing.
  • The inflatable is connected to the internet and responds to interactions via "crap.delightful.software".

• 0:41:13 Machine Learning Model Attacks:

  • Overview of attacks against image classifier systems using adversarial examples (small perturbations to input).
  • Examples include misleading autonomous vehicles and bypassing facial recognition.
  • Discussion of digital vs. physical-world attacks and the "Adversarial Robustness Toolbox" for experimenting with attacks.

• 0:45:43 iOS Inactivity Reboot:

  • iOS reboots after 3 days of inactivity (no unlocks) to enhance security (before first unlock state).
  • Reduces the attack surface for remote code execution and limits data access for thieves or law enforcement.
  • Timer duration reduced from 7 days (iOS 16) to 3 days (iOS 17); GrapheneOS uses 18 hours.

• 0:49:59 Querying LLMs with Graphs:

  • Using graphs (e.g., Zachary's karate club) to probe large language models (LLMs) for factual correctness and hallucination.
  • LLMs can partially recall graph structures, but often hallucinate edges.
  • Prompt engineering is crucial, and results correlate with existing hallucination benchmarks.

• 0:54:45 LibreOffice in the Web Browser with wasm:

  • Running LibreOffice in the browser using WebAssembly (wasm) and the emscripten compiler.
  • "LOK বট" (LibreOffice Kit WebAssembly) allows access to LibreOffice APIs from JavaScript via the "ozjs" library.
  • Enables new web applications and integrations with LibreOffice.

• 1:00:32 Youth Hacking for Freedom Competition:

  • Programming competition for 14-18-year-olds in Europe, hosted by the Free Software Foundation Europe (FSFE).
  • Participants develop a free software project over six months, with monthly calls, mentorship, and prizes.
  • Registration is open, and late registration is allowed.

• 1:04:33 Shovel: Network Traffic Analyzer for CTFs:

  • "Shovel" is a web interface built on top of Suricata for live network traffic analysis in Capture the Flag (CTF) competitions.
  • Summarizes flows, detects attacks, and helps identify vulnerabilities.
  • Free and open-source, available on GitHub.

• 1:09:23 Self-Contained Home Automation Infrastructure:

  • A tiny, efficient, and maintainable home automation system based on OpenWrt Linux.
  • Uses a single firmware for all devices, with configuration and logic separated into scripts.
  • Features remote access, web interface, scripting, and integration with other smart home systems.

• 1:14:38 Telescope: RDMA-based Remote Desktop:

  • "Telescope" is an RDMA-based remote desktop solution for uncompressed, high-performance, low-latency streaming.
  • Uses kernel bypass for data transfer, achieving pixel-perfect quality with minimal CPU usage.
  • Based on the "Looking Glass" project and open-source libraries (libfabric).

• 1:18:16 Hios Framework:

  • The objective is to simplify the development and deployment of automated mobile machine systems.
  • Provides a cloud-based core framework that connects user interfaces, planning services, and robots.
  • Supports various interfaces (HTTP, GraphQL, VDA 5050) and allows registration of microservices for specific tasks.
  • Open-source and available on GitHub.